Oracle Nosql Database vulnerabilities

12 CVEs affecting Oracle Nosql Database, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-21409, published 2021-03-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22883, published 2021-03-03. High severity, CVSS 7.5. EPSS: 77.4% chance of exploitation in the next 30 days. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of…
CVE-2021-23840, published 2021-02-16. High severity, CVSS 7.5. EPSS: 50.7% chance of exploitation in the next 30 days. Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an…
CVE-2021-22884, published 2021-03-03. High severity, CVSS 7.5. EPSS: 36.8% chance of exploitation in the next 30 days. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an…
CVE-2018-14718, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 12.7% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2020-11612, published 2020-04-07. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty…
CVE-2020-13956, published 2020-12-02. Medium severity, CVSS 5.3. EPSS: 9% chance of exploitation in the next 30 days. Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host…
CVE-2018-1320, published 2019-01-07. High severity, CVSS 7.5. EPSS: 8.2% chance of exploitation in the next 30 days. Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine…
CVE-2021-21409, published 2021-03-30. Medium severity, CVSS 5.9. EPSS: 4.9% chance of exploitation in the next 30 days. Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty…
CVE-2018-1000873, published 2018-12-20. Medium severity, CVSS 6.5. EPSS: 4.8% chance of exploitation in the next 30 days. Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…

Latest

CVE-2021-21290, published 2021-02-08. Medium severity, CVSS 5.5. EPSS: 1.8% chance of exploitation in the next 30 days. Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version…
CVE-2020-8908, published 2020-12-10. Low severity, CVSS 3.3. EPSS: 0.9% chance of exploitation in the next 30 days. A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API…