Oracle Banking Credit Facilities Process Management vulnerabilities, page 2
27 vulnerabilities
Known vulnerabilities in Oracle Banking Credit Facilities Process Management, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-28052apachekaraf+28
EPSS score7.22%
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.CVE-2020-28500debiannode-lodash+25EPSS score7.34%
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.CVE-2020-8203debiannode-lodash+28EPSS score5.21%
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.CVE-2020-35728chainguardeco-java-gradle-2.10+110EPSS score12.50%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).CVE-2022-22963org.springframework.cloudspring-cloud-function-context+29KEVEPSS score99.94%
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.CVE-2019-0228apachejames+14EPSS score9.45%
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.CVE-2019-12399apachekafka+13EPSS score3.91%
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.