Oracle Jd Edwards World Security vulnerabilities

14 CVEs affecting Oracle Jd Edwards World Security, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-4160, published 2022-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2017-3730, published 2017-05-04. High severity, CVSS 7.5. EPSS: 55.3% chance of exploitation in the next 30 days. In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a…
CVE-2020-1967, published 2020-04-21. High severity, CVSS 7.5. EPSS: 53.3% chance of exploitation in the next 30 days. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the…
CVE-2021-23840, published 2021-02-16. High severity, CVSS 7.5. EPSS: 50.7% chance of exploitation in the next 30 days. Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an…
CVE-2021-3712, published 2021-08-24. High severity, CVSS 7.4. EPSS: 50.4% chance of exploitation in the next 30 days. ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C…
CVE-2021-3450, published 2021-03-25. High severity, CVSS 7.4. EPSS: 18.3% chance of exploitation in the next 30 days. The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2020-9488, published 2020-04-27. Low severity, CVSS 3.7. EPSS: 8.2% chance of exploitation in the next 30 days. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log…
CVE-2021-23841, published 2021-02-16. Medium severity, CVSS 5.9. EPSS: 7.4% chance of exploitation in the next 30 days. The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails…

Latest

CVE-2021-4160, published 2022-01-28. Medium severity, CVSS 5.9. EPSS: 3.8% chance of exploitation in the next 30 days. There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because…
CVE-2021-23839, published 2021-02-16. Low severity, CVSS 3.7. EPSS: 3% chance of exploitation in the next 30 days. OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version…
CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…
CVE-2020-1968, published 2020-09-09. Low severity, CVSS 3.7. EPSS: 4.9% chance of exploitation in the next 30 days. The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based…