| Package | Affected versions | Patched versions |
|---|---|---|
| com.mchange:c3p0 | < 0.9.5.4 | 0.9.5.4 |
| c3p0 | < 0.9.5.4 | 0.9.5.4 |
| communications ip service activator | = 7.3.0= 7.4.0 | |
| communications session route manager | ≥ 8.2.0, ≤ 8.2.2 | |
| documaker | ≥ 12.6.0, ≤ 12.6.6 | |
| enterprise manager base platform | = 13.2.1.0 | |
| enterprise manager ops center | = 12.4.0.0 | |
| flexcube private banking | = 12.0.0= 12.1.0 | |
| hyperion infrastructure technology | = 11.1.2.4 | |
| retail xstore point of service | = 15.0= 16.0= 17.0= 18.0= 19.0 | |
| webcenter sites | = 12.2.1.3.0= 12.2.1.4.0 |
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free