ByteOS

Product:Fusion Middleware

Added At:28 Nov, 2022

Due At:19 Dec, 2022

Oracle Fusion Middleware Unspecified Vulnerability

Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.

Used in Ransomware

Unknown

CWE

CWE-502 CWE-790

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://www.oracle.com/security-alerts/cpujan2022.html; https://nvd.nist.gov/vuln/detail/CVE-2021-35587

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:oracle

Assigner Org ID:43595867-4340-4103-b7a2-9a5208d29a85

Published At:19 Jan, 2022 | 11:21

Updated At:21 Oct, 2025 | 23:15

▼CVE Numbering Authority (CNA)

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Products

Vendor

Product

Access Manager

Versions

Affected

11.1.2.3.0
12.2.1.3.0
12.2.1.4.0

Problem Types

Type	CWE ID	Description
text	N/A	Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager.

Type: text

CWE ID: N/A

Description: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager.

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Hyperlink: https://www.oracle.com/security-alerts/cpujan2022.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpujan2022.html

Resource:

x_refsource_MISC

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-306	CWE-306 Missing Authentication for Critical Function

Type: CWE

CWE ID: CWE-306

Description: CWE-306 Missing Authentication for Critical Function

Metrics Other Info

kev

dateAdded:

2022-11-28

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587

Timeline

Event	Date
CVE-2021-35587 added to CISA KEV	2022-11-28 00:00:00

Event: CVE-2021-35587 added to CISA KEV

Date: 2022-11-28 00:00:00

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587	government-resource

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587

Resource:

government-resource

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:19 Jan, 2022 | 12:15

Updated At:27 Oct, 2025 | 17:08

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-11-28	2022-12-19	Oracle Fusion Middleware Unspecified Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-11-28

Due Date: 2022-12-19

Vulnerability Name: Oracle Fusion Middleware Unspecified Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*

>>access_manager>>11.1.2.3.0

cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:*

>>access_manager>>12.2.1.3.0

cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*

>>access_manager>>12.2.1.4.0

Weaknesses

CWE ID	Type	Source
NVD-CWE-Other	Primary	nvd@nist.gov
CWE-306	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: NVD-CWE-Other

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-306

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://www.oracle.com/security-alerts/cpujan2022.html	secalert_us@oracle.com	Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587	134c704f-9b21-4f2e-91b3-4a467353bcc0	US Government Resource

Hyperlink: https://www.oracle.com/security-alerts/cpujan2022.html

Source: secalert_us@oracle.com

Resource:

Vendor Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

US Government Resource

Similar CVEs

1302Records found

CVE-2026-35273

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.03% / 7.47%

7 Day CHG~0.00%

Published-11 Jun, 2026 | 02:25

Updated-12 Jun, 2026 | 19:58

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-peoplesoft_enterprise_peopletools PeopleSoft Enterprise PeopleTools

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-53072

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.11% / 29.44%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-26 Feb, 2026 | 16:57

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-marketing Oracle Marketing

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2024-21014

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.15% / 78.87%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-17 Mar, 2025 | 16:15

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported versions that are affected are 19.1.0-19.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-hospitality_simphony Hospitality Simphony

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2026-46817

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.11% / 29.67%

7 Day CHG+0.06%

Published-28 May, 2026 | 20:17

Updated-04 Jun, 2026 | 13:45

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Oracle Payments

CWE ID-CWE-269

Improper Privilege Management

CWE ID-CWE-287

Improper Authentication

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2026-34275

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.12% / 31.21%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-01 May, 2026 | 03:55

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-advanced_inbound_telephony Oracle Advanced Inbound Telephony

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-30727

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.94% / 76.67%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-26 Feb, 2026 | 18:28

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in takeover of Oracle Scripting. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Oracle Scripting

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2026-21992

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.07% / 20.63%

7 Day CHG~0.00%

Published-20 Mar, 2026 | 02:24

Updated-24 Mar, 2026 | 03:55

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. Note: Oracle Web Services Manager is installed with an Oracle Fusion Middleware Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-web_services_manager identity_manager Oracle Web Services Manager Oracle Identity Manager

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-21535

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.00% / 77.43%

7 Day CHG~0.00%

Published-21 Jan, 2025 | 20:53

Updated-26 Feb, 2026 | 19:09

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server Oracle WebLogic Server

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-21524

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.18% / 79.14%

7 Day CHG~0.00%

Published-21 Jan, 2025 | 20:53

Updated-26 Feb, 2026 | 19:09

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-jd_edwards_enterpriseone_tools JD Edwards EnterpriseOne Tools

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2020-9480

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-88.27% / 99.51%

7 Day CHG~0.00%

Published-23 Jun, 2020 | 21:50

Updated-04 Aug, 2024 | 10:26

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Vendor-The Apache Software Foundation Oracle Corporation

Product-spark business_intelligence Apache Spark

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-62481

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.09% / 24.77%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-26 Feb, 2026 | 16:57

Product-marketing Oracle Marketing

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-61757

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-87.83% / 99.49%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-26 Feb, 2026 | 16:57

