Oracle Communications Cloud Native Core Network Exposure Function vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Oracle Communications Cloud Native Core Network Exposure Function: 5 record(s), with affected versions and fixes.cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function
CVE-2022-22965
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-94 Apr 1, 2022
Spring Framework JDK 9+ Remote Code Execution Vulnerability
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-917 Apr 1, 2022
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2021-3737
High · 7.5
CWE-400 Mar 4, 2022
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python...
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
CVE-2022-22947
Critical · 10.0
KEV Urgent · 83 Public exploit CWE-917 Mar 3, 2022
VMware Spring Cloud Gateway Code Injection Vulnerability
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
CVE-2021-37159
Medium · 6.4
CWE-415 Jul 21, 2021
Double Free in Linux Linux Kernel
hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.