[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWSiLbHkz9sxl3hsC5NfE_yT2xdW8_SHTdZvMa75rN2I":3,"g5a-family:oracle\u002Fcommunications_application_session_controller":146,"g5a-ex:oracle\u002Fcommunications_application_session_controller@*":147},{"success":4,"data":5},true,{"product":6,"versions":42,"topVulnerabilitiesByEpss":54,"kevVulnerabilities":118,"seoMetadata":124,"meta":143},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":41},"oracle","communications_application_session_controller",11,20,1,"2021-07-21",[14,18,20,22,25,27,30,33,35,37,39],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.0",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"3.6.0",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"3.7.0",{"version":23,"cve_count":24,"kev_count":11,"has_kev":4},"3.7.1",5,{"version":26,"cve_count":24,"kev_count":11,"has_kev":4},"3.8.0",{"version":28,"cve_count":29,"kev_count":16,"has_kev":17},"3.8m0",2,{"version":31,"cve_count":32,"kev_count":16,"has_kev":17},"3.9.0",4,{"version":34,"cve_count":16,"kev_count":16,"has_kev":17},"3.9.1",{"version":36,"cve_count":29,"kev_count":16,"has_kev":17},"3.9m0p1",{"version":38,"cve_count":29,"kev_count":16,"has_kev":17},"3.9m0p2",{"version":40,"cve_count":29,"kev_count":16,"has_kev":17},"3.9m0p3","Communications Application Session Controller by Oracle is a technology product with 11 tracked versions and 20 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[43,44,45,46,47,48,49,50,51,52,53],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":24,"kev_count":11,"has_kev":4},{"version":26,"cve_count":24,"kev_count":11,"has_kev":4},{"version":28,"cve_count":29,"kev_count":16,"has_kev":17},{"version":31,"cve_count":32,"kev_count":16,"has_kev":17},{"version":34,"cve_count":16,"kev_count":16,"has_kev":17},{"version":36,"cve_count":29,"kev_count":16,"has_kev":17},{"version":38,"cve_count":29,"kev_count":16,"has_kev":17},{"version":40,"cve_count":29,"kev_count":16,"has_kev":17},[55,63,70,78,84,89,95,100,107,113],{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":60,"severity":61,"isKev":17,"epssScore":62},"CVE-2020-11022","In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.1,"v3.1","Medium",0.99215,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"cvssVersion":68,"severity":61,"isKev":17,"epssScore":69},"CVE-2018-11784","When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '\u002Ffoo\u002F' when the user requested '\u002Ffoo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.","2018-10-04",4.3,"v3.0",0.9768,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":75,"severity":76,"isKev":17,"epssScore":77},"CVE-2015-0235","Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka \"GHOST.\"","2015-01-28",10,"v2","Critical",0.94558,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"cvssVersion":60,"severity":76,"isKev":4,"epssScore":83},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",9.8,0.90338,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":59,"cvssVersion":60,"severity":61,"isKev":17,"epssScore":88},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",0.8682,{"cveId":90,"description":91,"publishedDate":92,"cvssScore":93,"cvssVersion":60,"severity":61,"isKev":17,"epssScore":94},"CVE-2013-2566","The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.","2013-03-15",5.9,0.84424,{"cveId":96,"description":97,"publishedDate":98,"cvssScore":24,"cvssVersion":75,"severity":61,"isKev":17,"epssScore":99},"CVE-2015-2808","The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the \"Bar Mitzvah\" issue.","2015-04-01",0.73851,{"cveId":101,"description":102,"publishedDate":103,"cvssScore":104,"cvssVersion":68,"severity":105,"isKev":17,"epssScore":106},"CVE-2017-3730","In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.","2017-05-04",7.5,"High",0.55294,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":111,"cvssVersion":60,"severity":105,"isKev":17,"epssScore":112},"CVE-2020-11987","Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","2021-02-24",8.2,0.1328,{"cveId":114,"description":115,"publishedDate":116,"cvssScore":104,"cvssVersion":60,"severity":105,"isKev":17,"epssScore":117},"CVE-2019-17566","Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","2020-11-12",0.10867,[119],{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"severity":76,"isKev":4,"epssScore":83,"cisaVulnName":120,"cisaDateAdded":121,"cisaShortDescription":122,"cisaRequiredAction":123},"Apache Tomcat Remote Code Execution Vulnerability","2023-05-12","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","Apply updates per vendor instructions.",{"title":125,"metaDescription":126,"keywords":127,"structuredData":128},"Communications Application Session Controller by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Communications Application Session Controller by Oracle covering 11 versions with 20 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Communications Application Session Controller vulnerabilities, Communications Application Session Controller security, Communications Application Session Controller CVE, Oracle Communications Application Session Controller, Communications Application Session Controller threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Communications Application Session Controller KEV, Communications Application Session Controller exploited vulnerabilities",{"@context":129,"@type":130,"name":131,"description":126,"url":132,"manufacturer":133,"applicationCategory":137,"softwareVersion":138,"mainEntity":139},"https:\u002F\u002Fschema.org","SoftwareApplication","Communications Application Session Controller","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcommunications_application_session_controller",{"@type":134,"name":135,"url":136},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","11 versions tracked",{"@type":140,"name":141,"description":142,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Communications Application Session Controller Security Vulnerabilities","Security vulnerabilities affecting Communications Application Session Controller by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":144,"apiVersion":145},"2026-10-19T17:05:17.067Z","3.0",[],{"rows":148,"total":11,"capped":17,"failed":16},[149],{"cveId":79,"name":120,"severity":76,"cvss":82,"added":121,"epss":83,"published":150,"ranges":151,"checked":4,"hits":152,"covers":17},"2017-04-06T21:59:00.243",[23,26],[]]