Oracle Enterprise Communications Broker vulnerabilities, page 2
28 vulnerabilities
Known vulnerabilities in Oracle Enterprise Communications Broker, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-10723canonicalubuntu_linux+8
EPSS score0.38%
A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.CVE-2020-10726debiandpdk+6EPSS score0.47%
A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.CVE-2020-28500debiannode-lodash+25EPSS score7.34%
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.CVE-2020-8203debiannode-lodash+28EPSS score5.21%
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.CVE-2014-9708embedthisappweb+2EPSS score56.19%
Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by "Range: x=,".CVE-2019-9511apachetraffic_server+28EPSS score59.55%
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.CVE-2019-9513apachetraffic_server+28EPSS score81.56%
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.CVE-2019-10219debianlibhibernate-validator-java+191EPSS score2.16%
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.