CM
Product
Communications Messaging Server
40
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 20Medium 14Low 0
Watch
Add Communications Messaging Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-23305 | 9.8 | Jan 18 | By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout Affected: 8.1 |
| CVE-2020-11656 | 9.8 | Apr 9 | In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement Affected: 8.1 |
| CVE-2019-0228 | 9.8 | Apr 17 | Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF Affected: 8.1 |
| CVE-2017-5645 | 9.8 | Apr 17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary… Affected: before 8.0.2 |
| CVE-2022-23307 | 8.8 | Jan 18 | CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw Affected: 8.1 |
| CVE-2022-23302 | 8.8 | Jan 18 | JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration… Affected: 8.1 |
| CVE-2020-36189 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.2; 8.1 |
| CVE-2020-28052 | 8.1 | Dec 18 | An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66 Affected: 8.0.2; 8.1 |
| CVE-2020-24750 | 8.1 | Sep 17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.1 |
| CVE-2020-24616 | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… Affected: 8.1 |
| CVE-2021-4104 | 7.5 | Dec 14 | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration Affected: 8.1 |
| CVE-2021-40690 | 7.5 | Sep 19 | Bypass of the secureValidation property Affected: 8.1 |
| CVE-2021-37714 | 7.5 | Aug 18 | Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions Affected: 8.1 |
| CVE-2021-35516 | 7.5 | Jul 13 | When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs Affected: 8.1 |
| CVE-2021-35515 | 7.5 | Jul 13 | When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop Affected: 8.1 |
| CVE-2021-36090 | 7.5 | Jul 13 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 8.1 |
| CVE-2021-35517 | 7.5 | Jul 13 | Apache Commons Compress 1.1 to 1.20 denial of service vulnerability Affected: 8.1 |
| CVE-2021-33813 | 7.5 | Jun 16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request Affected: 8.1 |
| CVE-2021-30468 | 7.5 | Jun 16 | A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an… Affected: 8.1 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: 8.0.2; 8.1 |
| CVE-2020-13871 | 7.5 | Jun 6 | SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late Affected: 8.1 |
| CVE-2020-11655 | 7.5 | Apr 9 | SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is… Affected: 8.1 |
| CVE-2020-11612 | 7.5 | Apr 7 | The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream Affected: 8.1 |
| CVE-2020-9327 | 7.5 | Feb 21 | In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations Affected: 8.1 |
| CVE-2020-13954 | 6.1 | Nov 12 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: 8.0.2; 8.1 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: 8.1 |
| CVE-2021-21409 | 5.9 | Mar 30 | Possible request smuggling in HTTP/2 due missing validation of content-length Affected: 8.1 |
| CVE-2021-31812 | 5.5 | Jun 12 | In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file Affected: 8.1 |
| CVE-2021-31811 | 5.5 | Jun 12 | In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file Affected: 8.1 |
| CVE-2021-28657 | 5.5 | Mar 31 | A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25 Affected: 8.1 |
| CVE-2021-27906 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file Affected: 8.1 |
| CVE-2021-27807 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an infinite loop while loading the file Affected: 8.1 |
| CVE-2021-21290 | 5.5 | Feb 8 | Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files Affected: 8.1 |
| CVE-2020-15358 | 5.5 | Jun 27 | In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant… Affected: 8.1 |
| CVE-2020-9489 | 5.5 | Apr 27 | A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser Affected: 8.1 |
| CVE-2020-1951 | 5.5 | Mar 23 | A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23 Affected: 8.0.2; 8.1 |
| CVE-2020-1950 | 5.5 | Mar 23 | A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23 Affected: 8.0.2; 8.1 |
| CVE-2016-5455 | 5.3 | Jul 21 | Unspecified vulnerability in the Oracle Communications Messaging Server component in Oracle Communications Applications 6.3, 7.0, and 8.0 allows remote attackers to affect… Affected: 6.3; 7.0; 8.0 |
| CVE-2014-7926 | – | Jan 22 | The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers… Affected: 7.0.5; 8.0 |
| CVE-2014-7923 | – | Jan 22 | The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers… Affected: 7.0.5; 8.0 |
Showing 40