Known vulnerabilities in Oracle Communications Application Session Controller

Known vulnerabilities in Oracle Communications Application Session Controller

Vendor: Oracle

Software: Oracle Communications Application Session Controller

Software CPE: cpe:2.3:a:oracle:oracle_communications_application_session_controller:*:*:*:*:*:*:*:*

Website: https://www.oracle.com

Total vulnerabilities: 13

Public exploits: 2

Known exploited (KEV): 0

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (13)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU52501 - Server-Side Request Forgery (SSRF) CVE-2020-11987	CWE-918	Medium	No	No	-	23.04.2021	SB2021042315 SB2021042316 SB2021042514 and 32 more
#VU49086 - Comparison using wrong factors CVE-2020-28052	CWE-1025	High	Available	No	-	18.12.2020	SB2020121801 SB2021031707 SB2021042112 and 16 more
#VU48942 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CVE-2020-27216	CWE-362	Low	No	No	-	23.10.2020	SB2020121307 SB2020121308 SB2021012011 and 27 more
#VU30113 - Improper input validation CVE-2020-5258	CWE-20	Low	No	No	-	16.07.2020	SB2020071699 SB2021072124 SB2021072134 and 17 more
#VU34161 - Operation on a Resource after Expiration or Release CVE-2019-17638	CWE-672	High	No	No	-	09.07.2020	SB2020070939 SB2020081709 SB2020102107 and 11 more
#VU29068 - Server-Side Request Forgery (SSRF) CVE-2019-17566	CWE-918	Medium	No	No	-	16.06.2020	SB2020061613 SB2020062304 SB2020072310 and 23 more
#VU28238 - Exposed Dangerous Method or Function CVE-2020-10683	CWE-749	Medium	No	No	-	26.05.2020	SB2020050106 SB2020052616 SB2020071632 and 43 more
#VU27487 - Improper Certificate Validation CVE-2020-9488	CWE-295	Low	No	No	-	04.05.2020	SB2020050406 SB2020071606 SB2020071620 and 67 more
#VU27052 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2020-11022	CWE-79	Low	Available	No	-	21.04.2020	SB2020042126 SB2020052033 SB2020052103 and 181 more
#VU14150 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2015-9251	CWE-79	Low	No	No	-	31.07.2018	SB2018080106 SB2019011705 SB2019100301 and 63 more
#VU13059 - Deserialization of Untrusted Data CVE-2018-8013	CWE-502	Low	No	No	-	30.05.2018	SB2018053011 SB2018060503 SB2019011705 and 16 more
#VU12312 - Deserialization of Untrusted Data CVE-2016-1000031	CWE-502	High	No	No	-	01.05.2018	SB2017111432 SB2018110601 SB2019051512 and 39 more
#VU11111 - Heap-based Buffer Overflow CVE-2018-1000120	CWE-122	High	No	No	-	15.03.2018	SB2018031503 SB2018031505 SB2018031601 and 22 more