Oracle Banking Supply Chain Finance 14.5.0

CPE Details

Oracle Banking Supply Chain Finance 14.5.0
oracle
banking_supply_chain_finance
14.5.0
2021-11-30
19h59 +00:00
2021-12-02
21h36 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*

Informations

Vendor

oracle

Product

banking_supply_chain_finance

Version

14.5.0

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2021-31811 2021-06-12 07h45 +00:00 In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
5.5
Moyen
CVE-2021-31812 2021-06-12 07h45 +00:00 In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
5.5
Moyen
CVE-2021-27906 2021-03-19 16h05 +00:00 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
5.5
Moyen
CVE-2021-23337 2021-02-15 12h15 +00:00 Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
7.2
Haute
CVE-2020-28500 2021-02-15 11h10 +00:00 Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
5.3
Moyen
CVE-2020-28052 2020-12-17 23h52 +00:00 An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
8.1
Haute
CVE-2020-24750 2020-09-17 16h39 +00:00 FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
8.1
Haute
CVE-2020-5413 2020-07-31 19h40 +00:00 Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
9.8
Critique
CVE-2020-8203 2020-07-15 14h10 +00:00 Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
7.4
Haute