[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_IeQqsmKN9FJjclqlrQrjI3xqx1EM6PqnNKcr32FwFM":3,"g5a-family:oracle\u002Fcommunications_element_manager":141,"g5a-ex:oracle\u002Fcommunications_element_manager@*":142},{"success":4,"data":5},true,{"product":6,"versions":39,"topVulnerabilitiesByEpss":49,"kevVulnerabilities":108,"seoMetadata":119,"meta":138},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":38},"oracle","communications_element_manager",9,68,2,"2022-01-24",[14,19,21,24,26,28,31,34,36],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"8.0.0",8,0,false,{"version":20,"cve_count":16,"kev_count":17,"has_kev":18},"8.1.0",{"version":22,"cve_count":23,"kev_count":11,"has_kev":4},"8.1.1",19,{"version":25,"cve_count":23,"kev_count":11,"has_kev":4},"8.2.0",{"version":27,"cve_count":17,"kev_count":17,"has_kev":18},"8.2.0.0",{"version":29,"cve_count":30,"kev_count":11,"has_kev":4},"8.2.1",11,{"version":32,"cve_count":33,"kev_count":17,"has_kev":18},"8.2.2",5,{"version":35,"cve_count":17,"kev_count":17,"has_kev":18},"8.2.2.1",{"version":37,"cve_count":17,"kev_count":17,"has_kev":18},"8.2.4.0","Communications Element Manager by Oracle is a technology product with 9 tracked versions and 68 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[40,41,42,43,44,45,46,47,48],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":16,"kev_count":17,"has_kev":18},{"version":22,"cve_count":23,"kev_count":11,"has_kev":4},{"version":25,"cve_count":23,"kev_count":11,"has_kev":4},{"version":27,"cve_count":17,"kev_count":17,"has_kev":18},{"version":29,"cve_count":30,"kev_count":11,"has_kev":4},{"version":32,"cve_count":33,"kev_count":17,"has_kev":18},{"version":35,"cve_count":17,"kev_count":17,"has_kev":18},{"version":37,"cve_count":17,"kev_count":17,"has_kev":18},[50,58,65,70,77,82,86,91,97,103],{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":18,"epssScore":57},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":55,"severity":63,"isKev":4,"epssScore":64},"CVE-2020-1938","When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","2020-02-24",9.8,"Critical",0.9927,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":62,"cvssVersion":55,"severity":63,"isKev":18,"epssScore":69},"CVE-2021-44790","A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.","2021-12-20",0.9684,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":55,"severity":75,"isKev":18,"epssScore":76},"CVE-2019-0227","A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","2019-05-01",7.5,"High",0.9194,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":62,"cvssVersion":55,"severity":63,"isKev":18,"epssScore":81},"CVE-2020-11984","Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE","2020-08-07",0.90039,{"cveId":83,"description":84,"publishedDate":80,"cvssScore":74,"cvssVersion":55,"severity":75,"isKev":18,"epssScore":85},"CVE-2020-9490","Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP\u002F2 request would result in a crash when the server actually tries to HTTP\u002F2 PUSH a resource afterwards. Configuring the HTTP\u002F2 feature via \"H2Push off\" will mitigate this vulnerability for unpatched servers.",0.88844,{"cveId":87,"description":88,"publishedDate":89,"cvssScore":74,"cvssVersion":55,"severity":75,"isKev":18,"epssScore":90},"CVE-2020-5398","In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input.","2020-01-17",0.88768,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":95,"cvssVersion":55,"severity":56,"isKev":18,"epssScore":96},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",6.1,0.8682,{"cveId":98,"description":99,"publishedDate":100,"cvssScore":101,"cvssVersion":55,"severity":56,"isKev":4,"epssScore":102},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.9,0.84887,{"cveId":104,"description":105,"publishedDate":68,"cvssScore":106,"cvssVersion":55,"severity":75,"isKev":18,"epssScore":107},"CVE-2021-44224","A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).",8.2,0.82295,[109,114],{"cveId":98,"description":99,"publishedDate":100,"cvssScore":101,"severity":56,"isKev":4,"epssScore":102,"cisaVulnName":110,"cisaDateAdded":111,"cisaShortDescription":112,"cisaRequiredAction":113},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"severity":63,"isKev":4,"epssScore":64,"cisaVulnName":115,"cisaDateAdded":116,"cisaShortDescription":117,"cisaRequiredAction":118},"Apache Tomcat Improper Privilege Management Vulnerability","2022-03-03","Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.","Apply updates per vendor instructions.",{"title":120,"metaDescription":121,"keywords":122,"structuredData":123},"Communications Element Manager by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Communications Element Manager by Oracle covering 9 versions with 68 tracked vulnerabilities including 1 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Communications Element Manager vulnerabilities, Communications Element Manager security, Communications Element Manager CVE, Oracle Communications Element Manager, Communications Element Manager threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Communications Element Manager KEV, Communications Element Manager exploited vulnerabilities",{"@context":124,"@type":125,"name":126,"description":121,"url":127,"manufacturer":128,"applicationCategory":132,"softwareVersion":133,"mainEntity":134},"https:\u002F\u002Fschema.org","SoftwareApplication","Communications Element Manager","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcommunications_element_manager",{"@type":129,"name":130,"url":131},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","9 versions tracked",{"@type":135,"name":136,"description":137,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Communications Element Manager Security Vulnerabilities","Security vulnerabilities affecting Communications Element Manager by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":139,"apiVersion":140},"2026-10-17T12:56:23.086Z","3.0",[],{"rows":143,"total":11,"capped":18,"failed":17},[144,148],{"cveId":98,"name":110,"severity":56,"cvss":101,"added":111,"epss":102,"published":145,"ranges":146,"checked":4,"hits":147,"covers":18},"2020-04-29T21:15:11.743",[22,25,29],[],{"cveId":59,"name":115,"severity":63,"cvss":62,"added":116,"epss":64,"published":149,"ranges":150,"checked":4,"hits":151,"covers":18},"2020-02-24T22:15:12.057",[22,25,29],[]]