Skip to content

Product

oracle banking platform vulnerabilities

72 published CVES affecting oracle banking platform, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
72
Critical
29
High
28
Medium
15
Low
0
Unscored
0
CISA KEV
1

Latest oracle banking platform CVEs

Newest publication first · page 1 of 3

  3. CVE-2021-41184 XSS in the `of` option of the `.position()` util

    Published
    MediumCVSS 6.1 EPSS 40.8%

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is no...

  4. CVE-2021-41182 XSS in the `altField` option of the Datepicker widget

    Published
    MediumCVSS 6.1 EPSS 39.4% PoC

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField...

  5. CVE-2021-41183 XSS in `*Text` options of the Datepicker widget

    Published
    MediumCVSS 6.1 EPSS 8.5%

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text op...

  6. CVE-2021-2351 Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

    Published
    HighCVSS 7.5 EPSS 2.4%

    Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced N...

  7. CVE-2021-35043 Cross-site Scripting in OWASP AntiSamy

    Published
    MediumCVSS 6.1 EPSS 1.5%

    OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

  10. CVE-2021-29425 Possible limited path traversal vulnerabily in Apache Commons IO

    Published
    MediumCVSS 4.8 EPSS 10.5% PoC

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limite...

  12. CVE-2021-21349 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    Published
    HighCVSS 8.6 EPSS 46.8%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stre...

  13. CVE-2021-21350 XStream is vulnerable to an Arbitrary Code Execution attack

    Published
    CriticalCVSS 9.8 EPSS 15.2%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the reco...

  14. CVE-2021-21351 XStream is vulnerable to an Arbitrary Code Execution attack

    Published
    CriticalCVSS 9.1 EPSS 82.1%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected,...

  15. CVE-2021-21341 XStream can cause a Denial of Service

    Published
    HighCVSS 7.5 EPSS 77.8%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting...

  16. CVE-2021-21342 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    Published
    CriticalCVSS 9.1 EPSS 50.0%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new inst...

  18. CVE-2021-21344 XStream is vulnerable to an Arbitrary Code Execution attack

    Published
    CriticalCVSS 9.8 EPSS 76.0%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is aff...

  19. CVE-2021-21345 XStream is vulnerable to a Remote Command Execution attack

    Published
    CriticalCVSS 9.9 EPSS 72.3%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is...

  20. CVE-2021-21346 XStream is vulnerable to an Arbitrary Code Execution attack

    Published
    CriticalCVSS 9.8 EPSS 76.4%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is aff...

  21. CVE-2021-21347 XStream is vulnerable to an Arbitrary Code Execution attack

    Published
    CriticalCVSS 9.8 EPSS 14.3%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is aff...

  22. CVE-2020-13936 Velocity Sandbox Bypass

    Published
    HighCVSS 8.8 EPSS 22.7%

    An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity template...

  23. CVE-2020-36189 Unsafe Deserialization in jackson-databind

    Published
    HighCVSS 8.1 EPSS 4.0%

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.