Oracle Real User Experience Insight vulnerabilities

16 CVEs affecting Oracle Real User Experience Insight, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-2351, published 2021-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3518, published 2021-05-18. High severity, CVSS 8.8. EPSS: 21.9% chance of exploitation in the next 30 days. There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The…
CVE-2021-3517, published 2021-05-19. High severity, CVSS 8.6. EPSS: 17% chance of exploitation in the next 30 days. There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the…
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2020-7595, published 2020-01-21. High severity, CVSS 7.5. EPSS: 7.8% chance of exploitation in the next 30 days. xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
CVE-2019-19956, published 2019-12-24. High severity, CVSS 7.5. EPSS: 5.6% chance of exploitation in the next 30 days. xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
CVE-2018-11058, published 2018-09-14. Critical severity, CVSS 9.8. EPSS: 4% chance of exploitation in the next 30 days. RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read…
CVE-2021-3537, published 2021-05-14. Medium severity, CVSS 5.9. EPSS: 3.6% chance of exploitation in the next 30 days. A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed…
CVE-2018-11054, published 2018-08-31. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service.
CVE-2019-20388, published 2020-01-21. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
CVE-2020-24977, published 2020-09-04. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

Latest

CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…