Oracle Enterprise Communications Broker vulnerabilities

28 CVEs affecting Oracle Enterprise Communications Broker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-3712, published 2021-08-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2019-9513, published 2019-08-13. High severity, CVSS 7.5. EPSS: 81.6% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the…
CVE-2019-9511, published 2019-08-13. High severity, CVSS 7.5. EPSS: 59.5% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data…
CVE-2014-9708, published 2015-03-31. Medium severity, CVSS 5.0. EPSS: 56.2% chance of exploitation in the next 30 days. Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by "Range:…
CVE-2021-23017, published 2021-06-01. High severity, CVSS 7.7. EPSS: 53.5% chance of exploitation in the next 30 days. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process…
CVE-2021-3712, published 2021-08-24. High severity, CVSS 7.4. EPSS: 50.4% chance of exploitation in the next 30 days. ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C…
CVE-2021-23337, published 2021-02-15. High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2020-28500, published 2021-02-15. Medium severity, CVSS 5.3. EPSS: 7.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2018-11236, published 2018-05-18. Critical severity, CVSS 9.8. EPSS: 7.1% chance of exploitation in the next 30 days. stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit…

Latest

CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…
CVE-2020-14722, published 2020-07-15. Medium severity, CVSS 5.8. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are affected are 3.0.0-3.2.0. Difficult to…
CVE-2020-14721, published 2020-07-15. Medium severity, CVSS 6.3. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are affected are 3.0.0-3.2.0. Easily…
CVE-2020-14563, published 2020-07-15. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are affected are 3.0.0-3.2.0. Easily…