# Oracle Communications Cloud Native Core Policy


- [CVE-2022-22963](https://insights.sbomify.com/CVE-2022-22963/): VMware Tanzu Spring Cloud Function Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-22965](https://insights.sbomify.com/CVE-2022-22965/): Spring Framework JDK 9+ Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2021-39144](https://insights.sbomify.com/CVE-2021-39144/): XStream Remote Code Execution (high 8.5, exploited in the wild)
- [CVE-2021-3773](https://insights.sbomify.com/CVE-2021-3773/): Information disclosure in kernel (critical 9.8)
- [CVE-2021-42392](https://insights.sbomify.com/CVE-2021-42392/): RCE in H2 Console (critical 9.8)
- [CVE-2021-3520](https://insights.sbomify.com/CVE-2021-3520/): lz4-sys vulnerable to memory corruption via issue in liblz4 (critical 9.8)
- [CVE-2020-13936](https://insights.sbomify.com/CVE-2020-13936/): Velocity Sandbox Bypass (high 8.8)
- [CVE-2020-36179](https://insights.sbomify.com/CVE-2020-36179/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36180](https://insights.sbomify.com/CVE-2020-36180/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36181](https://insights.sbomify.com/CVE-2020-36181/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36182](https://insights.sbomify.com/CVE-2020-36182/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36184](https://insights.sbomify.com/CVE-2020-36184/): Unsafe Deserialization in jackson-databind (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/communications-cloud-native-core-policy/