Flexcube Core Banking

Vendor:

First CVE: Jan 27, 2017 · Active for 9 years

15

Total CVEs

More Total CVEs than 92% of tracked products

3.0

Avg CVEs / Year

Higher CVE frequency than 76% of tracked products

5.7

Avg CVSS

Higher Avg CVSS than 17% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Flexcube Core Banking over time

Volume of CVEsAvg CVSS Base Score

First CVE

Jan 27, 2017

9 years ago

Most Recent CVE

Apr 13, 2021

1,930 days ago

CVE Severity & Scoring

Flexcube Core Banking15 CVEs

13%

67%

13%

All CVEs352,719 CVEs

45%

40%

11%

LowMediumHighCritical

Attack Vector

Local1 (6.7%)

Network13 (86.7%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network1 (6.7%)

Attack Complexity

Low10 (66.7%)

High5 (33.3%)

Unknown0 (0.0%)

User Interaction

None12 (80.0%)

Unknown0 (0.0%)

Required3 (20.0%)

Privileges Required

Low5 (33.3%)

High0 (0.0%)

None10 (66.7%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (15 CVEs).

15 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2019-0227HIGH A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projec	May 1, 2019	7.5	84	NO	YES
CVE-2020-10683CRITICAL dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation fr	May 1, 2020	9.8	30	NO	NO
CVE-2019-10241MEDIUM In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL agai	Apr 22, 2019	6.1	26	NO	NO
CVE-2018-8032MEDIUM Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.	Aug 2, 2018	6.1	26	NO	NO
CVE-2020-27216HIGH In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory i	Oct 23, 2020	7.0	25	NO	NO
CVE-2021-29425MEDIUM In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value,	Apr 13, 2021	4.8	24	NO	NO
CVE-2020-2955MEDIUM Vulnerability in the Oracle FLEXCUBE Core Banking product of Oracle Financial Services Applications (component: Transaction Processing). The supported version that is affected is 4	Apr 15, 2020	6.3	22	NO	NO
CVE-2019-10247MEDIUM In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured f	Apr 22, 2019	5.3	22	NO	NO
CVE-2019-10246MEDIUM In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a rem	Apr 22, 2019	5.3	22	NO	NO
CVE-2020-9488LOW Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which coul	Apr 27, 2020	3.7	20	NO	NO

View all 15 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (15 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

1 CVE

6.7% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (15 CVEs).

Media Mentions

Signals from CVEs in this product scope (15 CVEs).

Top CNAs Publishing CVEs For Flexcube Core Banking

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
5.2.0	9	4.8	4.7%	0
5.1.0	4	4.5	1.2%	0
4.0	1	6.3	0.9%	0
11.9.0	3	7.8	36.6%	1
11.8.0	3	7.8	36.6%	1
11.7.0	4	7.4	27.8%	1
11.6.0	1	6.1	1.5%	0
11.5.0	5	4.8	1.3%	0
11.10.0	4	7.0	30.0%	1