Oracle Communications 24.2.2
productDEcpe:/a:oracle:communications:24.2.2
A product tracked in the threat graph; the vulnerabilities below are known to affect it.
by severity
3critical9high1medium0low
updated 2026-10-30
01
vulnerabilities (25)
Related CVEs.
| ID | severity | exploitable | ||||
|---|---|---|---|---|---|---|
| CVE-2024-4577US | critical9.8OT critical | KEV | ||||
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m… | ||||||
| CVE-2024-43044US | high8.8 | Exploit | ||||
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` m… | ||||||
| CVE-2024-38816US | — | Exploit | ||||
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP r… | ||||||
| CVE-2024-40898US | high7.5 | Exploit | ||||
SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.
Users… | ||||||
| CVE-2023-46136US | high7.5 | Exploit | ||||
Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with… | ||||||
| CVE-2023-3635US | high7.5 | Exploit | ||||
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZI… | ||||||
| CVE-2024-22262US | — | Exploit | ||||
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be v… | ||||||
| CVE-2022-2068US | high7.3 | — | ||||
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to… | ||||||
| CVE-2023-5685US | — | — | ||||
A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled… | ||||||
| CVE-2024-5971US | — | — | ||||
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as… | ||||||
| CVE-2024-23672US | — | — | ||||
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource cons… | ||||||
| CVE-2023-6816US | critical9.8 | — | ||||
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any… | ||||||
| CVE-2023-2953US | high7.5 | — | ||||
A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. | ||||||
| CVE-2022-36760US | critical9.0 | — | ||||
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP serve… | ||||||
| CVE-2024-6162US | — | — | ||||
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer i… | ||||||
| CVE-2024-25062US | high7.5 | — | ||||
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafte… | ||||||
| CVE-2024-4603US | — | — | ||||
Issue summary: Checking excessively long DSA keys or parameters may be very
slow.
Impact summary: Applications that use the functions EVP_PKEY_param_check()
or EVP_PKEY_public_che… | ||||||
| CVE-2023-51775US | —OT elevated | — | ||||
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. | ||||||
| CVE-2024-32760US | medium6.5 | — | ||||
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other p… | ||||||
| CVE-2023-4043US | high7.5 | — | ||||
In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers… | ||||||
| CVE-2024-31744US | — | — | ||||
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service atta… | ||||||
| CVE-2024-31080US | — | — | ||||
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replie… | ||||||
| CVE-2022-2601US | high8.6 | — | ||||
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller tha… | ||||||
| CVE-2024-25638US | —OT elevated | — | ||||
dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones.… | ||||||
| CVE-2024-0450US | — | — | ||||
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” z… | ||||||
02
weaknesses (8)
The flaw types (CWEs) most of these CVEs share.
- CWE-400Uncontrolled Resource Consumption6 CVEs
- CWE-404Improper Resource Shutdown or Release5 CVEs
- CWE-787Out-of-bounds Write4 CVEs
- CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer3 CVEs
- CWE-22Improper Limitation of a Pathname to a Restricted Directory2 CVEs
- CWE-78Improper Neutralization of Special Elements used in an OS Command2 CVEs
- CWE-834Excessive Iteration2 CVEs
- CWE-918Server-Side Request Forgery2 CVEs
03
sources (1)
Which sources assert this record, and when.
- DECERT-Bund (BSI CSAF)25 CVEs
scry
Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan