CVE-2015-3253 	Oracle Communications BRM - Elastic Charging Engine 	Security (Apache Groovy) 	HTTP 	Yes 	9.8 	Network 	Low 	None 	None 	Un-
changed 	High 	High 	High 	7.5
CVE-2017-5645 	Oracle Communications BRM - Elastic Charging Engine 	Security (Apache Log4j) 	HTTP 	Yes 	9.8 	Network 	Low 	None 	None 	Un-
changed 	High 	High 	High 	7.5
CVE-2017-5645 	Oracle Communications Convergent Charging Controller 	Notifications Gateway (Apache Log4j) 	TCP 	Yes 	9.8 	Network 	Low 	None 	None 	Un-
changed 	High 	High 	High 	6.0
CVE-2017-5645 	Oracle Communications Network Charging and Control 	Notifications Gateway (Apache Log4j) 	TCP 	Yes 	9.8 	Network 	Low 	None 	None 	Un-
changed 	High 	High 	High 	6.0
CVE-2017-5645 	Oracle Communications Services Gatekeeper 	Security (Apache Log4j) 	HTTP 	Yes 	9.8 	Network 	Low 	None 	None 	Un-
changed 	High 	High 	High 	5.1, 6.0
CVE-2016-5385 	Oracle Communications User Data Repository 	Security (PM&C) 	Multiple 	Yes 	8.1 	Network 	High 	None 	None 	Un-
changed 	High 	High 	High 	10.x, 12.x
CVE-2018-2570 	Oracle Communications Unified Inventory Management 	Portal 	HTTP 	No 	6.3 	Network 	Low 	Low 	None 	Un-
changed 	Low 	Low 	Low 	7.2.4.2.x, 7.3
CVE-2018-2567 	Oracle Communications Order and Service Management 	Portal 	HTTP 	Yes 	6.1 	Network 	Low 	None 	Required 	Changed 	Low 	Low 	None 	7.2.4.1.x, 7.2.4.2.x, 7.3.0.x.x, 7.3.0.1.x
CVE-2013-2566 	Oracle Communications Application Session Controller 	Security 	TLS 	Yes 	5.9 	Network 	High 	None 	None 	Un-
changed 	High 	None 	None 	3.x
CVE-2018-2571 	Oracle Communications Unified Inventory Management 	Portal 	HTTP 	No 	5.4 	Network 	Low 	Low 	None 	Un-
changed 	Low 	Low 	None 	7.2.4.2.x, 7.3


Additional CVEs addressed are below:

    The fix for CVE-2013-2566 also addresses CVE-2015-2808.
    The fix for CVE-2015-3253 also addresses CVE-2016-6814.
    The fix for CVE-2016-5385 also addresses CVE-2016-2518, CVE-2016-2550, CVE-2016-4449, CVE-2016-5387 and CVE-2016-7977.