FS
Product
Financial Services Analytical Applications Infrastructure
On CISA KEVExploited in the wild
88
CVEs
3
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 18High 30Medium 39Low 1
Watch
Add Financial Services Analytical Applications Infrastructure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22965 In wildKEV | 9.8 | Apr 1 | Spring Framework JDK 9+ Remote Code Execution Vulnerability Affected: 8.1.1; 8.1.2.0 |
| CVE-2022-22963 In wildKEV | 9.8 | Apr 1 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability Affected: 8.1.1.0; 8.1.2.0 |
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 7.3.3.0.0 through 7.3.5.3.0; 8.0.0.0.0 through 8.0.9.0.0 |
| CVE-2018-14721 | 10.0 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 8.0.2; 8.0.3; 8.0.4; 8.0.5; 8.0.6; 8.0.7 |
| CVE-2025-53037 | 9.8 | Oct 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform) Affected: 8.0.7.9.0; 8.0.8.7.0; 8.1.2.5.0 |
| CVE-2020-10683 | 9.8 | May 1 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks Affected: 8.0.6 through 8.1.0 |
| CVE-2020-9546 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.6 through 8.1.0 |
| CVE-2019-16335 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 8.0.2 through 8.0.8 |
| CVE-2019-14540 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 8.0.2 through 8.0.8 |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 8.0.2 through 8.0.8 |
| CVE-2019-3773 | 9.8 | Jan 18 | Spring Web Services XML External Entity Injection (XXE) Affected: 8.0.6 through 8.1.0 |
| CVE-2018-14720 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 8.0.2; 8.0.3; 8.0.4; 8.0.5; 8.0.6; 8.0.7 |
| CVE-2018-14718 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: 8.0.2; 8.0.3; 8.0.4; 8.0.5; 8.0.6; 8.0.7 |
| CVE-2018-14719 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: 8.0.2; 8.0.3; 8.0.4; 8.0.5; 8.0.6; 8.0.7 |
| CVE-2018-8013 | 9.8 | May 24 | In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the… Affected: 7.3.3.0.0 through 7.3.3.0.2; 8.0.0.0.0 through 8.0.7.1.0 |
| CVE-2017-7525 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: 8.0.2.0.0; 8.0.3.0.0; 8.0.4.0.0; 8.0.5.0.0; 8.0.6.0.0; 8.0.7.0.0 |
| CVE-2017-15095 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: 8.0.2; 8.0.3; 8.0.4; 8.0.5; 8.0.6; 8.0.7 |
| CVE-2017-5645 | 9.8 | Apr 17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary… Affected: 7.3.3.0.0 through 7.3.3.0.2; 8.0.0.0.0 through 8.0.7.0.0 |
| CVE-2021-26291 | 9.1 | Apr 23 | Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a… Affected: 8.0.6.0.0 through 8.0.9.0.0; 8.1.0.0.0 through 8.1.2.0 |
| CVE-2020-11113 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 8.0.6 through 8.1.0 |
| CVE-2020-11112 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.6 through 8.1.0 |
| CVE-2020-10969 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 8.0.6 through 8.1.0 |
| CVE-2020-10968 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 8.0.6 through 8.1.0 |
| CVE-2020-10673 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 8.0.6 through 8.1.0 |
| CVE-2020-10672 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.6 through 8.1.0 |
| CVE-2025-53036 | 8.6 | Oct 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform) Affected: 8.0.7.9.0; 8.0.8.7.0; 8.1.2.5.0 |
| CVE-2020-14824 | 8.6 | Oct 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure) Affected: 8.0.6.0.0 through 8.1.0.0.0 |
| CVE-2021-2351 | 8.3 | Jul 21 | Vulnerability in the Advanced Networking Option component of Oracle Database Server Affected: 8.0.7 through 8.1.1 |
| CVE-2025-61751 | 8.1 | Oct 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform) Affected: 8.0.7.9.0; 8.0.8.7.0; 8.1.2.5.0 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 8.0.8 through 8.1.1 |
| CVE-2026-34310 | 7.5 | Apr 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform) Affected: 8.0.7.9.0; 8.0.8.7.0; 8.1.2.5.0 |
| CVE-2026-22010 | 7.5 | Apr 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform) Affected: 8.0.7.9.0; 8.0.8.7.0; 8.1.2.5.0 |
| CVE-2025-61756 | 7.5 | Oct 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: System Configuration) Affected: 8.0.7.9.0; 8.0.8.7.0; 8.1.2.5.0 |
| CVE-2022-24729 | 7.5 | Mar 16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 8.0.7.0.0 through 8.1.0.0.0; 8.1.1.0; 8.1.2.0; 8.1.2.1 |
| CVE-2020-36518 | 7.5 | Mar 11 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects Affected: 8.0.7 through 8.1.0.0; 8.1.1.0; 8.1.2.0; 8.1.2.1 |
| CVE-2021-36090 | 7.5 | Jul 13 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 8.0.6 through 8.1.1 |
| CVE-2019-17566 | 7.5 | Nov 12 | Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes Affected: 8.0.6 through 8.1.0 |
| CVE-2020-11979 | 7.5 | Oct 1 | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them Affected: 8.0.6 through 8.0.9; 8.1.0; 8.1.1 |
| CVE-2019-12399 | 7.5 | Jan 14 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on… Affected: 8.0.6 through 8.1.0 |
| CVE-2019-17359 | 7.5 | Oct 8 | The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data Affected: 8.0.6 through 8.0.9 |
| CVE-2019-14439 | 7.5 | Jul 30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2 Affected: 8.0.2 through 8.0.8 |
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 7.3.3 through 7.3.5; 8.0.0 through 8.0.8 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 8.0.2 through 8.0.8 |
| CVE-2023-21901 | 7.4 | Jan 16 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure) Affected: 8.0.7; 8.0.8; 8.0.9; 8.1.0; 8.1.1; 8.1.2 |
| CVE-2018-2660 | 7.4 | Jan 18 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure component of Oracle Financial Services Applications (subcomponent: Core) Affected: 7.3.5.0.0; 7.3.5.1.0; 7.3.5.2.0; 7.3.5.3.0; 8.0.0.0.0; 8.0.1.0.0; +4 more |
| CVE-2020-14602 | 7.1 | Jul 15 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure) Affected: 8.0.6 through 8.1.0 |
| CVE-2020-2793 | 7.1 | Apr 15 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure) Affected: 8.0.6.0.0 through 8.0.9.0.0 |
| CVE-2020-2688 | 7.1 | Jan 15 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Object Migration) Affected: 8.0.4 through 8.0.8 |
| CVE-2026-34325 | 6.8 | Apr 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interface) Affected: 8.0.7.9.0; 8.0.8.7.0; 8.1.2.5.0 |
| CVE-2026-34314 | 6.8 | Apr 21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform) Affected: 8.0.7.9.0; 8.0.8.7.0; 8.1.2.5.0 |