# Oracle Communications Unified Inventory Management


- [CVE-2022-22965](https://insights.sbomify.com/CVE-2022-22965/): Spring Framework JDK 9+ Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2021-39144](https://insights.sbomify.com/CVE-2021-39144/): XStream Remote Code Execution (high 8.5, exploited in the wild)
- [CVE-2022-23305](https://insights.sbomify.com/CVE-2022-23305/): SQL injection in JDBC Appender in Apache Log4j V1 (critical 9.8)
- [CVE-2020-10683](https://insights.sbomify.com/CVE-2020-10683/): dom4j allows External Entities by default which might enable XXE attacks (critical 9.8)
- [CVE-2022-23302](https://insights.sbomify.com/CVE-2022-23302/): Deserialization of untrusted data in JMSSink in Apache Log4j 1.x (high 8.8)
- [CVE-2022-23307](https://insights.sbomify.com/CVE-2022-23307/): A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. (high 8.8)
- [CVE-2021-22112](https://insights.sbomify.com/CVE-2021-22112/): Privilege escalation in spring security (high 8.8)
- [CVE-2020-36179](https://insights.sbomify.com/CVE-2020-36179/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36180](https://insights.sbomify.com/CVE-2020-36180/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36181](https://insights.sbomify.com/CVE-2020-36181/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36182](https://insights.sbomify.com/CVE-2020-36182/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36184](https://insights.sbomify.com/CVE-2020-36184/): Unsafe Deserialization in jackson-databind (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/communications-unified-inventory-management/