[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2OG6K3avXGuxW8kLp57WaP7GcP0jqT0JfiROUt2NBr0":3,"g5a-ex:oracle\u002Fcommunications_brm_-_elastic_charging_engine@*":117,"g5a-family:oracle\u002Fcommunications_brm_-_elastic_charging_engine":119},{"success":4,"data":5},true,{"product":6,"versions":31,"topVulnerabilitiesByEpss":38,"kevVulnerabilities":94,"seoMetadata":95,"meta":114},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":30},"oracle","communications_brm_-_elastic_charging_engine",6,14,0,"2022-02-01",[14,18,21,23,25,27],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"11.3",3,false,{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},"11.3.0.9.0",1,{"version":22,"cve_count":20,"kev_count":11,"has_kev":17},"12",{"version":24,"cve_count":16,"kev_count":11,"has_kev":17},"12.0",{"version":26,"cve_count":9,"kev_count":11,"has_kev":17},"12.0.0.3",{"version":28,"cve_count":29,"kev_count":11,"has_kev":17},"12.0.0.5.0",4,"Communications Brm - Elastic Charging Engine by Oracle is a technology product with 6 tracked versions and 14 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[32,33,34,35,36,37],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},{"version":22,"cve_count":20,"kev_count":11,"has_kev":17},{"version":24,"cve_count":16,"kev_count":11,"has_kev":17},{"version":26,"cve_count":9,"kev_count":11,"has_kev":17},{"version":28,"cve_count":29,"kev_count":11,"has_kev":17},[39,47,54,60,65,70,74,79,85,89],{"cveId":40,"description":41,"publishedDate":42,"cvssScore":43,"cvssVersion":44,"severity":45,"isKev":17,"epssScore":46},"CVE-2021-44832","Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","2021-12-28",6.6,"v3.1","Medium",0.97906,{"cveId":48,"description":49,"publishedDate":50,"cvssScore":51,"cvssVersion":44,"severity":52,"isKev":17,"epssScore":53},"CVE-2021-29505","XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.","2021-05-28",7.5,"High",0.77232,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":58,"cvssVersion":44,"severity":45,"isKev":17,"epssScore":59},"CVE-2021-21342","XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","2021-03-23",5.3,0.4999,{"cveId":61,"description":62,"publishedDate":63,"cvssScore":51,"cvssVersion":44,"severity":52,"isKev":17,"epssScore":64},"CVE-2018-15756","Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.","2018-10-18",0.09207,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":51,"cvssVersion":44,"severity":52,"isKev":17,"epssScore":69},"CVE-2020-11612","The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.","2020-04-07",0.09188,{"cveId":71,"description":72,"publishedDate":12,"cvssScore":51,"cvssVersion":44,"severity":52,"isKev":17,"epssScore":73},"CVE-2021-43859","XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.",0.07934,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":51,"cvssVersion":44,"severity":52,"isKev":17,"epssScore":78},"CVE-2021-37137","The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.","2021-10-19",0.06565,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":44,"severity":45,"isKev":17,"epssScore":84},"CVE-2021-38153","Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.","2021-09-22",5.9,0.06201,{"cveId":86,"description":87,"publishedDate":77,"cvssScore":51,"cvssVersion":44,"severity":52,"isKev":17,"epssScore":88},"CVE-2021-37136","The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack",0.05908,{"cveId":90,"description":91,"publishedDate":92,"cvssScore":83,"cvssVersion":44,"severity":45,"isKev":17,"epssScore":93},"CVE-2021-21409","Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP\u002F1.1. This is a followup of GHSA-wm47-8v5p-wjpj\u002FCVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.","2021-03-30",0.04935,[],{"title":96,"metaDescription":97,"keywords":98,"structuredData":99},"Communications Brm - Elastic Charging Engine by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Communications Brm - Elastic Charging Engine by Oracle covering 6 versions with 14 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Communications Brm - Elastic Charging Engine vulnerabilities, Communications Brm - Elastic Charging Engine security, Communications Brm - Elastic Charging Engine CVE, Oracle Communications Brm - Elastic Charging Engine, Communications Brm - Elastic Charging Engine threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":100,"@type":101,"name":102,"description":97,"url":103,"manufacturer":104,"applicationCategory":108,"softwareVersion":109,"mainEntity":110},"https:\u002F\u002Fschema.org","SoftwareApplication","Communications Brm - Elastic Charging Engine","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcommunications_brm_-_elastic_charging_engine",{"@type":105,"name":106,"url":107},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","6 versions tracked",{"@type":111,"name":112,"description":113,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Communications Brm - Elastic Charging Engine Security Vulnerabilities","Security vulnerabilities affecting Communications Brm - Elastic Charging Engine by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":115,"apiVersion":116},"2026-10-17T13:25:21.353Z","3.0",{"rows":118,"total":11,"capped":17,"failed":11},[],[]]