Oracle Financial Services Retail Customer Analytics vulnerabilities

9 CVEs affecting Oracle Financial Services Retail Customer Analytics, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-9488, published 2020-04-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2020-9488, published 2020-04-27. Low severity, CVSS 3.7. EPSS: 8.2% chance of exploitation in the next 30 days. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log…
CVE-2020-10673, published 2020-03-18. High severity, CVSS 8.8. EPSS: 8% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVE-2020-11113, published 2020-03-31. High severity, CVSS 8.8. EPSS: 6.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2020-9546, published 2020-03-02. Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded…
CVE-2020-11112, published 2020-03-31. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka…
CVE-2020-10968, published 2020-03-26. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
CVE-2020-10969, published 2020-03-26. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVE-2020-10672, published 2020-03-18. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka…