Oracle Communications Session Border Controller — known CVE vulnerabilities

Every CVE whose affected-product data names Oracle Communications Session Border Controller, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (22)

• CVE-2015-0235 — CVSS 10.0 (critical): Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows…
• CVE-2021-3711 — CVSS 9.8 (critical): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application…
• CVE-2019-5481 — CVSS 9.8 (critical): Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
• CVE-2019-5482 — CVSS 9.8 (critical): Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
• CVE-2018-11236 — CVSS 9.8 (critical): stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the…
• CVE-2018-6485 — CVSS 9.8 (critical): An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and…
• CVE-2021-33909 — CVSS 7.8 (high): fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an…
• CVE-2018-11237 — CVSS 7.8 (high): An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data…
• CVE-2018-16864 — CVSS 7.8 (high): An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in…
• CVE-2018-16865 — CVSS 7.8 (high): An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in…
• CVE-2021-23017 — CVSS 7.7 (high): A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to…
• CVE-2021-3712 — CVSS 7.4 (high): ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a…
• CVE-2020-8203 — CVSS 7.4 (high): Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
• CVE-2021-23337 — CVSS 7.2 (high): Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
• CVE-2021-2414 — CVSS 6.8 (medium): Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported…
• CVE-2019-10219 — CVSS 6.1 (medium): A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of…
• CVE-2020-1971 — CVSS 5.9 (medium): The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName…
• CVE-2019-1559 — CVSS 5.9 (medium): If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive…
• CVE-2020-28500 — CVSS 5.3 (medium): Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd…
• CVE-2020-10722 — CVSS 5.1 (medium): A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could…
• CVE-2020-10723 — CVSS 5.1 (medium): A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a…
• CVE-2021-2416 — CVSS 4.9 (medium): Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported…