Oracle Healthcare Master Person Index vulnerabilities

14 CVEs affecting Oracle Healthcare Master Person Index, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-45105, published 2021-12-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2018-1270, published 2018-04-06. Critical severity, CVSS 9.8. EPSS: 77.5% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1275, published 2018-04-11. Critical severity, CVSS 9.8. EPSS: 57.4% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1271, published 2018-04-06. Medium severity, CVSS 5.9. EPSS: 34.4% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS,…
CVE-2020-5421, published 2020-09-19. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed…
CVE-2018-15756, published 2018-10-18. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving…
CVE-2016-0635, published 2016-07-21. High severity, CVSS 8.8. EPSS: 5.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component…
CVE-2018-11040, published 2018-06-25. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through…
CVE-2018-1272, published 2018-04-06. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux…

Latest

CVE-2020-5397, published 2020-01-17. Medium severity, CVSS 5.3. EPSS: 2.6% chance of exploitation in the next 30 days. Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module)…
CVE-2018-11039, published 2018-06-25. Medium severity, CVSS 5.9. EPSS: 2.7% chance of exploitation in the next 30 days. Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including…
CVE-2018-1258, published 2018-05-11. High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days. Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain…
CVE-2018-1257, published 2018-05-11. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory…