ByteOS

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.73% / 73.12%

||

7 Day CHG~0.00%

Published-21 Jul, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Infrastructure.

Product-integrated_lights_out_manager_firmware n/a

CVE-2016-5574

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.6||HIGH

EPSS-0.92% / 76.40%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.5.1 through 8.5.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters, a different vulnerability than CVE-2016-5558, CVE-2016-5577, CVE-2016-5578, CVE-2016-5579, and CVE-2016-5588.

CWE ID-CWE-284

Improper Access Control

CVE-2016-5445

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.3||HIGH

EPSS-0.73% / 73.12%

||

7 Day CHG~0.00%

Published-21 Jul, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

Product-integrated_lights_out_manager_firmware n/a

CVE-2020-14609

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.6||HIGH

EPSS-2.62% / 85.99%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:32

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Answers). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).

Product-business_intelligence Oracle Business Intelligence Enterprise Edition

CVE-2016-5526

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.33% / 56.14%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Apache Tomcat.

Product-agile_product_lifecycle_management n/a

CWE ID-CWE-284

Improper Access Control

CVE-2007-3865

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.23% / 84.86%

||

7 Day CHG~0.00%

Published-18 Jul, 2007 | 19:00

Updated-23 Apr, 2026 | 00:35

Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 12.0.1 has unknown impact and remote attack vectors, aka APPS01.

Product-e-business_suite n/a

CVE-2020-14841

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-13.49% / 94.37%

||

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:12

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2016-5254

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.54% / 81.74%

||

7 Day CHG~0.00%

Published-05 Aug, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items.

Vendor-n/a Mozilla Corporation Oracle Corporation

Product-firefox linux n/a

CWE ID-CWE-416

Use After Free

CVE-2020-14750

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.44% / 99.99%

||

7 Day CHG~0.00%

Published-01 Nov, 2020 | 23:50

Updated-12 Jan, 2026 | 20:23

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server WebLogic Server

CVE-2020-14756

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-83.39% / 99.29%

||

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:49

Updated-26 Sep, 2024 | 18:46

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-utilities_framework coherence Utilities Framework

CVE-2020-14644

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-93.64% / 99.85%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-12 Jan, 2026 | 21:03

Known KEV||Action Due Date - 2024-10-09||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server weblogic_server WebLogic Server

CVE-2020-14625

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-7.09% / 91.71%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:30

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-14701

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||CRITICAL

EPSS-1.79% / 83.13%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-26 Sep, 2024 | 20:40

Vulnerability in the Oracle SD-WAN Aware product of Oracle Communications Applications (component: User Interface). The supported version that is affected is 8.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SD-WAN Aware. While the vulnerability is in Oracle SD-WAN Aware, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle SD-WAN Aware. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Product-sd-wan_aware SD-WAN Aware

CVE-2020-14645

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-92.31% / 99.74%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:27

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-14687

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.90% / 83.62%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-26 Sep, 2024 | 20:42

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-14611

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.6||HIGH

EPSS-1.23% / 79.56%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:32

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized read access to a subset of Oracle WebCenter Portal accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).

Product-webcenter_portal WebCenter Portal

CVE-2020-14825

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-20.26% / 95.65%

||

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:16

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2016-5578

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.6||HIGH

EPSS-0.69% / 72.25%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.5.1 through 8.5.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters, a different vulnerability than CVE-2016-5558, CVE-2016-5574, CVE-2016-5577, CVE-2016-5579, and CVE-2016-5588.

CWE ID-CWE-284

Improper Access Control

CVE-2016-5535

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-3.55% / 87.94%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

Product-weblogic_server n/a

CVE-2016-1283

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.37% / 85.28%

||

7 Day CHG~0.00%

Published-03 Jan, 2016 | 00:00

Updated-06 May, 2026 | 22:30

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Vendor-pcre n/a The PHP Group Oracle Corporation Fedora Project

Product-solaris pcre php fedora n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-5558

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.6||HIGH

EPSS-3.41% / 87.69%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.5.1 through 8.5.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters, a different vulnerability than CVE-2016-5574, CVE-2016-5577, CVE-2016-5578, CVE-2016-5579, and CVE-2016-5588.

CVE-2016-5577

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.6||HIGH

EPSS-0.69% / 72.25%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.5.1 through 8.5.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters, a different vulnerability than CVE-2016-5558, CVE-2016-5574, CVE-2016-5578, CVE-2016-5579, and CVE-2016-5588.

CWE ID-CWE-284

Improper Access Control

CVE-2019-2792

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.64% / 70.94%

||

7 Day CHG~0.00%

Published-23 Jul, 2019 | 22:31

Updated-15 Oct, 2024 | 18:57

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Product-outside_in_technology Outside In Technology

CVE-2014-9674

Matching Score-8

Assigner-MITRE Corporation

Product-ubuntu_linux enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop opensuse solaris enterprise_linux_server_eus enterprise_linux_hpc_node fedora freetype enterprise_linux_hpc_node_eus n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-4.31% / 89.11%

||

7 Day CHG~0.00%

Published-08 Feb, 2015 | 11:00

Updated-06 May, 2026 | 22:30

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

Vendor-freetype n/a Canonical Ltd.openSUSE Oracle Corporation Red Hat, Inc.Fedora Project

CVE-2015-0396

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.82% / 74.76%

||

7 Day CHG~0.00%

Published-21 Jan, 2015 | 18:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Admin Console.

Product-fusion_middleware n/a

CVE-2015-3145

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-7.5||HIGH

EPSS-67.99% / 98.61%

||

7 Day CHG~0.00%

Published-24 Apr, 2015 | 14:00

Updated-06 May, 2026 | 22:30

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.

Vendor-n/a Canonical Ltd.Apple Inc.openSUSE CURL Oracle Corporation HP Inc.Debian GNU/Linux Fedora Project

Product-debian_linux ubuntu_linux system_management_homepage mac_os_x curl libcurl solaris fedora opensuse n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-0908

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.69% / 72.11%

||

7 Day CHG~0.00%

Published-13 Jul, 2010 | 22:07

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

Product-e-business_suite n/a

CVE-2020-11973

Matching Score-8

Matching Score-8

Product-communications_diameter_signaling_router camel enterprise_manager_base_platform flexcube_private_banking Apache Camel

CVSS Score-9.8||CRITICAL

EPSS-14.10% / 94.52%

||

7 Day CHG~0.00%

Published-14 May, 2020 | 16:22

Updated-04 Aug, 2024 | 11:48

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11656

Matching Score-8

Assigner-MITRE Corporation

Product-sinec_infrastructure_network_services communications_messaging_server ontap_select_deploy_administration_utility sqlite communications_network_charging_and_control zfs_storage_appliance_kit outside_in_technology tenable.sc hyperion_infrastructure_technology mysql_workbench enterprise_manager_ops_center mysql n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-6.23% / 91.09%

||

7 Day CHG~0.00%

Published-09 Apr, 2020 | 02:49

Updated-04 Aug, 2024 | 11:35

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

Vendor-sqlite n/a NetApp, Inc.Oracle Corporation Tenable, Inc.Siemens AG

CWE ID-CWE-416

Use After Free

CVE-2016-3446

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.3||HIGH

EPSS-0.63% / 70.79%

||

7 Day CHG~0.00%

Published-21 Jul, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Analytics Web Administration.

Product-business_intelligence n/a

CVE-2020-11984

Matching Score-8

Matching Score-8

Vendor-n/a Canonical Ltd.The Apache Software Foundation NetApp, Inc.openSUSE Fedora Project Debian GNU/Linux Oracle Corporation

CVSS Score-9.8||CRITICAL

EPSS-76.29% / 98.95%

||

7 Day CHG~0.00%

Published-07 Aug, 2020 | 15:27

Updated-04 Aug, 2024 | 11:48

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

Product-http_server clustered_data_ontap ubuntu_linux debian_linux instantis_enterprisetrack fedora communications_session_route_manager zfs_storage_appliance_kit communications_session_report_manager hyperion_infrastructure_technology enterprise_manager_ops_center communications_element_manager leap Apache HTTP Server

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2002-0656

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-89.06% / 99.55%

||

7 Day CHG~0.00%

Published-31 Jul, 2002 | 04:00

Updated-16 Apr, 2026 | 00:27

Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.

Vendor-n/a Oracle Corporation Apple Inc.OpenSSL

Product-corporate_time_outlook_connector mac_os_x openssl http_server application_server n/a

CVE-2020-11972

Matching Score-8

Matching Score-8

Product-communications_diameter_signaling_router camel enterprise_manager_base_platform flexcube_private_banking Apache Camel

CVSS Score-9.8||CRITICAL

EPSS-6.92% / 91.60%

||

7 Day CHG~0.00%

Published-14 May, 2020 | 16:26

Updated-04 Aug, 2024 | 11:48

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-10683

Matching Score-8

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router ubuntu_linux banking_platform endeca_information_discovery_integrator agile_plm health_sciences_empirica_signal snapcenter communications_application_session_controller insurance_policy_administration_j2ee retail_order_broker financial_services_analytical_applications_infrastructure retail_price_management dom4j communications_unified_inventory_management documaker application_testing_suite fusion_middleware retail_customer_management_and_segmentation_foundation business_process_management_suite leap insurance_rules_palette oncommand_api_services rapid_planning retail_integration_bus oncommand_workflow_automation enterprise_data_quality utilities_framework storagetek_tape_analytics_sw_tool primavera_p6_enterprise_project_portfolio_management health_sciences_information_manager snapmanager flexcube_core_banking jdeveloper retail_xstore_point_of_service snap_creator_framework enterprise_manager_base_platform webcenter_portal data_integrator n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-6.96% / 91.63%

||

7 Day CHG~0.00%

Published-01 May, 2020 | 18:55

Updated-04 Aug, 2024 | 11:06

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Vendor-dom4j_project n/a NetApp, Inc.Canonical Ltd.Oracle Corporation openSUSE

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2020-10878

Matching Score-8

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router communications_billing_and_revenue_management communications_offline_mediation_controller tekelec_platform_distribution perl configuration_manager communications_eagle_lnp_application_processor oncommand_workflow_automation communications_performance_intelligence_center sd-wan_aware communications_pricing_design_center fedora communications_eagle_application_processor snap_creator_framework communications_lsms enterprise_manager_base_platform leap n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-8.6||HIGH

EPSS-0.11% / 29.15%

||

7 Day CHG~0.00%

Published-05 Jun, 2020 | 13:27

Updated-04 Aug, 2024 | 11:14

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

Vendor-perl n/a NetApp, Inc.Oracle Corporation Fedora Project openSUSE

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2009-1000

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.62% / 70.36%

||

7 Day CHG~0.00%

Published-15 Apr, 2009 | 10:00

Updated-23 Apr, 2026 | 00:35

The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not DB users)," which has unknown impact and attack vectors.

Product-e-business_suite n/a

CVE-2002-1923

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.71% / 72.69%

||

7 Day CHG~0.00%

Published-28 Jun, 2005 | 04:00

Updated-16 Apr, 2026 | 00:27

The default configuration in MySQL 3.20.32 through 3.23.52, when running on Windows, does not have logging enabled, which could allow remote attackers to conduct activities without detection.

Product-mysql n/a

CVE-2002-1631

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-5.94% / 90.83%

||

7 Day CHG~0.00%

Published-26 Mar, 2005 | 05:00

Updated-16 Apr, 2026 | 00:27

SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.

