Vulnerabilidades do Oracle Communications Cloud Native Core Network Exposure Function
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Oracle Communications Cloud Native Core Network Exposure Function: 5 registro(s), com versões afetadas e correções.cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function
CVE-2022-22965
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-94 01/04/2022
Spring Framework JDK 9+ Remote Code Execution Vulnerability
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-917 01/04/2022
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2021-3737
Alta · 7.5
CWE-400 04/03/2022
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python...
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
CVE-2022-22947
Crítica · 10.0
KEV Urgente · 83 Exploit público CWE-917 03/03/2022
Vulnerabilidade de Injeção de Código no VMware Spring Cloud Gateway (CVE-2022-22947)
Nas versões do spring cloud gateway anteriores a 3.1.1+ e 3.0.7+, as aplicações são vulneráveis a um ataque de injeção de código quando o endpoint Gateway Actuator está habilitado, exposto e sem proteção. Um atacante remoto poderia enviar uma requisição maliciosamente elaborada que permitiria a execução remota arbitrária no host remoto.
CVE-2021-37159
Média · 6.4
CWE-415 21/07/2021
Double Free em Linux Linux Kernel
hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.