Known vulnerabilities in Oracle Communications Application Session Controller

Known vulnerabilities in Oracle Communications Application Session Controller

Vendor: Oracle

Software: Oracle Communications Application Session Controller

Software CPE: cpe:2.3:a:oracle:oracle_communications_application_session_controller:*:*:*:*:*:*:*:*

Website: https://www.oracle.com

Total vulnerabilities: 13

Public exploits: 2

Known exploited (KEV): 0

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (13)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU52501 - Server-Side Request Forgery (SSRF) CVE-2020-11987	CWE-918	Medium	No	No	-	23.04.2021	-
#VU49086 - Comparison using wrong factors CVE-2020-28052	CWE-1025	High	Available	No	-	18.12.2020	-
#VU48942 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CVE-2020-27216	CWE-362	Low	No	No	-	23.10.2020	-
#VU30113 - Improper input validation CVE-2020-5258	CWE-20	Low	No	No	-	16.07.2020	-
#VU34161 - Operation on a Resource after Expiration or Release CVE-2019-17638	CWE-672	High	No	No	-	09.07.2020	-
#VU29068 - Server-Side Request Forgery (SSRF) CVE-2019-17566	CWE-918	Medium	No	No	-	16.06.2020	-
#VU28238 - Exposed Dangerous Method or Function CVE-2020-10683	CWE-749	Medium	No	No	-	26.05.2020	-
#VU27487 - Improper Certificate Validation CVE-2020-9488	CWE-295	Low	No	No	-	04.05.2020	-
#VU27052 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2020-11022	CWE-79	Low	Available	No	-	21.04.2020	-
#VU14150 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2015-9251	CWE-79	Low	No	No	-	31.07.2018	-
#VU13059 - Deserialization of Untrusted Data CVE-2018-8013	CWE-502	Low	No	No	-	30.05.2018	-
#VU12312 - Deserialization of Untrusted Data CVE-2016-1000031	CWE-502	High	No	No	-	01.05.2018	-
#VU11111 - Heap-based Buffer Overflow CVE-2018-1000120	CWE-122	High	No	No	-	15.03.2018	-