Product-application_server n/a

CVE-2019-0230

Matching Score-8

Matching Score-8

Product-financial_services_data_integration_hub struts mysql_enterprise_monitor financial_services_market_risk_measurement_and_management communications_policy_management Apache Struts

CVSS Score-9.8||CRITICAL

EPSS-93.85% / 99.88%

||

7 Day CHG~0.00%

Published-14 Sep, 2020 | 16:41

Updated-04 Aug, 2024 | 17:44

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CWE ID-CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVE-2020-10108

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.32% / 85.16%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 12:42

Updated-25 Nov, 2024 | 18:12

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Vendor-twisted n/a Oracle Corporation Canonical Ltd.Fedora Project Debian GNU/Linux

Product-ubuntu_linux debian_linux solaris fedora zfs_storage_appliance_kit twisted n/a

CWE ID-CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVE-2014-6051

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-7.98% / 92.25%

||

7 Day CHG~0.00%

Published-30 Sep, 2014 | 16:00

Updated-06 May, 2026 | 22:30

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.

Vendor-libvncserver n/a Oracle Corporation Red Hat, Inc.Debian GNU/Linux Fedora Project

Product-debian_linux libvncserver solaris enterprise_linux_server_eus enterprise_linux_server_aus fedora n/a

CVE-2019-0228

Matching Score-8

Matching Score-8

Product-banking_trade_finance_process_management peoplesoft_enterprise_peopletools banking_supply_chain_finance pdfbox communications_messaging_server hyperion_financial_reporting fedora retail_xstore_point_of_service james banking_corporate_lending_process_management communications_session_report_manager webcenter_sites banking_credit_facilities_process_management banking_virtual_account_management Apache PDFBox

CVSS Score-9.8||CRITICAL

EPSS-13.03% / 94.24%

||

7 Day CHG~0.00%

Published-17 Apr, 2019 | 14:07

Updated-04 Aug, 2024 | 17:44

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

Vendor-n/a The Apache Software Foundation Fedora Project Oracle Corporation

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2017-3553

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.9||CRITICAL

EPSS-0.87% / 75.51%

||

7 Day CHG~0.00%

Published-24 Apr, 2017 | 19:00

Updated-13 May, 2026 | 00:24

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Rules Engine). The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Product-identity_manager Identity Manager

CVE-2001-0326

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.52% / 81.64%

||

7 Day CHG~0.00%

Published-07 May, 2001 | 04:00

Updated-16 Apr, 2026 | 00:27

Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission.

Product-oracle8i application_server n/a

CVE-2019-0219

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-8.91% / 92.74%

||

7 Day CHG~0.00%

Published-14 Jan, 2020 | 14:18

Updated-04 Aug, 2024 | 17:44

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.

Vendor-The Apache Software Foundation Oracle Corporation

Product-instantis_enterprisetrack retail_xstore_point_of_service cordova_inappbrowser Cordova

CVE-2018-9019

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.00% / 83.99%

||

7 Day CHG~0.00%

Published-22 May, 2018 | 20:00

Updated-05 Aug, 2024 | 07:10

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php.

Vendor-n/a Dolibarr ERP & CRM Oracle Corporation

Product-dolibarr data_integrator n/a

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2018-7489

Matching Score-8

Assigner-MITRE Corporation

Product-debian_linux communications_billing_and_revenue_management jackson-databind communications_instant_messaging_server jboss_enterprise_application_platform n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-36.21% / 97.20%

||

7 Day CHG~0.00%

Published-26 Feb, 2018 | 15:00

Updated-05 Aug, 2024 | 06:31

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Vendor-n/a Red Hat, Inc.Oracle Corporation FasterXML, LLC.Debian GNU/Linux

CWE ID-CWE-502

Deserialization of Untrusted Data

CWE ID-CWE-184

Incomplete List of Disallowed Inputs

CVE-2018-8013

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-1.23% / 79.55%

||

7 Day CHG~0.00%

Published-24 May, 2018 | 16:00

Updated-16 Sep, 2024 | 23:16

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Vendor-Canonical Ltd.The Apache Software Foundation Debian GNU/Linux Oracle Corporation

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2018-7318

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-25.32% / 96.32%

||

7 Day CHG~0.00%

Published-22 Feb, 2018 | 19:00

Updated-05 Aug, 2024 | 06:24

SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.

Vendor-belitsoft n/a Oracle Corporation

Product-checklist data_integrator n/a

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2018-8088

Matching Score-8

Assigner-MITRE Corporation