WaratekVRT Sign in

Critical Communications Converged Application Server CVEs

7 CVEs, 1 exploited, 5 protected by Waratek

Reset
More filters (1)
Columns
Product communications converged application server✕
Overview 7 matches · 5 protected · 1 exploited · 1 CISA KEV · 3 public PoC · 4 EPSS ≥ 0.5
7matches 5protected71.4% 1exploited14.3% 1CISA KEV14.3% 3public PoC42.9% 4EPSS ≥ 0.557.1%
Protected by Waratek 5 71.4% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 28.6%
Critical 7 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 71.4% partly blocked 0 0.0% not blocked 2 28.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 1 14.3% Proof of concept only 1 14.3% Forecast only 1 14.3% No public exploit 3 42.9%
split by peak 3 / year
No exploit published: 2Protected by Waratek: 5 Critical: 7 not blocked: 2blocked by ARMR today: 5 No public exploit: 3Forecast only: 1Proof of concept only: 1Working exploit published: 1Exploited: 1
20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20183 Protected by Waratek3 Critical3 blocked by ARMR today3 Proof of concept only1 Forecast only1 No public exploit1 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20200 20210 20220 20231 No exploit published1 Critical1 not blocked1 No public exploit1 20240 20250 20261 No exploit published1 Critical1 not blocked1 No public exploit1
2017201820192020202120222023202420252026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-61223 Critical 2026-07-21 No exploit published No public exploit Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVE-2023-21890 Critical 2023-01-18 No exploit published No public exploit Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affected are 7.1.0 and 8.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via UDP to compromise Oracle Communications Converged Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2019-2725 Critical 2019-04-26 Protected by Waratek Exploited Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2018-1000613 Critical 2018-07-09 Protected by Waratek No public exploit Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.
CVE-2018-1275 Critical 2018-04-11 Protected by Waratek Forecast only Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
CVE-2018-1270 Critical 2018-04-06 Protected by Waratek Proof of concept only Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.