| Package | Affected versions | Patched versions |
|---|---|---|
| ckeditor | ≥ 4.0, < 4.16 | 4.16 |
| agile product lifecycle management | = 9.3.5= 9.3.6 | |
| application express | < 21.1.0 | 21.1.0 |
| banking party management | = 2.7.0 | |
| commerce merchandising | = 11.1.0= 11.2.0≥ 11.3.0, ≤ 11.3.2 | |
| financial services analytical applications infrastructure | = 8.1.0= 8.1.1≥ 8.0.6, ≤ 8.0.9 | |
| financial services model management and governance | ≥ 8.0.8.0.0, ≤ 8.1.0.0.0 | |
| jd edwards enterpriseone tools | < 9.2.6.0 | 9.2.6.0 |
| siebel ui framework | ≤ 21.9 | |
| webcenter sites | = 12.2.1.3.0= 12.2.1.4.0 | |
| ckeditor4 | < 4.16.0 | 4.16.0 |
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free