# Oracle Banking Platform


- [CVE-2020-11023](https://insights.sbomify.com/CVE-2020-11023/): JQuery Cross-Site Scripting (XSS) (medium 6.9, exploited in the wild)
- [CVE-2018-14721](https://insights.sbomify.com/CVE-2018-14721/): Server-Side Request Forgery (SSRF) in jackson-databind (critical 10.0)
- [CVE-2020-10683](https://insights.sbomify.com/CVE-2020-10683/): dom4j allows External Entities by default which might enable XXE attacks (critical 9.8)
- [CVE-2020-9546](https://insights.sbomify.com/CVE-2020-9546/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2020-9547](https://insights.sbomify.com/CVE-2020-9547/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2020-9548](https://insights.sbomify.com/CVE-2020-9548/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2019-20330](https://insights.sbomify.com/CVE-2019-20330/): Deserialization of Untrusted Data in jackson-databind (critical 9.8)
- [CVE-2019-2904](https://insights.sbomify.com/CVE-2019-2904/): Auth bypass in Enterprise Repository (critical 9.8)
- [CVE-2019-17531](https://insights.sbomify.com/CVE-2019-17531/): jackson-databind polymorphic typing issue (critical 9.8)
- [CVE-2019-17495](https://insights.sbomify.com/CVE-2019-17495/): Cross-site scripting in Swagger-UI (critical 9.8)
- [CVE-2019-16942](https://insights.sbomify.com/CVE-2019-16942/): Polymorphic Typing in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-16943](https://insights.sbomify.com/CVE-2019-16943/): jackson-databind polymorphic typing issue (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/banking-platform/