Oracle Financial Services Behavior Detection Platform vulnerabilities

12 CVEs affecting Oracle Financial Services Behavior Detection Platform, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-21550, published 2025-01-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 99.9% chance of exploitation in the next 30 days. In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression…
CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-04. EPSS: 99.6% chance of exploitation in the next 30 days. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2022-23437, published 2022-01-24. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop,…
CVE-2021-38153, published 2021-09-22. Medium severity, CVSS 5.9. EPSS: 6.2% chance of exploitation in the next 30 days. Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be…
CVE-2020-36518, published 2022-03-11. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2022-24729, published 2022-03-16. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…
CVE-2022-24728, published 2022-03-16. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to…

Latest

CVE-2025-21550, published 2025-01-21. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Web UI). Supported versions that are affected are 8.0.8.1,…
CVE-2023-21902, published 2023-04-18. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Application). The supported version that is affected is…