[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fm8WBjs9bNZmGl0S9K9rm-FoqfxHJw3HshnAcvnn6yiA":3,"g5a-family:oracle\u002Fcommunications_interactive_session_recorder":130,"g5a-ex:oracle\u002Fcommunications_interactive_session_recorder@*":131},{"success":4,"data":5},true,{"product":6,"versions":30,"topVulnerabilitiesByEpss":36,"kevVulnerabilities":97,"seoMetadata":108,"meta":127},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":29},"oracle","communications_interactive_session_recorder",5,19,2,"2021-12-28",[14,17,19,21,26],{"version":15,"cve_count":11,"kev_count":16,"has_kev":4},"6.0",1,{"version":18,"cve_count":11,"kev_count":16,"has_kev":4},"6.1",{"version":20,"cve_count":11,"kev_count":16,"has_kev":4},"6.2",{"version":22,"cve_count":23,"kev_count":24,"has_kev":25},"6.3",8,0,false,{"version":27,"cve_count":28,"kev_count":24,"has_kev":25},"6.4",13,"Communications Interactive Session Recorder by Oracle is a technology product with 5 tracked versions and 19 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[31,32,33,34,35],{"version":15,"cve_count":11,"kev_count":16,"has_kev":4},{"version":18,"cve_count":11,"kev_count":16,"has_kev":4},{"version":20,"cve_count":11,"kev_count":16,"has_kev":4},{"version":22,"cve_count":23,"kev_count":24,"has_kev":25},{"version":27,"cve_count":28,"kev_count":24,"has_kev":25},[37,45,50,57,62,68,74,80,84,90],{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":42,"severity":43,"isKev":25,"epssScore":44},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":46,"description":47,"publishedDate":12,"cvssScore":48,"cvssVersion":42,"severity":43,"isKev":25,"epssScore":49},"CVE-2021-44832","Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",6.6,0.97906,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":42,"severity":55,"isKev":4,"epssScore":56},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",9.8,"Critical",0.90338,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":54,"cvssVersion":42,"severity":55,"isKev":25,"epssScore":61},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",0.89792,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":42,"severity":43,"isKev":25,"epssScore":67},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",6.1,0.8682,{"cveId":69,"description":70,"publishedDate":71,"cvssScore":72,"cvssVersion":42,"severity":43,"isKev":4,"epssScore":73},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.9,0.84887,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":78,"cvssVersion":42,"severity":43,"isKev":25,"epssScore":79},"CVE-2021-41184","jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.","2021-10-26",6.5,0.40768,{"cveId":81,"description":82,"publishedDate":77,"cvssScore":66,"cvssVersion":42,"severity":43,"isKev":25,"epssScore":83},"CVE-2021-41182","jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.",0.39361,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":66,"cvssVersion":88,"severity":43,"isKev":25,"epssScore":89},"CVE-2015-9251","jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text\u002Fjavascript responses to be executed.","2018-01-18","v3.0",0.29726,{"cveId":91,"description":92,"publishedDate":93,"cvssScore":94,"cvssVersion":42,"severity":95,"isKev":25,"epssScore":96},"CVE-2020-25649","A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.","2020-12-03",7.5,"High",0.17714,[98,103],{"cveId":69,"description":70,"publishedDate":71,"cvssScore":72,"severity":43,"isKev":4,"epssScore":73,"cisaVulnName":99,"cisaDateAdded":100,"cisaShortDescription":101,"cisaRequiredAction":102},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"severity":55,"isKev":4,"epssScore":56,"cisaVulnName":104,"cisaDateAdded":105,"cisaShortDescription":106,"cisaRequiredAction":107},"Apache Tomcat Remote Code Execution Vulnerability","2023-05-12","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","Apply updates per vendor instructions.",{"title":109,"metaDescription":110,"keywords":111,"structuredData":112},"Communications Interactive Session Recorder by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Communications Interactive Session Recorder by Oracle covering 5 versions with 19 tracked vulnerabilities including 1 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Communications Interactive Session Recorder vulnerabilities, Communications Interactive Session Recorder security, Communications Interactive Session Recorder CVE, Oracle Communications Interactive Session Recorder, Communications Interactive Session Recorder threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Communications Interactive Session Recorder KEV, Communications Interactive Session Recorder exploited vulnerabilities",{"@context":113,"@type":114,"name":115,"description":110,"url":116,"manufacturer":117,"applicationCategory":121,"softwareVersion":122,"mainEntity":123},"https:\u002F\u002Fschema.org","SoftwareApplication","Communications Interactive Session Recorder","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcommunications_interactive_session_recorder",{"@type":118,"name":119,"url":120},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","5 versions tracked",{"@type":124,"name":125,"description":126,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Communications Interactive Session Recorder Security Vulnerabilities","Security vulnerabilities affecting Communications Interactive Session Recorder by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":128,"apiVersion":129},"2026-10-17T14:55:24.196Z","3.0",[],{"rows":132,"total":11,"capped":25,"failed":24},[133,138],{"cveId":69,"name":99,"severity":43,"cvss":72,"added":100,"epss":73,"published":134,"ranges":135,"checked":4,"hits":137,"covers":25},"2020-04-29T21:15:11.743",[136],"6.1 to 6.4",[],{"cveId":51,"name":104,"severity":55,"cvss":54,"added":105,"epss":56,"published":139,"ranges":140,"checked":4,"hits":141,"covers":25},"2017-04-06T21:59:00.243",[15,18,20],[]]