BP
Product
Banking Platform
On CISA KEVExploited in the wild
72
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 29High 28Medium 15Low 0
Watch
Add Banking Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-21343 | 7.5 | Mar 22 | XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: 2.6.2; 2.7.0; 2.7.1; 2.8.0; 2.9.0; 2.10.0 |
| CVE-2020-11979 | 7.5 | Oct 1 | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them Affected: 2.4.0; 2.4.1; 2.6.2; 2.7.0; 2.7.1; 2.8.0 |
| CVE-2019-12399 | 7.5 | Jan 14 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on… Affected: 2.7.0 |
| CVE-2019-12402 | 7.5 | Aug 30 | The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs Affected: 2.6.2; 2.7.0; 2.8.0; 2.9.0 |
| CVE-2019-14439 | 7.5 | Jul 30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2 Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.7.0; +1 more |
| CVE-2018-3246 | 7.5 | Oct 17 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services) Affected: 2.6.0; 2.6.1; 2.6.2 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 2.4.0; 2.7.1; 2.9.0 |
| CVE-2021-43797 | 6.5 | Dec 9 | HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling Affected: 2.6.2 |
| CVE-2020-6950 | 6.5 | Jun 2 | Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter Affected: 2.6.2; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2020-1945 | 6.3 | May 14 | Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak… Affected: 2.4.0 through 2.9.0 |
| CVE-2021-41184 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 2.9.0; 2.12.0 |
| CVE-2021-41183 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 2.9.0; 2.12.0 |
| CVE-2021-41182 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 2.9.0; 2.12.0 |
| CVE-2021-35043 | 6.1 | Jul 19 | OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected) Affected: 2.3.0 through 2.4.1; 2.6.2; 2.7.0; 2.7.1 |
| CVE-2020-27193 | 6.1 | Nov 12 | A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and… Affected: 2.4.0; 2.7.0; 2.7.1; 2.8.0; 2.9.0 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 2.3.0 through 2.4.1; 2.6.2; 2.7.0; 2.7.1 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 2.4.0 through 2.10.0 |
| CVE-2015-9251 | 6.1 | Jan 18 | jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript… Affected: 2.6.0; 2.6.1; 2.6.2 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: 2.6.2; 2.7.1; 2.12.0 |
| CVE-2019-12415 | 5.5 | Oct 23 | In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files… Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.6.2; +3 more |
| CVE-2021-29425 | 4.8 | Apr 13 | Possible limited path traversal vulnerabily in Apache Commons IO Affected: 2.3.0 through 2.4.1; 2.6.2; 2.7.0; 2.7.1 |