Jd Edwards World Security

Vendor:

First CVE: May 4, 2017 · Active for 9 years

14

Total CVEs

More Total CVEs than 92% of tracked products

2.8

Avg CVEs / Year

Higher CVE frequency than 78% of tracked products

6.3

Avg CVSS

Higher Avg CVSS than 29% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Jd Edwards World Security over time

Volume of CVEsAvg CVSS Base Score

First CVE

May 4, 2017

9 years ago

Most Recent CVE

Jan 28, 2022

1,642 days ago

CVE Severity & Scoring

Jd Edwards World Security14 CVEs

21%

36%

All CVEs353,240 CVEs

45%

40%

11%

LowMediumHighCritical

Attack Vector

Local0 (0.0%)

Network14 (100.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low4 (28.6%)

High10 (71.4%)

Unknown0 (0.0%)

User Interaction

None14 (100.0%)

Unknown0 (0.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None14 (100.0%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (14 CVEs).

14 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2021-3711CRITICAL In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first tim	Aug 24, 2021	9.8	79	NO	NO
CVE-2017-3730HIGH In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL po	May 4, 2017	7.5	67	NO	YES
CVE-2021-3449MEDIUM An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms	Mar 25, 2021	5.9	57	NO	NO
CVE-2021-3712HIGH ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This cont	Aug 24, 2021	7.4	53	NO	NO
CVE-2021-23840HIGH Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable	Feb 16, 2021	7.5	53	NO	NO
CVE-2020-1967HIGH Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect hand	Apr 21, 2020	7.5	51	NO	NO
CVE-2021-3450HIGH The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.	Mar 25, 2021	7.4	34	NO	NO
CVE-2019-1559MEDIUM If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently	Feb 27, 2019	5.9	30	NO	NO
CVE-2021-4160MEDIUM There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed	Jan 28, 2022	5.9	25	NO	NO
CVE-2021-23841MEDIUM The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate	Feb 16, 2021	5.9	24	NO	NO

View all 14 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (14 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

1 CVE

7.1% of CVEs· 86th percentile

Social Chatter

Signals from CVEs in this product scope (14 CVEs).

Media Mentions

Signals from CVEs in this product scope (14 CVEs).

Top CNAs Publishing CVEs For Jd Edwards World Security

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
a9.4	14	6.3	30.7%	1
a9.3.1	1	5.9	17.1%	0
a9.3	2	6.7	36.2%	1
a9.2	1	7.5	55.3%	1
a9.1	1	7.5	55.3%	1