Oracle Enterprise Operations Monitor vulnerabilities

5 CVEs affecting Oracle Enterprise Operations Monitor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-23219, published 2022-01-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-9251, published 2018-01-18. Medium severity, CVSS 6.1. EPSS: 29.7% chance of exploitation in the next 30 days. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVE-2022-23218, published 2022-01-14. Critical severity, CVSS 9.8. EPSS: 5.3% chance of exploitation in the next 30 days. The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may…
CVE-2022-23219, published 2022-01-14. Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days. The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may…
CVE-2021-38604, published 2021-08-12. High severity, CVSS 7.5. EPSS: 3.7% chance of exploitation in the next 30 days. In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was…
CVE-2021-43396, published 2021-11-04. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an…