[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvQp7MWv7ivt97bvyoHpq2mmU08KcTc5BSpm52RaejV8":3,"g5a-ex:oracle\u002Fbanking_apis@*":123,"g5a-family:oracle\u002Fbanking_apis":125},{"success":4,"data":5},true,{"product":6,"versions":33,"topVulnerabilitiesByEpss":41,"kevVulnerabilities":100,"seoMetadata":101,"meta":120},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":32},"oracle","banking_apis",7,14,0,"2021-11-17",[14,18,20,23,26,28,30],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"18.1",2,false,{"version":19,"cve_count":16,"kev_count":11,"has_kev":17},"18.2",{"version":21,"cve_count":22,"kev_count":11,"has_kev":17},"18.3",3,{"version":24,"cve_count":25,"kev_count":11,"has_kev":17},"19.1",12,{"version":27,"cve_count":25,"kev_count":11,"has_kev":17},"19.2",{"version":29,"cve_count":10,"kev_count":11,"has_kev":17},"20.1",{"version":31,"cve_count":10,"kev_count":11,"has_kev":17},"21.1","Banking Apis by Oracle is a technology product with 7 tracked versions and 14 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[34,35,36,37,38,39,40],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":16,"kev_count":11,"has_kev":17},{"version":21,"cve_count":22,"kev_count":11,"has_kev":17},{"version":24,"cve_count":25,"kev_count":11,"has_kev":17},{"version":27,"cve_count":25,"kev_count":11,"has_kev":17},{"version":29,"cve_count":10,"kev_count":11,"has_kev":17},{"version":31,"cve_count":10,"kev_count":11,"has_kev":17},[42,50,57,63,68,72,78,83,87,94],{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":47,"severity":48,"isKev":17,"epssScore":49},"CVE-2021-28164","In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to \u002Fcontext\u002F%2e\u002FWEB-INF\u002Fweb.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","2021-04-01",5.3,"v3.1","Medium",0.82371,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":47,"severity":55,"isKev":17,"epssScore":56},"CVE-2020-25649","A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.","2020-12-03",7.5,"High",0.17714,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":61,"cvssVersion":47,"severity":55,"isKev":17,"epssScore":62},"CVE-2020-11987","Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","2021-02-24",8.2,0.1328,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":54,"cvssVersion":47,"severity":55,"isKev":17,"epssScore":67},"CVE-2021-36090","When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.","2021-07-13",0.12945,{"cveId":69,"description":70,"publishedDate":66,"cvssScore":54,"cvssVersion":47,"severity":55,"isKev":17,"epssScore":71},"CVE-2021-35517","When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.",0.10614,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"cvssVersion":47,"severity":48,"isKev":17,"epssScore":77},"CVE-2021-29425","In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"\u002F\u002F..\u002Ffoo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value.","2021-04-13",4.8,0.10549,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":54,"cvssVersion":47,"severity":55,"isKev":17,"epssScore":82},"CVE-2021-37137","The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.","2021-10-19",0.06565,{"cveId":84,"description":85,"publishedDate":81,"cvssScore":54,"cvssVersion":47,"severity":55,"isKev":17,"epssScore":86},"CVE-2021-37136","The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack",0.05908,{"cveId":88,"description":89,"publishedDate":90,"cvssScore":91,"cvssVersion":47,"severity":92,"isKev":17,"epssScore":93},"CVE-2019-17495","A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that \u003Cstyle>@import within the JSON data was a functional attack method.","2019-10-10",9.8,"Critical",0.05734,{"cveId":95,"description":96,"publishedDate":45,"cvssScore":97,"cvssVersion":47,"severity":98,"isKev":17,"epssScore":99},"CVE-2021-28163","In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.",2.7,"Low",0.0418,[],{"title":102,"metaDescription":103,"keywords":104,"structuredData":105},"Banking Apis by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Banking Apis by Oracle covering 7 versions with 14 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Banking Apis vulnerabilities, Banking Apis security, Banking Apis CVE, Oracle Banking Apis, Banking Apis threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":106,"@type":107,"name":108,"description":103,"url":109,"manufacturer":110,"applicationCategory":114,"softwareVersion":115,"mainEntity":116},"https:\u002F\u002Fschema.org","SoftwareApplication","Banking Apis","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fbanking_apis",{"@type":111,"name":112,"url":113},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","7 versions tracked",{"@type":117,"name":118,"description":119,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Banking Apis Security Vulnerabilities","Security vulnerabilities affecting Banking Apis by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":121,"apiVersion":122},"2026-10-17T12:37:29.220Z","3.0",{"rows":124,"total":11,"capped":17,"failed":11},[],[]]