Oracle - Financial Services Behavior Detection Platform CVE

Filtered by vendor Oracle Subscribe

Filtered by product Financial Services Behavior Detection Platform

Total 11 CVE

CVE	Vendors	Products	Updated	CVSS v2	CVSS v3
CVE-2023-21902	1 Oracle	1 Financial Services Behavior Detection Platform	2024-11-21	N/A	4.3 MEDIUM
Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Application). The supported version that is affected is 8.0.8.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Financial Services Behavior Detection Platform accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVE-2022-24729	4 Ckeditor, Drupal, Fedoraproject and 1 more	9 Ckeditor, Drupal, Fedora and 6 more	2024-11-21	5.0 MEDIUM	6.5 MEDIUM
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
CVE-2022-24728	4 Ckeditor, Drupal, Fedoraproject and 1 more	9 Ckeditor, Drupal, Fedora and 6 more	2024-11-21	3.5 LOW	5.4 MEDIUM
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
CVE-2022-23437	3 Apache, Netapp, Oracle	29 Xerces-j, Active Iq Unified Manager, Agile Engineering Data Management and 26 more	2024-11-21	7.1 HIGH	6.5 MEDIUM
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
CVE-2022-22965	5 Cisco, Oracle, Siemens and 2 more	39 Cx Cloud Agent, Commerce Platform, Communications Cloud Native Core Automated Test Suite and 36 more	2024-11-21	7.5 HIGH	9.8 CRITICAL
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963	2 Oracle, Vmware	28 Banking Branch, Banking Cash Management, Banking Corporate Lending Process Management and 25 more	2024-11-21	7.5 HIGH	9.8 CRITICAL
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2021-38153	3 Apache, Oracle, Quarkus	8 Kafka, Communications Brm - Elastic Charging Engine, Communications Cloud Native Core Policy and 5 more	2024-11-21	4.3 MEDIUM	5.9 MEDIUM
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
CVE-2021-2351	1 Oracle	111 Advanced Networking Option, Agile Engineering Data Management, Agile Plm and 108 more	2024-11-21	5.1 MEDIUM	8.3 HIGH
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVE-2020-36518	4 Debian, Fasterxml, Netapp and 1 more	36 Debian Linux, Jackson-databind, Active Iq Unified Manager and 33 more	2024-11-21	5.0 MEDIUM	7.5 HIGH
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2019-10219	3 Netapp, Oracle, Redhat	195 Active Iq Unified Manager, Element, Management Services For Element Software And Netapp Hci and 192 more	2024-11-21	4.3 MEDIUM	6.1 MEDIUM
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
CVE-2017-5645	4 Apache, Netapp, Oracle and 1 more	79 Log4j, Oncommand Api Services, Oncommand Insight and 76 more	2024-11-21	7.5 HIGH	9.8 CRITICAL
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Vulnerabilities (CVE)