Oracle Financial Services Crime And Compliance Management Studio vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Oracle Financial Services Crime And Compliance Management Studio: 10 record(s), with affected versions and fixes.
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio

CVE-2022-22971 Medium · 6.5 CWE-770 May 12, 2022

Allocation of Resources Without Limits or Throttling in Vmware Spring Framework

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

CVE-2022-22970 Medium · 5.3 CWE-770 May 12, 2022

Denial of service in Spring Framework

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

CVE-2022-23437 Medium · 6.5 CWE-835 Jan 24, 2022

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVE-2021-37714 High · 7.5 CWE-835 Aug 18, 2021

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

CVE-2021-36090 High · 7.5 CWE-130 Jul 13, 2021

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

CVE-2021-35517 High · 7.5 CWE-770 Jul 13, 2021

Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

CVE-2021-23337 High · 7.2 Public exploit CWE-94 Feb 15, 2021

Command Injection

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVE-2020-28500 Medium · 5.3 Feb 15, 2021

Regular Expression Denial of Service (ReDoS)

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CVE-2020-7712 High · 7.2 CWE-78 Aug 30, 2020

Command Injection

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

CVE-2018-1273 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-94 Apr 11, 2018

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.