Oracle Financial Services Data Integration Hub vulnerabilities
6 CVEs affecting Oracle Financial Services Data Integration Hub, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-17530, published 2020-12-11.
More from Oracle.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability, published 2020-12-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95.9% chance of exploitation in the next 30 days. Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- CVE-2020-11022, published 2020-04-29. Medium severity, CVSS 6.1. EPSS: 99.2% chance of exploitation in the next 30 days. In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may…
- CVE-2019-0230, published 2020-09-14. Critical severity, CVSS 9.8. EPSS: 96.9% chance of exploitation in the next 30 days. Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
- CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
- CVE-2019-0233, published 2020-09-14. High severity, CVSS 7.5. EPSS: 66.1% chance of exploitation in the next 30 days. An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
- CVE-2015-9251, published 2018-01-18. Medium severity, CVSS 6.1. EPSS: 29.7% chance of exploitation in the next 30 days. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.