Oracle Communications Session Border Controller vulnerabilities

22 CVEs affecting Oracle Communications Session Border Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-2416, published 2021-10-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0235, published 2015-01-28. High severity, CVSS 10.0. EPSS: 94.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors…
CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2021-23017, published 2021-06-01. High severity, CVSS 7.7. EPSS: 53.5% chance of exploitation in the next 30 days. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process…
CVE-2021-3712, published 2021-08-24. High severity, CVSS 7.4. EPSS: 50.4% chance of exploitation in the next 30 days. ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C…
CVE-2021-23337, published 2021-02-15. High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2019-5482, published 2019-09-16. Critical severity, CVSS 9.8. EPSS: 17.9% chance of exploitation in the next 30 days. Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2021-33909, published 2021-07-20. High severity, CVSS 7.8. EPSS: 9.7% chance of exploitation in the next 30 days. fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root…
CVE-2019-5481, published 2019-09-16. Critical severity, CVSS 9.8. EPSS: 7.5% chance of exploitation in the next 30 days. Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2020-28500, published 2021-02-15. Medium severity, CVSS 5.3. EPSS: 7.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Latest

CVE-2021-2416, published 2021-10-20. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported versions that are affected are 8.4 and 9.0. Easily exploitable…
CVE-2021-2414, published 2021-10-20. Medium severity, CVSS 6.8. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported versions that are affected are 8.4 and 9.0. Easily exploitable…
CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…
CVE-2020-8203, published 2020-07-15. High severity, CVSS 7.4. EPSS: 5.2% chance of exploitation in the next 30 days. Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.