# Oracle Flexcube Universal Banking


- [CVE-2018-2648](https://insights.sbomify.com/CVE-2018-2648/): Auth bypass in FLEXCUBE Universal Banking (high 8.8)
- [CVE-2016-5607](https://insights.sbomify.com/CVE-2016-5607/): Missing authorization in n/a (high 8.8)
- [CVE-2020-11987](https://insights.sbomify.com/CVE-2020-11987/): Server-side request forgery (SSRF) in Apache Batik (high 8.2)
- [CVE-2019-2754](https://insights.sbomify.com/CVE-2019-2754/): Missing authorization in FLEXCUBE Universal Banking (high 8.1)
- [CVE-2018-3015](https://insights.sbomify.com/CVE-2018-3015/): Missing authorization in FLEXCUBE Universal Banking (high 8.1)
- [CVE-2018-2649](https://insights.sbomify.com/CVE-2018-2649/): Business logic in FLEXCUBE Universal Banking (high 8.1)
- [CVE-2016-8297](https://insights.sbomify.com/CVE-2016-8297/): Missing authorization in FLEXCUBE Universal Banking (high 8.1)
- [CVE-2016-5619](https://insights.sbomify.com/CVE-2016-5619/): Missing authorization in n/a (high 8.1)
- [CVE-2021-37714](https://insights.sbomify.com/CVE-2021-37714/): Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions (high 7.5)
- [CVE-2021-35515](https://insights.sbomify.com/CVE-2021-35515/): Apache Commons Compress 1.6 to 1.20 denial of service vulnerability (high 7.5)
- [CVE-2021-35516](https://insights.sbomify.com/CVE-2021-35516/): Apache Commons Compress 1.6 to 1.20 denial of service vulnerability (high 7.5)
- [CVE-2021-35517](https://insights.sbomify.com/CVE-2021-35517/): Apache Commons Compress 1.1 to 1.20 denial of service vulnerability (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/flexcube-universal-banking/