# Oracle Flexcube Private Banking


- [CVE-2016-3081](https://insights.sbomify.com/CVE-2016-3081/): Apache Struts Command Injection (high 8.1, exploited in the wild)
- [CVE-2013-4316](https://insights.sbomify.com/CVE-2013-4316/): Code injection in Apache Struts (critical 10.0)
- [CVE-2020-11998](https://insights.sbomify.com/CVE-2020-11998/): Remote code execution in Apache ActiveMQ (critical 9.8)
- [CVE-2020-5413](https://insights.sbomify.com/CVE-2020-5413/): Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets" (critical 9.8)
- [CVE-2020-11972](https://insights.sbomify.com/CVE-2020-11972/): Deserialization of Untrusted Data in Apache Camel RabbitMQ (critical 9.8)
- [CVE-2020-11973](https://insights.sbomify.com/CVE-2020-11973/): Apache Camel Netty enables Java deserialization by default (critical 9.8)
- [CVE-2019-12419](https://insights.sbomify.com/CVE-2019-12419/): Potential session hijack in Apache CXF (critical 9.8)
- [CVE-2019-2904](https://insights.sbomify.com/CVE-2019-2904/): Auth bypass in Enterprise Repository (critical 9.8)
- [CVE-2019-13990](https://insights.sbomify.com/CVE-2019-13990/): XML external entity injection in Terracotta Quartz Scheduler (critical 9.8)
- [CVE-2019-3773](https://insights.sbomify.com/CVE-2019-3773/): Spring Web Services XML External Entity Injection (XXE) (critical 9.8)
- [CVE-2020-5421](https://insights.sbomify.com/CVE-2020-5421/): RFD Protection Bypass via jsessionid (high 8.7)
- [CVE-2021-2351](https://insights.sbomify.com/CVE-2021-2351/): Weak cryptography in WebLogic Server (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/flexcube-private-banking/