Known KEV||Action Due Date - 2025-12-12||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-identity_manager Identity Manager Fusion Middleware

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2023-22069

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.50% / 66.41%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 21:02

Updated-06 Mar, 2025 | 16:15

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2023-22072

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.66% / 71.62%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 21:02

Updated-06 Mar, 2025 | 16:15

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-53037

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.13% / 32.58%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:02

Updated-23 Oct, 2025 | 16:08

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-financial_services_analytical_applications_infrastructure Oracle Financial Services Analytical Applications Infrastructure

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2022-21587

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.40% / 99.98%

7 Day CHG~0.00%

Published-18 Oct, 2022 | 00:00

Updated-27 Oct, 2025 | 17:09

Known KEV||Action Due Date - 2023-02-23||Apply updates per vendor instructions.

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Web Applications Desktop Integrator E-Business Suite

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2001-0326

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.52% / 81.68%

7 Day CHG~0.00%

Published-07 May, 2001 | 04:00

Updated-16 Apr, 2026 | 00:27

Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission.

Product-oracle8i application_server n/a

CVE-2025-61882

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-90.86% / 99.65%

7 Day CHG+1.37%

Published-05 Oct, 2025 | 03:17

Updated-26 Feb, 2026 | 17:48

Known KEV||Action Due Date - 2025-10-27||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-concurrent_processing Oracle Concurrent Processing E-Business Suite

CWE ID-CWE-287

Improper Authentication

CVE-2020-14644

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-93.64% / 99.85%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-12 Jan, 2026 | 21:03

Known KEV||Action Due Date - 2024-10-09||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server weblogic_server WebLogic Server

CVE-2020-14645

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-92.31% / 99.74%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:27

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-14855

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-5.09% / 90.02%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:10

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-universal_work_queue Universal Work Queue

CVE-2016-3427

Matching Score-8

Assigner-Oracle

Vendor-n/a Oracle Corporation Debian GNU/Linux SUSE NetApp, Inc.Red Hat, Inc.openSUSE Canonical Ltd.The Apache Software Foundation

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-93.29% / 99.82%

7 Day CHG~0.00%

Published-21 Apr, 2016 | 10:00

Updated-22 Apr, 2026 | 13:41

Known KEV||Action Due Date - 2023-06-02||Apply updates per vendor instructions.

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CWE ID-CWE-284

Improper Access Control

CVE-2020-14882

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.45% / 99.99%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-12 Jan, 2026 | 20:22

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server WebLogic Server

CVE-2016-3561

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.66% / 71.61%

7 Day CHG~0.00%

Published-21 Jul, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SDK.

Product-agile_product_lifecycle_management n/a

CVE-2020-14611

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.6||HIGH

EPSS-1.23% / 79.57%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:32

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized read access to a subset of Oracle WebCenter Portal accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).

Product-webcenter_portal WebCenter Portal

CVE-2020-14750

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.44% / 99.99%

7 Day CHG~0.00%

Published-01 Nov, 2020 | 23:50

Updated-12 Jan, 2026 | 20:23

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

Product-weblogic_server WebLogic Server WebLogic Server

CVE-2016-5118

Matching Score-8

Assigner-MITRE Corporation

Product-debian_linux ubuntu_linux linux_enterprise_desktop imagemagick graphicsmagick linux_enterprise_workstation_extension studio_onsite linux_enterprise_debuginfo leap solaris linux_enterprise_server linux linux_enterprise_software_development_kit opensuse n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-37.74% / 97.30%

7 Day CHG~0.00%

Published-10 Jun, 2016 | 15:00

Updated-06 May, 2026 | 22:30

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

Vendor-n/a Canonical Ltd.ImageMagick Studio LLC openSUSE Oracle Corporation SUSE Debian GNU/Linux GraphicsMagick

CVE-2016-3446

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.3||HIGH

EPSS-0.63% / 70.84%

7 Day CHG~0.00%

Published-21 Jul, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Analytics Web Administration.

Product-business_intelligence n/a

CVE-2020-14859

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-7.64% / 92.07%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:09

CVE-2020-14609

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.6||HIGH

EPSS-2.62% / 86.00%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:32

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Answers). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).

Product-business_intelligence Oracle Business Intelligence Enterprise Edition

CVE-2020-14756

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-83.39% / 99.29%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:49

Updated-26 Sep, 2024 | 18:46

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-utilities_framework coherence Utilities Framework

CVE-2016-3504

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.61% / 82.16%

7 Day CHG~0.00%

Published-21 Jul, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to ADF Faces.

Product-jdeveloper n/a

CVE-2020-14625

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-7.09% / 91.72%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:30

CVE-2021-44790

Matching Score-8

Matching Score-8

Vendor-Fedora Project Tenable, Inc.Oracle Corporation The Apache Software Foundation Apple Inc.Debian GNU/Linux NetApp, Inc.

CVSS Score-9.8||CRITICAL

EPSS-86.23% / 99.42%

7 Day CHG~0.00%

Published-20 Dec, 2021 | 00:00

Updated-01 May, 2025 | 15:38

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Product-communications_session_route_manager debian_linux fedora communications_element_manager communications_session_report_manager http_server tenable.sc mac_os_x zfs_storage_appliance_kit communications_operations_monitor macos instantis_enterprisetrack cloud_backup Apache HTTP Server

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-14841

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-13.49% / 94.37%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:12

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-14687

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.90% / 83.63%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-26 Sep, 2024 | 20:42

CVE-2021-42392

Matching Score-8

Assigner-JFrog

Matching Score-8

Assigner-JFrog

CVSS Score-9.8||CRITICAL

EPSS-90.59% / 99.63%

7 Day CHG~0.00%

Published-07 Jan, 2022 | 00:00

Updated-04 Aug, 2024 | 03:30

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

Vendor-h2database h2database Oracle Corporation Debian GNU/Linux

Product-communications_cloud_native_core_policy debian_linux h2 h2

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2012-0549

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-85.07% / 99.37%

7 Day CHG~0.00%

Published-03 May, 2012 | 18:17

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related to Desktop API.

Product-supply_chain_products_suite n/a

CVE-2021-42575

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.72% / 72.91%

7 Day CHG~0.00%

Published-18 Oct, 2021 | 14:38

Updated-04 Aug, 2024 | 03:38

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Vendor-owasp n/a Oracle Corporation

Product-middleware_common_libraries_and_tools java_html_sanitizer primavera_unifier n/a

CVE-2012-0553

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.71% / 72.76%

7 Day CHG~0.00%

Published-28 Mar, 2013 | 23:00

Updated-29 Apr, 2026 | 01:13

Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28, has unspecified impact and attack vectors, a different vulnerability than CVE-2013-1492.

Vendor-mysql n/a Oracle Corporation

Product-mysql n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2020-14825

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-20.26% / 95.66%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:16

CVE-2000-0169

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-20.73% / 95.73%

7 Day CHG~0.00%

Published-02 Jun, 2000 | 04:00

Updated-16 Apr, 2026 | 00:27

Batch files in the Oracle web listener ows-bin directory allow remote attackers to execute commands via a malformed URL that includes '?&'.

Product-application_server n/a

CVE-2021-42013

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-94.41% / 99.98%

7 Day CHG~0.00%

Published-07 Oct, 2021 | 15:50

Updated-27 Oct, 2025 | 17:36

Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Vendor-Fedora Project The Apache Software Foundation Oracle Corporation NetApp, Inc.

Product-http_server instantis_enterprisetrack secure_backup jd_edwards_enterpriseone_tools fedora cloud_backup Apache HTTP Server HTTP Server

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2021-41773

Matching Score-8

Matching Score-8

CVSS Score-7.5||HIGH

EPSS-94.39% / 99.97%

7 Day CHG~0.00%

Published-05 Oct, 2021 | 08:40

Updated-17 Feb, 2026 | 19:49

Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Vendor-Fedora Project The Apache Software Foundation Oracle Corporation NetApp, Inc.

Product-http_server cloud_backup fedora instantis_enterprisetrack Apache HTTP Server HTTP Server

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2006-1872

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.39% / 85.37%

7 Day CHG~0.00%

Published-20 Apr, 2006 | 10:00

Updated-16 Apr, 2026 | 00:27

Unspecified vulnerability in Oracle Database Server 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors in the Oracle Enterprise Manager Intelligent Agent component, aka Vuln# DB07.

Product-database_server n/a

CVE-2020-14343

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-13.70% / 94.43%

7 Day CHG~0.00%

Published-09 Feb, 2021 | 00:00

Updated-04 Aug, 2024 | 12:39

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Vendor-pyyaml n/a Oracle Corporation

Product-communications_cloud_native_core_network_function_cloud_native_environment pyyaml PyYAML

CWE ID-CWE-20

Improper Input Validation

CVE-2018-3259

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-4.95% / 89.88%

7 Day CHG~0.00%

Published-17 Oct, 2018 | 01:00

Updated-02 Oct, 2024 | 19:29

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-database_server Oracle Database

CVE-2021-39085

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.3||MEDIUM

EPSS-0.23% / 45.63%

7 Day CHG~0.00%

Published-16 Aug, 2022 | 18:45

Updated-17 Sep, 2024 | 00:42

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 215888.

Product-sterling_b2b_integrator solaris linux_kernel hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2016-2182

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-28.95% / 96.68%

7 Day CHG~0.00%

Published-16 Sep, 2016 | 00:00

Updated-06 May, 2026 | 22:30

The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

Vendor-n/a OpenSSL HP Inc.Oracle Corporation

Product-icewall_sso icewall_federation_agent icewall_sso_agent_option icewall_mcrp linux openssl n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-2894

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.30% / 99.95%

7 Day CHG~0.00%

Published-18 Jul, 2018 | 13:00

Updated-02 Oct, 2024 | 20:21

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).