Oracle Customer Management And Segmentation Foundation vulnerabilities

9 CVEs affecting Oracle Customer Management And Segmentation Foundation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-41973, published 2021-11-01.

More from Oracle.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
• CVE-2019-13990, published 2019-07-26. Critical severity, CVSS 9.8. EPSS: 16.6% chance of exploitation in the next 30 days. initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
• CVE-2019-12402, published 2019-08-30. High severity, CVSS 7.5. EPSS: 16.2% chance of exploitation in the next 30 days. The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service…
• CVE-2019-14540, published 2019-09-15. Critical severity, CVSS 9.8. EPSS: 10.8% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
• CVE-2019-20330, published 2020-01-03. Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
• CVE-2018-10237, published 2018-04-26. Medium severity, CVSS 5.9. EPSS: 5.1% chance of exploitation in the next 30 days. Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize…
• CVE-2019-16335, published 2019-09-15. Critical severity, CVSS 9.8. EPSS: 4.9% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
• CVE-2021-41973, published 2021-11-01. Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days. In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer…
• CVE-2019-17267, published 2019-10-07. Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.