# Oracle Communications Instant Messaging Server


- [CVE-2020-1938](https://insights.sbomify.com/CVE-2020-1938/): Apache Tomcat Improper Privilege Management (critical 9.8, exploited in the wild)
- [CVE-2016-8735](https://insights.sbomify.com/CVE-2016-8735/): Apache Tomcat Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2017-12617](https://insights.sbomify.com/CVE-2017-12617/): Apache Tomcat Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2022-23305](https://insights.sbomify.com/CVE-2022-23305/): SQL injection in JDBC Appender in Apache Log4j V1 (critical 9.8)
- [CVE-2020-9546](https://insights.sbomify.com/CVE-2020-9546/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2020-9547](https://insights.sbomify.com/CVE-2020-9547/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2020-9548](https://insights.sbomify.com/CVE-2020-9548/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2019-20330](https://insights.sbomify.com/CVE-2019-20330/): Deserialization of Untrusted Data in jackson-databind (critical 9.8)
- [CVE-2019-14379](https://insights.sbomify.com/CVE-2019-14379/): Deserialization of untrusted data in FasterXML jackson-databind (critical 9.8)
- [CVE-2018-11307](https://insights.sbomify.com/CVE-2018-11307/): Deserialization of Untrusted Data in jackson-databind (critical 9.8)
- [CVE-2018-14718](https://insights.sbomify.com/CVE-2018-14718/): Arbitrary Code Execution in jackson-databind (critical 9.8)
- [CVE-2018-7489](https://insights.sbomify.com/CVE-2018-7489/): FasterXML jackson-databind allows unauthenticated remote code execution (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/communications-instant-messaging-server/