[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTQLs_PH98Fcc8ZnWhLYC02Q-EaOlRzSxxwPB_0Vz2c0":3,"g5a-ex:oracle\u002Fcommunications_converged_application_server_-_service_controller@*":91,"g5a-family:oracle\u002Fcommunications_converged_application_server_-_service_controller":93},{"success":4,"data":5},true,{"product":6,"versions":25,"topVulnerabilitiesByEpss":29,"kevVulnerabilities":68,"seoMetadata":69,"meta":88},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":24},"oracle","communications_converged_application_server_-_service_controller",3,6,0,"2021-04-13",[14,18,21],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"6.0",1,false,{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},"6.1",2,{"version":22,"cve_count":23,"kev_count":11,"has_kev":17},"6.2",4,"Communications Converged Application Server - Service Controller by Oracle is a technology product with 3 tracked versions and 6 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[26,27,28],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},{"version":22,"cve_count":23,"kev_count":11,"has_kev":17},[30,38,44,51,56,62],{"cveId":31,"description":32,"publishedDate":33,"cvssScore":34,"cvssVersion":35,"severity":36,"isKev":17,"epssScore":37},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",9.8,"v3.1","Critical",0.89792,{"cveId":39,"description":40,"publishedDate":12,"cvssScore":41,"cvssVersion":35,"severity":42,"isKev":17,"epssScore":43},"CVE-2021-29425","In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"\u002F\u002F..\u002Ffoo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value.",4.8,"Medium",0.10549,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":35,"severity":49,"isKev":17,"epssScore":50},"CVE-2018-15756","Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.","2018-10-18",7.5,"High",0.09207,{"cveId":52,"description":53,"publishedDate":54,"cvssScore":41,"cvssVersion":35,"severity":42,"isKev":17,"epssScore":55},"CVE-2020-27218","In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.","2020-11-28",0.08277,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":60,"cvssVersion":35,"severity":49,"isKev":17,"epssScore":61},"CVE-2020-27216","In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF\u002Flib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.","2020-10-23",7,0.04352,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":35,"severity":42,"isKev":17,"epssScore":67},"CVE-2019-10219","A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.","2019-11-08",6.1,0.02157,[],{"title":70,"metaDescription":71,"keywords":72,"structuredData":73},"Communications Converged Application Server - Service Controller by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Communications Converged Application Server - Service Controller by Oracle covering 3 versions with 6 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Communications Converged Application Server - Service Controller vulnerabilities, Communications Converged Application Server - Service Controller security, Communications Converged Application Server - Service Controller CVE, Oracle Communications Converged Application Server - Service Controller, Communications Converged Application Server - Service Controller threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":74,"@type":75,"name":76,"description":71,"url":77,"manufacturer":78,"applicationCategory":82,"softwareVersion":83,"mainEntity":84},"https:\u002F\u002Fschema.org","SoftwareApplication","Communications Converged Application Server - Service Controller","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcommunications_converged_application_server_-_service_controller",{"@type":79,"name":80,"url":81},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","3 versions tracked",{"@type":85,"name":86,"description":87,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Communications Converged Application Server - Service Controller Security Vulnerabilities","Security vulnerabilities affecting Communications Converged Application Server - Service Controller by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":89,"apiVersion":90},"2026-10-18T18:11:28.900Z","3.0",{"rows":92,"total":11,"capped":17,"failed":11},[],[]]