Oracle Financial Services Crime And Compliance Management Studio vulnerabilities

22 CVEs affecting Oracle Financial Services Crime And Compliance Management Studio, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22978, published 2022-05-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1273: VMware Tanzu Spring Data Commons Property Binder Vulnerability, published 2018-04-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 97% chance of exploitation in the next 30 days. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An…
CVE-2021-34429, published 2021-07-15. Medium severity, CVSS 5.3. EPSS: 99.3% chance of exploitation in the next 30 days. For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security…
CVE-2021-41303, published 2021-09-17. Critical severity, CVSS 9.8. EPSS: 76.1% chance of exploitation in the next 30 days. Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
CVE-2021-23337, published 2021-02-15. High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2021-36090, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35516, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.4% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2022-22978, published 2022-05-19. Critical severity, CVSS 9.8. EPSS: 12.4% chance of exploitation in the next 30 days. In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications…
CVE-2022-25647, published 2022-05-01. High severity, CVSS 7.5. EPSS: 12.2% chance of exploitation in the next 30 days. The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
CVE-2022-23437, published 2022-01-24. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop,…
CVE-2021-35515, published 2021-07-13. High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack…

Latest

CVE-2022-22976, published 2022-05-19. Medium severity, CVSS 5.3. EPSS: 2.3% chance of exploitation in the next 30 days. Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work…
CVE-2022-22971, published 2022-05-12. Medium severity, CVSS 6.5. EPSS: 3.2% chance of exploitation in the next 30 days. In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated…
CVE-2022-22970, published 2022-05-12. Medium severity, CVSS 5.3. EPSS: 2% chance of exploitation in the next 30 days. In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a…
CVE-2022-24823, published 2022-05-06. Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days. Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for…
CVE-2020-36518, published 2022-03-11. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2021-38296, published 2022-03-10. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication…
CVE-2022-23181, published 2022-01-27. High severity, CVSS 7.0. EPSS: 0.7% chance of exploitation in the next 30 days. The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed…