Oracle Communications Performance Intelligence Center vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Oracle Communications Performance Intelligence Center: 8 record(s), with affected versions and fixes.cpe:2.3:a:oracle:communications_performance_intelligence_center
CVE-2021-3156
High · 7.8
KEV Urgent · 76 Public exploit CWE-193 Jan 26, 2021
Sudo Heap-Based Buffer Overflow Vulnerability
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CVE-2020-12723
High · 7.5
CWE-120 Jun 5, 2020
Classic Buffer Overflow in Perl
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
CVE-2020-10878
High · 8.6
CWE-190 Jun 5, 2020
Integer Overflow or Wraparound in Perl
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
CVE-2020-10543
High · 8.2
CWE-190 Jun 5, 2020
Integer Overflow or Wraparound in Perl
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
CVE-2019-10086
High · 7.3
CWE-502 Aug 20, 2019
Deserialization of Untrusted Data in Apache Software Foundation Commons Beanutils
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2018-11039
Medium · 5.9
Jun 25, 2018
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and…
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
CVE-2018-1257
Medium · 6.5
May 11, 2018
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and…
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
CVE-2018-1270
Critical · 9.8
CWE-94 Apr 6, 2018
Code Injection in Vmware Spring Framework
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.