What’s Vulnerable › Products

Oracle Communications Instant Messaging Server vulnerabilities

57 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 0 published in the last 12 months.

Check whether your Oracle Communications Instant Messaging Server version is affected

Exploited Oracle Communications Instant Messaging Server vulnerabilities

• CVE-2016-8735 — Apache Tomcat Remote Code Execution Vulnerability
• CVE-2017-12617 — Apache Tomcat Remote Code Execution Vulnerability
• CVE-2020-1938 — Apache Tomcat Improper Privilege Management Vulnerability

Latest Oracle Communications Instant Messaging Server vulnerabilities

• CVE-2022-23307 — A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. (CVSS 8.8)
• CVE-2022-23305 — SQL injection in JDBC Appender in Apache Log4j V1 (CVSS 9.8)
• CVE-2022-23302 — Deserialization of untrusted data in JMSSink in Apache Log4j 1.x (CVSS 8.8)
• CVE-2021-43797 — HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling (CVSS 6.5)
• CVE-2021-37136 — (CVSS 7.5)
• CVE-2021-33037 — Incorrect Transfer-Encoding handling with HTTP/1.0 (CVSS 5.3)
• CVE-2021-25329 — Incomplete fix for CVE-2020-9484 (CVSS 7.0)
• CVE-2021-25122 — Apache Tomcat h2c request mix-up (CVSS 7.5)
• CVE-2020-36183 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36182 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36180 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36179 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36189 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36188 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36187 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36186 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36185 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36184 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-36181 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-35491 — Serialization gadgets exploit in jackson-databind (CVSS 8.1)
• CVE-2020-35490 — Serialization gadgets exploit in jackson-databind (CVSS 8.1)
• CVE-2020-17527 — Apache Tomcat: Request header mix-up between HTTP/2 streams (CVSS 7.5)
• CVE-2020-25649 — XML External Entity (XXE) Injection in Jackson Databind (CVSS 7.5)
• CVE-2020-24750 — Unsafe Deserialization in jackson-databind (CVSS 8.1)
• CVE-2020-24616 — Code Injection in jackson-databind (CVSS 8.1)