Oracle Banking Supply Chain Finance vulnerabilities, page 2

26 vulnerabilities

Known vulnerabilities in Oracle Banking Supply Chain Finance, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2020-28500debiannode-lodash+25
EPSS score
7.34%
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.7.4CVE-2020-8203debiannode-lodash+28
EPSS score
5.21%
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.8.1CVE-2020-35728chainguardeco-java-gradle-2.10+110
EPSS score
12.50%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).9.8CVE-2022-22963org.springframework.cloudspring-cloud-function-context+29KEV
EPSS score
99.94%
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.9.8CVE-2019-0228apachejames+14
EPSS score
9.45%
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.7.5CVE-2019-12399apachekafka+13
EPSS score
3.91%
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.