Vulnerability record · CVE-2018-2705 · published 18 January 2018

CVE-2018-2705: Oracle banking payments vulnerability

Oracle · Banking Payments

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in takeover of Oracle Banking Payments. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

8.8 CVSS 3.0 High EPSS 1.7% · top 23.2%

8.8CVSS 3.0 base score, v2 6.5

1.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Banking Payments Oracle

References

Link	Tags
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	PatchVendor Advisory
http://www.securityfocus.com/bid/102561	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040214	Third Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	PatchVendor Advisory
http://www.securityfocus.com/bid/102561	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040214	Third Party AdvisoryVDB Entry

Track CVE-2018-2705 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-13990Softwareag quartz xml external entity (xxe) vulnerabilityinitDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.EPSS 16%26 Jul 2019 8.1CVE-2018-3027Oracle banking payments vulnerabilityVulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions th…EPSS 2.0%18 Jul 2018 8.1CVE-2018-2704Oracle banking payments vulnerabilityVulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions th…EPSS 1.8%18 Jan 2018 7.5CVE-2021-35515Apache commons compress vulnerabilityWhen reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This cou…EPSS 12%13 Jul 2021 7.5CVE-2021-35517Apache commons compress allocation without limits vulnerabilityWhen reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error e…EPSS 11%13 Jul 2021 7.5CVE-2021-36090Apache commons compress vulnerabilityWhen reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error e…EPSS 13%13 Jul 2021 7.5CVE-2019-12399Apache kafka cleartext transmission vulnerabilityWhen Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a conne…EPSS 3.9%14 Jan 2020 7.5CVE-2019-12402Apache commons compress vulnerabilityThe file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially craf…EPSS 16%30 Aug 2019

Source: NIST National Vulnerability Database (record CVE-2018-2705), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.