Banking Digital Experience vulnerabilities | LiveThreat CVE Feed

Product

Banking Digital Experience

by Oracle · last CVE Nov 17, 2021

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities31 In the news0 Timeline

Severity mix

Critical 3High 19Medium 8Low 1

Severity

All severities31 Critical3 High19 Medium8 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Banking Digital Experience to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2020-9546	9.8	5%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-9548	9.8	19%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2019-17495	9.8	6%	Oct 10	A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input… Affected: 18.1 through 18.3; 19.1; 19.2; 20.1; 21.1
CVE-2020-11113	8.8	6%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-11112	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-11111	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-10969	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-10968	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-10673	8.8	8%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-10672	8.8	3%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2021-2351	8.3	2%	Jul 21	Vulnerability in the Advanced Networking Option component of Oracle Database Server Affected: 18.1 through 18.3; 17.2; 19.1; 19.2; 20.1; 21.1
CVE-2020-11987	8.2	13%	Feb 24	Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel Affected: 18.3; 19.1; 19.2; 20.1; 21.1
CVE-2020-14195	8.1	5%	Jun 16	FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-14060	8.1	9%	Jun 14	FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-14061	8.1	4%	Jun 14	FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory,… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2020-14062	8.1	8%	Jun 14	FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to… Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2021-37136	7.5	6%	Oct 19	The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression) Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1; +1 more
CVE-2021-37137	7.5	7%	Oct 19	The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1; +1 more
CVE-2021-35516	7.5	12%	Jul 13	When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs Affected: 18.1 through 18.3; 19.1; 19.2; 20.1; 21.1
CVE-2021-35515	7.5	12%	Jul 13	When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop Affected: 18.1 through 18.3; 19.1; 20.1; 21.1
CVE-2021-36090	7.5	13%	Jul 13	Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 18.1 through 18.3; 19.1; 19.2; 20.1; 21.1
CVE-2021-35517	7.5	11%	Jul 13	Apache Commons Compress 1.1 to 1.20 denial of service vulnerability Affected: 18.1 through 18.3; 19.1; 19.2; 20.1; 21.1
CVE-2020-11022	6.1	99%	Apr 29	In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1; +1 more
CVE-2019-10219	6.1	2%	Nov 8	A vulnerability was found in Hibernate-Validator Affected: 17.2; 18.1; 18.3; 19.1; 19.2; 20.1; +1 more
CVE-2019-11358	6.1	87%	Apr 20	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 18.1; 18.2; 18.3; 19.1; 19.2; 20.1
CVE-2021-41165	5.4	2%	Nov 17	CKEditor4 is an open source WYSIWYG HTML editor Affected: 18.1 through 18.3; 19.1; 19.2; 20.1; 21.1
CVE-2021-41164	5.4	1%	Nov 17	CKEditor4 is an open source WYSIWYG HTML editor Affected: 18.1 through 18.3; 19.1; 19.2; 20.1; 21.1
CVE-2019-3019	5.4	1%	Oct 16	Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Loan Calculator) Affected: 18.1; 18.2; 18.3; 19.1
CVE-2021-28164	5.3	82%	Apr 1	In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources… Affected: 20.1; 21.1
CVE-2021-29425	4.8	11%	Apr 13	Possible limited path traversal vulnerabily in Apache Commons IO Affected: 17.2; 18.1; 18.3; 19.1; 19.2; 20.1; +1 more
CVE-2021-28163	2.7	4%	Apr 1	In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory… Affected: 20.1; 21.1