CP
Product
Communications Policy Management
On CISA KEVExploited in the wild
50
CVEs
3
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 12High 22Medium 6Low 1
Watch
Add Communications Policy Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22965 In wildKEV | 9.8 | Apr 1 | Spring Framework JDK 9+ Remote Code Execution Vulnerability Affected: 12.6.0.0.0 |
| CVE-2020-17530 In wildKEV | 9.8 | Dec 11 | Apache Struts Remote Code Execution Vulnerability Affected: 12.5.0 |
| CVE-2018-11776 In wildKEV | 8.1 | Aug 22 | Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like… Affected: before 12.5.0 |
| CVE-2021-21345 | 9.9 | Mar 22 | XStream is vulnerable to a Remote Command Execution attack Affected: 12.5.0 |
| CVE-2021-23450 | 9.8 | Dec 17 | Prototype Pollution Affected: 12.6.0.0.0 |
| CVE-2021-43527 | 9.8 | Dec 8 | NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures Affected: 12.6.0.0.0 |
| CVE-2021-21350 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 12.5.0 |
| CVE-2021-21344 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 12.5.0 |
| CVE-2021-21346 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 12.5.0 |
| CVE-2021-21347 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 12.5.0 |
| CVE-2019-0230 | 9.8 | Sep 14 | Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution Affected: 12.5.0 |
| CVE-2021-21351 | 9.1 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 12.5.0 |
| CVE-2021-21342 | 9.1 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: 12.5.0 |
| CVE-2020-26217 | 8.8 | Nov 16 | Remote Code Execution in XStream Affected: 12.5.0 |
| CVE-2021-21349 | 8.6 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: 12.5.0 |
| CVE-2020-36182 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36180 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36179 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-24750 | 8.1 | Sep 17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to… Affected: 12.5.0 |
| CVE-2020-24616 | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… Affected: 12.5.0 |
| CVE-2020-5258 | 7.7 | Mar 10 | Prototype pollution in dojo Affected: 12.5.0 |
| CVE-2021-43859 | 7.5 | Feb 1 | XStream is an open source java library to serialize objects to XML and back again Affected: 12.6.0.0.0 |
| CVE-2021-21348 | 7.5 | Mar 22 | XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) Affected: 12.5.0 |
| CVE-2021-21343 | 7.5 | Mar 22 | XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights Affected: 12.5.0 |
| CVE-2019-0233 | 7.5 | Sep 14 | An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload Affected: 12.5.0 |
| CVE-2020-5398 | 7.5 | Jan 16 | RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application Affected: 12.5.0 |
| CVE-2017-3633 | 6.5 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached) Affected: 12.0 through 12.0.0.4.0; 12.1.0 through 12.1.2; 12.2.0 through 12.2.2; 12.3; 12.3.1; 12.4.0; +3 more |
| CVE-2017-10159 | 6.1 | Oct 19 | Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Portal, CMP) Affected: 11.5; 12.0 |
| CVE-2018-1271 | 5.9 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources… Affected: 12.5.0 |
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: 12.5.0 |
| CVE-2020-5397 | 5.3 | Jan 17 | Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux… Affected: 12.5.0 |
| CVE-2021-29425 | 4.8 | Apr 13 | Possible limited path traversal vulnerabily in Apache Commons IO Affected: 12.5.0.0.0 |
| CVE-2015-2808 | 3.7 | Apr 1 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for… Affected: before 9.9.2 |
| CVE-2015-2568 | – | Apr 16 | Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server :… Affected: through 9.7.3; 9.9.1; 10.4.1; 12.1.1 |
| CVE-2015-0500 | – | Apr 16 | Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors Affected: through 9.7.3; 9.9.1; 10.4.1; 12.1.1 |
| CVE-2015-0433 | – | Apr 16 | Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB… Affected: through 9.7.3; 9.9.1; 10.4.1; 12.1.1 |
| CVE-2015-0423 | – | Apr 16 | Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer Affected: through 9.7.3; 9.9.1; 10.4.1; 12.1.1 |
| CVE-2015-0235 | – | Jan 28 | Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary… Affected: 9.7.3; 9.9.1; 10.4.1; 11.5; 12.1.1 |
| CVE-2015-0411 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via… Affected: through 9.7.3; 9.9.1; 10.4.1; 12.1.1 |
| CVE-2015-0409 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer Affected: through 9.7.3; 9.9.1; 10.4.1; 12.1.1 |
| CVE-2015-0382 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server :… Affected: through 9.7.3; 9.9.1; 10.4.1; 12.1.1 |
| CVE-2015-0381 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server :… Affected: through 9.7.3; 9.9.1; 10.4.1; 12.1.1 |
Showing 50