# Oracle Communications Element Manager


- [CVE-2020-1938](https://insights.sbomify.com/CVE-2020-1938/): Apache Tomcat Improper Privilege Management (critical 9.8, exploited in the wild)
- [CVE-2020-11023](https://insights.sbomify.com/CVE-2020-11023/): JQuery Cross-Site Scripting (XSS) (medium 6.9, exploited in the wild)
- [CVE-2021-44790](https://insights.sbomify.com/CVE-2021-44790/): Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier (critical 9.8)
- [CVE-2020-11998](https://insights.sbomify.com/CVE-2020-11998/): Remote code execution in Apache ActiveMQ (critical 9.8)
- [CVE-2020-11984](https://insights.sbomify.com/CVE-2020-11984/): Memory corruption in Apache HTTP Server (critical 9.8)
- [CVE-2020-9546](https://insights.sbomify.com/CVE-2020-9546/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2020-9548](https://insights.sbomify.com/CVE-2020-9548/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2019-10082](https://insights.sbomify.com/CVE-2019-10082/): Use after free in Apache HTTP Server (critical 9.1)
- [CVE-2021-22112](https://insights.sbomify.com/CVE-2021-22112/): Privilege escalation in spring security (high 8.8)
- [CVE-2020-36179](https://insights.sbomify.com/CVE-2020-36179/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36180](https://insights.sbomify.com/CVE-2020-36180/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36181](https://insights.sbomify.com/CVE-2020-36181/): Unsafe Deserialization in jackson-databind (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/communications-element-manager/