CC
Product
Communications Converged Application Server
On CISA KEVExploited in the wildRansomware-linked
16
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 7Medium 3Low 0
Watch
Add Communications Converged Application Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-2725 RansomwareIn wildKEV | 9.8 | Apr 26 | Oracle WebLogic Server, Injection Affected: 5.1; 7.0; 7.1 |
| CVE-2023-21890 | 9.8 | Jan 18 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core) Affected: 7.1.0; 8.0.0 |
| CVE-2018-1000613 | 9.8 | Jul 9 | Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select… Affected: before 7.0.0.1; 7.0.0.1 |
| CVE-2018-1275 | 9.8 | Apr 11 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a… Affected: before 7.0.0.1 |
| CVE-2018-1270 | 9.8 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a… Affected: before 7.0.0.1 |
| CVE-2026-61223 | 9.0 | Jul 21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security) Affected: 8.2.0; 8.3.0 |
| CVE-2018-1258 | 8.8 | May 11 | Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security Affected: before 7.0.0.1 |
| CVE-2026-61225 | 8.1 | Jul 21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core) Affected: 8.2.0; 8.3.0 |
| CVE-2026-61224 | 8.0 | Jul 21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security) Affected: 8.3.0 |
| CVE-2026-61226 | 7.5 | Jul 21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: RTP Proxy) Affected: 8.3.0 |
| CVE-2018-3246 | 7.5 | Oct 17 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services) Affected: before 7.0.0.1 |
| CVE-2018-1000180 | 7.5 | Jun 5 | Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in… Affected: before 7.0.0.1 |
| CVE-2018-1272 | 7.5 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests Affected: before 7.0.0.1 |
| CVE-2018-1257 | 6.5 | May 11 | Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a… Affected: before 7.0.0.1 |
| CVE-2015-9251 | 6.1 | Jan 18 | jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript… Affected: before 7.0.0.1 |
| CVE-2018-1271 | 5.9 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources… Affected: before 7.0.0.1 |
Showing 16