Communications Policy Management vulnerabilities

3 known vulnerabilities in Communications Policy Management from Oracle. 3 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Spring Framework JDK 9+ Remote Code Execution Exploited

  CVE-2022-22965Apr 1, 2022Spring FrameworkEPSS 99.6%

  A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot

• 9.8 Critical severity

  Apache Struts Remote Code Execution Exploited

  CVE-2020-17530Dec 11, 2020ApacheEPSS 96.3%

  Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

• 8.1 High severity

  Apache Struts Remote Code Execution Exploited

  CVE-2018-11776Aug 22, 2018ApacheEPSS 100%

  Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its uppe