Communications Cloud Native Core Binding Support Function vulnerabilities

6 known vulnerabilities in Communications Cloud Native Core Binding Support Function from Oracle. 6 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Spring Framework JDK 9+ Remote Code Execution Exploited

  CVE-2022-22965Apr 1, 2022Spring FrameworkEPSS 99.6%

  A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot

• 7.8 High severity

  kernel: Use After Free

  CVE-2022-1011Mar 18, 2022KernelEPSS 1.17%

  A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

• 10.0 Critical severity

  VMware Spring Cloud Gateway Code Injection Exploited

  CVE-2022-22947Mar 3, 2022Spring Cloud GatewayEPSS 98.3%

  In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could all

• 7.8 High severity

  Linux Kernel: Improper Privilege Management

  CVE-2022-25636Feb 24, 2022LinuxEPSS 2.63%

  net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.

• 9.8 Critical severity

  SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Buffer Copy without Checking Size of Input

  CVE-2022-23219Jan 14, 2022SiemensEPSS 5.03%

  The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a deni

• 8.5 High severity

  XStream Remote Code Execution Exploited

  CVE-2021-39144Aug 23, 2021X-streamEPSS 98.1%

  XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affect