[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDdzGifbX_XCB5c1pyGwQ5YAS8RD69rf0wbmG6Z0XsYI":3,"g5a-family:oracle\u002Fcommunications_session_route_manager":152,"g5a-ex:oracle\u002Fcommunications_session_route_manager@*":153},{"success":4,"data":5},true,{"product":6,"versions":42,"topVulnerabilitiesByEpss":54,"kevVulnerabilities":114,"seoMetadata":130,"meta":149},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":41},"oracle","communications_session_route_manager",11,74,2,"2022-01-24",[14,18,20,23,25,29,31,33,35,37,39],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},"8.0.0",7,1,{"version":19,"cve_count":16,"kev_count":17,"has_kev":4},"8.1.0",{"version":21,"cve_count":22,"kev_count":11,"has_kev":4},"8.1.1",17,{"version":24,"cve_count":22,"kev_count":11,"has_kev":4},"8.2.0",{"version":26,"cve_count":27,"kev_count":27,"has_kev":28},"8.2.0.0",0,false,{"version":30,"cve_count":9,"kev_count":17,"has_kev":4},"8.2.1",{"version":32,"cve_count":27,"kev_count":27,"has_kev":28},"8.2.2",{"version":34,"cve_count":27,"kev_count":27,"has_kev":28},"8.2.2.1",{"version":36,"cve_count":27,"kev_count":27,"has_kev":28},"8.2.4",{"version":38,"cve_count":27,"kev_count":27,"has_kev":28},"8.2.4.0",{"version":40,"cve_count":27,"kev_count":27,"has_kev":28},"8.2.5","Communications Session Route Manager by Oracle is a technology product with 11 tracked versions and 74 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[43,44,45,46,47,48,49,50,51,52,53],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},{"version":19,"cve_count":16,"kev_count":17,"has_kev":4},{"version":21,"cve_count":22,"kev_count":11,"has_kev":4},{"version":24,"cve_count":22,"kev_count":11,"has_kev":4},{"version":26,"cve_count":27,"kev_count":27,"has_kev":28},{"version":30,"cve_count":9,"kev_count":17,"has_kev":4},{"version":32,"cve_count":27,"kev_count":27,"has_kev":28},{"version":34,"cve_count":27,"kev_count":27,"has_kev":28},{"version":36,"cve_count":27,"kev_count":27,"has_kev":28},{"version":38,"cve_count":27,"kev_count":27,"has_kev":28},{"version":40,"cve_count":27,"kev_count":27,"has_kev":28},[55,63,70,77,82,86,91,97,103,109],{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":60,"severity":61,"isKev":28,"epssScore":62},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"cvssVersion":60,"severity":68,"isKev":28,"epssScore":69},"CVE-2021-44790","A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.","2021-12-20",9.8,"Critical",0.9684,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":60,"severity":75,"isKev":28,"epssScore":76},"CVE-2019-0227","A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","2019-05-01",7.5,"High",0.9194,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":67,"cvssVersion":60,"severity":68,"isKev":28,"epssScore":81},"CVE-2020-11984","Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE","2020-08-07",0.90039,{"cveId":83,"description":84,"publishedDate":80,"cvssScore":74,"cvssVersion":60,"severity":75,"isKev":28,"epssScore":85},"CVE-2020-9490","Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP\u002F2 request would result in a crash when the server actually tries to HTTP\u002F2 PUSH a resource afterwards. Configuring the HTTP\u002F2 feature via \"H2Push off\" will mitigate this vulnerability for unpatched servers.",0.88844,{"cveId":87,"description":88,"publishedDate":89,"cvssScore":74,"cvssVersion":60,"severity":75,"isKev":28,"epssScore":90},"CVE-2020-5398","In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input.","2020-01-17",0.88768,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":95,"cvssVersion":60,"severity":61,"isKev":28,"epssScore":96},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",6.1,0.8682,{"cveId":98,"description":99,"publishedDate":100,"cvssScore":101,"cvssVersion":60,"severity":61,"isKev":4,"epssScore":102},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.9,0.84887,{"cveId":104,"description":105,"publishedDate":106,"cvssScore":107,"cvssVersion":60,"severity":61,"isKev":28,"epssScore":108},"CVE-2021-28164","In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to \u002Fcontext\u002F%2e\u002FWEB-INF\u002Fweb.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","2021-04-01",5.3,0.82371,{"cveId":110,"description":111,"publishedDate":66,"cvssScore":112,"cvssVersion":60,"severity":75,"isKev":28,"epssScore":113},"CVE-2021-44224","A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).",8.2,0.82295,[115,120],{"cveId":98,"description":99,"publishedDate":100,"cvssScore":101,"severity":61,"isKev":4,"epssScore":102,"cisaVulnName":116,"cisaDateAdded":117,"cisaShortDescription":118,"cisaRequiredAction":119},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":121,"description":122,"publishedDate":123,"cvssScore":124,"severity":75,"isKev":4,"epssScore":125,"cisaVulnName":126,"cisaDateAdded":127,"cisaShortDescription":128,"cisaRequiredAction":129},"CVE-2019-0211","In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.","2019-04-08",7.8,0.65005,"Apache HTTP Server Privilege Escalation Vulnerability","2021-11-03","Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.","Apply updates per vendor instructions.",{"title":131,"metaDescription":132,"keywords":133,"structuredData":134},"Communications Session Route Manager by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Communications Session Route Manager by Oracle covering 11 versions with 74 tracked vulnerabilities including 0 critical and 1 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Communications Session Route Manager vulnerabilities, Communications Session Route Manager security, Communications Session Route Manager CVE, Oracle Communications Session Route Manager, Communications Session Route Manager threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Communications Session Route Manager KEV, Communications Session Route Manager exploited vulnerabilities",{"@context":135,"@type":136,"name":137,"description":132,"url":138,"manufacturer":139,"applicationCategory":143,"softwareVersion":144,"mainEntity":145},"https:\u002F\u002Fschema.org","SoftwareApplication","Communications Session Route Manager","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcommunications_session_route_manager",{"@type":140,"name":141,"url":142},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","11 versions tracked",{"@type":146,"name":147,"description":148,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Communications Session Route Manager Security Vulnerabilities","Security vulnerabilities affecting Communications Session Route Manager by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":150,"apiVersion":151},"2026-10-17T12:37:30.863Z","3.0",[],{"rows":154,"total":11,"capped":28,"failed":11},[155,158],{"cveId":98,"name":116,"severity":61,"cvss":101,"added":117,"epss":102,"published":100,"ranges":156,"hits":157,"checked":28,"covers":28},[],[],{"cveId":121,"name":126,"severity":75,"cvss":124,"added":127,"epss":125,"published":123,"ranges":159,"hits":160,"checked":28,"covers":28},[],[]]