# Oracle Financial Services Analytical Applications Infrastructure


- [CVE-2022-22963](https://insights.sbomify.com/CVE-2022-22963/): VMware Tanzu Spring Cloud Function Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-22965](https://insights.sbomify.com/CVE-2022-22965/): Spring Framework JDK 9+ Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2017-12617](https://insights.sbomify.com/CVE-2017-12617/): Apache Tomcat Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2018-14721](https://insights.sbomify.com/CVE-2018-14721/): Server-Side Request Forgery (SSRF) in jackson-databind (critical 10.0)
- [CVE-2025-53037](https://insights.sbomify.com/CVE-2025-53037/): Auth bypass in Oracle Financial Services Analytical Applications Infrastructure (critical 9.8)
- [CVE-2020-10683](https://insights.sbomify.com/CVE-2020-10683/): dom4j allows External Entities by default which might enable XXE attacks (critical 9.8)
- [CVE-2020-9546](https://insights.sbomify.com/CVE-2020-9546/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2019-14540](https://insights.sbomify.com/CVE-2019-14540/): Polymorphic Typing issue in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-16335](https://insights.sbomify.com/CVE-2019-16335/): Polymorphic Typing issue in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-14379](https://insights.sbomify.com/CVE-2019-14379/): Deserialization of untrusted data in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-3773](https://insights.sbomify.com/CVE-2019-3773/): Spring Web Services XML External Entity Injection (XXE) (critical 9.8)
- [CVE-2018-14718](https://insights.sbomify.com/CVE-2018-14718/): Arbitrary Code Execution in jackson-databind (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/financial-services-analytical-applications-infrastructure/