CC
Product
Communications Cloud Native Core Network Repository Function
On CISA KEVExploited in the wild
23
CVEs
3
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 5High 8Medium 8Low 2
Watch
Add Communications Cloud Native Core Network Repository Function to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22947 In wildKEV | 10.0 | Mar 3 | VMware Spring Cloud Gateway Code Injection Vulnerability Affected: 1.15.0; 1.15.1; 22.1.2; 22.2.0 |
| CVE-2022-22965 In wildKEV | 9.8 | Apr 1 | Spring Framework JDK 9+ Remote Code Execution Vulnerability Affected: 1.15.0; 22.1.0 |
| CVE-2022-22963 In wildKEV | 9.8 | Apr 1 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability Affected: 1.15.0; 22.1.0 |
| CVE-2022-23219 | 9.8 | Jan 14 | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating… Affected: 22.1.2; 22.2.0 |
| CVE-2021-43527 | 9.8 | Dec 8 | NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures Affected: 1.15.0; 1.15.1 |
| CVE-2019-13734 | 8.8 | Dec 10 | Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page Affected: 1.14.0 |
| CVE-2021-22901 | 8.1 | Jun 11 | curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection Affected: 1.15.0; 1.15.1 |
| CVE-2020-36518 | 7.5 | Mar 11 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects Affected: 22.1.2; 22.2.0 |
| CVE-2022-23308 | 7.5 | Feb 26 | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes Affected: 22.1.2; 22.2.0 |
| CVE-2021-43396 | 7.5 | Nov 4 | In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is… Affected: 22.1.2; 22.2.0 |
| CVE-2021-22946 | 7.5 | Sep 29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line… Affected: 1.15.0; 1.15.1; 22.1.0; 22.2.0 |
| CVE-2021-38604 | 7.5 | Aug 12 | In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference Affected: 22.1.2; 22.2.0 |
| CVE-2021-33560 | 7.5 | Jun 8 | Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window… Affected: 1.14.0; 1.15.0; 1.15.1 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 1.14.0 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: 1.15.0; 1.15.1 |
| CVE-2021-22947 | 5.9 | Sep 29 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple… Affected: 1.15.0; 1.15.1; 22.1.2; 22.2.0 |
| CVE-2020-14340 | 5.9 | Jun 2 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles Affected: 1.14.0 |
| CVE-2022-22946 | 5.5 | Mar 4 | In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an… Affected: 22.1.2; 22.2.0 |
| CVE-2021-22569 | 5.5 | Jan 10 | An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order Affected: 1.15.0; 1.15.1 |
| CVE-2021-22897 | 5.3 | Jun 11 | curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the… Affected: 1.15.0; 1.15.1 |
| CVE-2021-29425 | 4.8 | Apr 13 | Possible limited path traversal vulnerabily in Apache Commons IO Affected: 1.14.0 |
| CVE-2020-8908 | 3.3 | Dec 10 | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory… Affected: 1.14.0 |
| CVE-2021-22898 | 3.1 | Jun 11 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content… Affected: 1.15.0; 1.15.1 |
Showing 23