Medium severity · published Jul 21, 2016
CVE-2016-5455
Unspecified vulnerability in the Oracle Communications Messaging Server component in Oracle Communications Applications 6.3, 7.0, and 8.0 allows remote attackers to affect…
5.3
CVSS
2.3%
EPSS
No
On KEV
Description
Unspecified vulnerability in the Oracle Communications Messaging Server component in Oracle Communications Applications 6.3, 7.0, and 8.0 allows remote attackers to affect confidentiality via vectors related to Multiplexor.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Communications Messaging Server · Oracle
6.3; 7.0; 8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5455
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5455
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Third Party Advisory
http://www.securityfocus.com/bid/91787
www.securityfocus.com
http://www.securityfocus.com/bid/91863
www.securitytracker.com
http://www.securitytracker.com/id/1036401
More from Communications Messaging Server
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement
9.8
CVE-2019-0228
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF
9.8
CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…
8.8
CVE-2022-23307
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw