ByteOS

Product:WebLogic Server

Added At:01 May, 2023

Due At:22 May, 2023

Oracle WebLogic Server Unspecified Vulnerability

Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.

Used in Ransomware

Unknown

CWE

N/A

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://www.oracle.com/security-alerts/cpujan2023.html; https://nvd.nist.gov/vuln/detail/CVE-2023-21839

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:oracle

Assigner Org ID:43595867-4340-4103-b7a2-9a5208d29a85

Published At:17 Jan, 2023 | 23:35

Updated At:21 Oct, 2025 | 23:15

▼CVE Numbering Authority (CNA)

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected Products

Vendor

Product

WebLogic Server

Versions

Affected

12.2.1.3.0
12.2.1.4.0
14.1.1.0.0

Problem Types

Type	CWE ID	Description
N/A	N/A	Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

Type: N/A

CWE ID: N/A

Description: Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

Metrics

Version	Base score	Base severity	Vector
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpujan2023.html	vendor-advisory
http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html	N/A

Hyperlink: https://www.oracle.com/security-alerts/cpujan2023.html

Resource:

vendor-advisory

Hyperlink: http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpujan2023.html	vendor-advisory x_transferred
http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html	x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpujan2023.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-306	CWE-306 Missing Authentication for Critical Function

Type: CWE

CWE ID: CWE-306

Description: CWE-306 Missing Authentication for Critical Function

Metrics Other Info

kev

dateAdded:

2023-05-01

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839

Timeline

Event	Date
CVE-2023-21839 added to CISA KEV	2023-05-01 00:00:00

Event: CVE-2023-21839 added to CISA KEV

Date: 2023-05-01 00:00:00

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839	government-resource

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839

Resource:

government-resource

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:18 Jan, 2023 | 00:15

Updated At:27 Oct, 2025 | 17:08

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2023-05-01	2023-05-22	Oracle WebLogic Server Unspecified Vulnerability	Apply updates per vendor instructions.

Date Added: 2023-05-01

Due Date: 2023-05-22

Vulnerability Name: Oracle WebLogic Server Unspecified Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

>>weblogic_server>>12.2.1.3.0

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*

>>weblogic_server>>12.2.1.4.0

cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*

>>weblogic_server>>14.1.1.0.0

Weaknesses

CWE ID	Type	Source
CWE-502	Primary	nvd@nist.gov
CWE-306	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-502

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-306

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html	secalert_us@oracle.com	Exploit Third Party Advisory VDB Entry
https://www.oracle.com/security-alerts/cpujan2023.html	secalert_us@oracle.com	Patch Vendor Advisory
http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
https://www.oracle.com/security-alerts/cpujan2023.html	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839	134c704f-9b21-4f2e-91b3-4a467353bcc0	US Government Resource

Hyperlink: http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html

Source: secalert_us@oracle.com

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://www.oracle.com/security-alerts/cpujan2023.html

Source: secalert_us@oracle.com

Resource:

Patch

Vendor Advisory

Hyperlink: http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://www.oracle.com/security-alerts/cpujan2023.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

US Government Resource

Similar CVEs

503Records found

CVE-2019-14439

Matching Score-10

Assigner-MITRE Corporation

Vendor-n/a Debian GNU/Linux Fedora Project Oracle Corporation The Apache Software Foundation FasterXML, LLC.Red Hat, Inc.

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-10.32% / 93.20%

7 Day CHG~0.00%

Published-30 Jul, 2019 | 10:49

Updated-05 Aug, 2024 | 00:19

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Product-communications_diameter_signaling_router global_lifecycle_management_opatch siebel_engineering_-_installer_\&_deployment jd_edwards_enterpriseone_orchestrator primavera_gateway siebel_ui_framework banking_platform communications_instant_messaging_server jboss_middleware_text-only_advisories debian_linux jackson-databind financial_services_analytical_applications_infrastructure fedora goldengate_stream_analytics retail_xstore_point_of_service jd_edwards_enterpriseone_tools drill retail_customer_management_and_segmentation_foundation n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2023-21931

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-84.02% / 99.31%

7 Day CHG+2.21%

Published-18 Apr, 2023 | 19:54

Updated-13 Feb, 2025 | 16:40

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2023-21837

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.05% / 77.57%

7 Day CHG~0.00%

Published-17 Jan, 2023 | 23:35

Updated-17 Sep, 2024 | 14:35

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-30762

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.11% / 29.19%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-16 Jul, 2025 | 15:15

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-Oracle WebLogic Server

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2022-39412

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-4.25% / 88.82%

7 Day CHG~0.00%

Published-18 Oct, 2022 | 00:00

Updated-23 Sep, 2024 | 18:35

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-access_manager Access Manager

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2023-21979

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.91% / 75.76%

7 Day CHG~0.00%

Published-18 Apr, 2023 | 19:54

Updated-16 Sep, 2024 | 15:35

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2023-22047

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-91.63% / 99.68%

7 Day CHG~0.00%

Published-18 Jul, 2023 | 20:18

Updated-13 Sep, 2024 | 17:35

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-peoplesoft_enterprise PeopleSoft Enterprise PT PeopleTools

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2023-21842

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.10% / 78.08%

7 Day CHG~0.00%

Published-17 Jan, 2023 | 23:35

Updated-16 Sep, 2024 | 15:35

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2024-21007

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.78% / 73.80%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-21 May, 2025 | 19:43

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2024-21183

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.75% / 73.19%

7 Day CHG~0.00%

Published-16 Jul, 2024 | 22:40

Updated-26 Mar, 2025 | 15:15

Product-weblogic_server WebLogic Server weblogic_server

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2024-21006

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-84.93% / 99.35%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:25

Updated-18 Mar, 2025 | 15:15

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2020-9315

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-87.93% / 99.48%

7 Day CHG~0.00%

Published-10 May, 2020 | 22:23

Updated-04 Aug, 2024 | 10:26

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.

Vendor-n/a Oracle Corporation

Product-iplanet_web_server n/a

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2017-9735

Matching Score-8

Assigner-MITRE Corporation

Product-jetty retail_xstore_point_of_service debian_linux communications_cloud_native_core_policy hospitality_guest_access enterprise_manager_base_platform rest_data_services n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.28% / 79.58%

7 Day CHG+0.43%

Published-16 Jun, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Vendor-n/a Eclipse Foundation AISBL Debian GNU/Linux Oracle Corporation

CWE ID-CWE-203

Observable Discrepancy

CVE-2025-33142

Matching Score-8

Assigner-IBM Corporation

Vendor-Oracle Corporation IBM Corporation HP Inc.Microsoft Corporation Linux Kernel Organization, Inc

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.03% / 8.71%

7 Day CHG~0.00%

Published-14 Aug, 2025 | 15:41

Updated-18 Aug, 2025 | 18:05

IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.

Product-linux_kernel windows z\/os i solaris hp-ux websphere_application_server aix WebSphere Application Server

CWE ID-CWE-295

Improper Certificate Validation

CVE-2025-30708

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.43% / 62.62%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-26 Jun, 2025 | 18:57

Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Search and Register Users). Supported versions that are affected are 12.2.4-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle User Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle User Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-user_management Oracle User Management

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2019-2900

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.33% / 84.85%

7 Day CHG~0.00%

Published-16 Oct, 2019 | 17:40

Updated-15 Oct, 2024 | 18:51

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-business_intelligence Business Intelligence Enterprise Edition

CVE-2025-30716

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.43% / 62.62%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-21 Apr, 2025 | 19:55

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-common_applications Oracle Common Applications

CWE ID-CWE-862

Missing Authorization

CVE-2025-30728

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.43% / 62.62%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-21 Apr, 2025 | 19:56

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-configurator Oracle Configurator

CWE ID-CWE-284

Improper Access Control

CVE-2025-30707

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.43% / 62.62%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-21 Apr, 2025 | 19:28

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-istore Oracle iStore

CWE ID-CWE-284

Improper Access Control

CVE-2025-30724

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.38% / 59.47%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-21 Apr, 2025 | 19:55

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-bi_publisher Oracle BI Publisher

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2020-2967

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-4.67% / 89.34%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-26 Sep, 2024 | 20:35

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2017-10115

Matching Score-8

Assigner-Oracle

Vendor-Debian GNU/Linux Red Hat, Inc.Oracle Corporation NetApp, Inc.Phoenix Contact GmbH & Co. KG

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.51% / 66.35%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2020-26184

Matching Score-8

Assigner-Dell

Product-bsafe_micro-edition-suite http_server security_service weblogic_server_proxy_plug-in Dell BSAFE Micro Edition Suite

Matching Score-8

Assigner-Dell

CVSS Score-7.5||HIGH

EPSS-0.31% / 54.23%

7 Day CHG~0.00%

Published-01 Jun, 2022 | 14:25

Updated-16 Sep, 2024 | 17:33

Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability.

Vendor-Oracle Corporation Dell Inc.

CWE ID-CWE-295

Improper Certificate Validation

CVE-2016-6797

Matching Score-8

Matching Score-8

Vendor-Debian GNU/Linux Canonical Ltd.Red Hat, Inc.The Apache Software Foundation Oracle Corporation NetApp, Inc.

CVSS Score-7.5||HIGH

EPSS-0.34% / 56.72%

7 Day CHG~0.00%

Published-10 Aug, 2017 | 22:00

Updated-20 Apr, 2025 | 01:37

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

Product-enterprise_linux_desktop tekelec_platform_distribution enterprise_linux_server_tus enterprise_linux_eus enterprise_linux_workstation tomcat oncommand_shift debian_linux snap_creator_framework enterprise_linux_server ubuntu_linux enterprise_linux_server_aus jboss_enterprise_web_server oncommand_insight Apache Tomcat

CWE ID-CWE-863

Incorrect Authorization

CVE-2025-21565

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.48% / 65.03%

7 Day CHG~0.00%

Published-21 Jan, 2025 | 20:53

Updated-29 Apr, 2025 | 20:01

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-agile_product_lifecycle_management Oracle Agile PLM Framework

CWE ID-CWE-863

Incorrect Authorization

CVE-2025-21510

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.46% / 64.05%

7 Day CHG~0.00%

Published-21 Jan, 2025 | 20:52

Updated-17 Mar, 2025 | 19:47

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-jd_edwards_enterpriseone_tools JD Edwards EnterpriseOne Tools

CWE ID-CWE-203

Observable Discrepancy

CVE-2016-5842

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.39% / 80.40%

7 Day CHG~0.00%

Published-13 Dec, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.

Vendor-n/a ImageMagick Studio LLC Oracle Corporation

Product-imagemagick solaris n/a

CWE ID-CWE-125

Out-of-bounds Read

CVE-2020-14820

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-5.24% / 89.99%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:17

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2020-14639

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-5.24% / 89.99%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:28

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2016-2183

Matching Score-8

Assigner-Red Hat, Inc.

Vendor-n/a Node.js (OpenJS Foundation)Cisco Systems, Inc.Red Hat, Inc.OpenSSL Oracle Corporation Python Software Foundation

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-7.5||HIGH

EPSS-40.99% / 97.39%

7 Day CHG~0.00%

Published-01 Sep, 2016 | 00:00

Updated-12 Apr, 2025 | 10:46

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Product-enterprise_linux python jboss_enterprise_web_server jboss_enterprise_application_platform content_security_management_appliance jboss_web_server node.js openssl database n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-16056

Matching Score-8

Assigner-MITRE Corporation

Vendor-n/a Canonical Ltd.openSUSE Red Hat, Inc.Python Software Foundation Oracle Corporation Debian GNU/Linux Fedora Project

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.22% / 79.05%

7 Day CHG~0.00%

Published-06 Sep, 2019 | 17:24

Updated-05 Aug, 2024 | 01:03

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Product-ubuntu_linux communications_operations_monitor debian_linux peoplesoft_enterprise_peopletools software_collections solaris fedora zfs_storage_appliance_kit python leap n/a

CVE-2020-7067

Matching Score-8

Assigner-PHP Group

Matching Score-8

Assigner-PHP Group

CVSS Score-7.5||HIGH

EPSS-9.98% / 93.06%

7 Day CHG~0.00%

Published-27 Apr, 2020 | 20:38

Updated-17 Sep, 2024 | 02:21

OOB Read in urldecode()

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Vendor-Oracle Corporation Debian GNU/Linux Tenable, Inc.The PHP Group

Product-communications_diameter_signaling_router php debian_linux tenable.sc PHP

CWE ID-CWE-125

Out-of-bounds Read

CWE ID-CWE-196

Unsigned to Signed Conversion Error

CVE-2022-43917

Matching Score-8

Assigner-IBM Corporation

Vendor-Oracle Corporation HP Inc.Microsoft Corporation IBM Corporation Linux Kernel Organization, Inc

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.11% / 29.60%

7 Day CHG~0.00%

Published-25 Jan, 2023 | 17:17

Updated-31 Mar, 2025 | 14:31

IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045.

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CVE-2019-13565

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-3.82% / 88.13%

7 Day CHG~0.00%

Published-26 Jul, 2019 | 12:30

Updated-04 Aug, 2024 | 23:57

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

Vendor-openldap n/a openSUSE Oracle Corporation F5, Inc.Debian GNU/Linux Apple Inc.Canonical Ltd.

Product-ubuntu_linux debian_linux solaris blockchain_platform zfs_storage_appliance_kit mac_os_x traffix_signaling_delivery_controller openldap leap n/a

CVE-2020-11971

Matching Score-8

Matching Score-8

Product-communications_diameter_signaling_router communications_diameter_intelligence_hub camel flexcube_private_banking enterprise_manager_base_platform Apache Camel

CVSS Score-7.5||HIGH

EPSS-9.70% / 92.94%

7 Day CHG~0.00%

Published-14 May, 2020 | 16:18

Updated-04 Aug, 2024 | 11:48

Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CVE-2003-0411

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-9.27% / 92.74%

7 Day CHG~0.00%

Published-11 Jun, 2003 | 04:00

Updated-16 Apr, 2026 | 00:27

Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension.

Vendor-n/a Oracle Corporation Microsoft Corporation

Product-windows_xp windows_2000 sun_one_application_server n/a

CWE ID-CWE-178

Improper Handling of Case Sensitivity

CVE-2019-12423

Matching Score-8

Matching Score-8

Product-communications_diameter_signaling_router retail_order_broker communications_session_route_manager flexcube_private_banking communications_session_report_manager cxf communications_element_manager commerce_guided_search CXF

CVSS Score-7.5||HIGH

EPSS-1.16% / 78.64%

7 Day CHG~0.00%

Published-16 Jan, 2020 | 17:42

Updated-04 Aug, 2024 | 23:17

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.

Vendor-The Apache Software Foundation Oracle Corporation

CWE ID-CWE-522

Insufficiently Protected Credentials

CVE-2019-12399

Matching Score-8

Matching Score-8

Product-banking_trade_finance_process_management banking_supply_chain_finance communications_cloud_native_core_policy banking_payments blockchain_platform flexcube_universal_banking financial_services_analytical_applications_infrastructure banking_liquidity_management banking_corporate_lending_process_management banking_platform kafka banking_credit_facilities_process_management banking_virtual_account_management Kafka

CVSS Score-7.5||HIGH

EPSS-2.31% / 84.78%

7 Day CHG~0.00%

Published-14 Jan, 2020 | 14:28

Updated-04 Aug, 2024 | 23:17

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

Vendor-The Apache Software Foundation Oracle Corporation

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CVE-2019-0188

Matching Score-8

Matching Score-8

Product-enterprise_repository camel flexcube_private_banking enterprise_data_quality enterprise_manager_base_platform Apache Camel

CVSS Score-7.5||HIGH

EPSS-1.32% / 79.91%

7 Day CHG~0.00%

Published-28 May, 2019 | 18:10

Updated-04 Aug, 2024 | 17:44

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

Vendor-The Apache Software Foundation Oracle Corporation

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2023-22019

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.27% / 50.40%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 21:02

Updated-13 Sep, 2024 | 17:35

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-http_server HTTP Server

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2015-2802

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-3.88% / 88.26%

7 Day CHG~0.00%

Published-04 Feb, 2020 | 20:09

Updated-06 Aug, 2024 | 05:24

An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, and Asset Manager Cloudsystem Chargeback 9.40, which could let a remote malicious user obtain sensitive information. This is the TLS vulnerability known as the RC4 cipher Bar Mitzvah vulnerability.

Vendor-n/a Microsoft Corporation HP Inc.Oracle Corporation Linux Kernel Organization, Inc

Product-solaris linux_kernel asset_manager windows sitescope asset_manager_cloudsystem_chargeback n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2022-43927

Matching Score-8

Assigner-IBM Corporation

Vendor-IBM Corporation HP Inc.Microsoft Corporation Oracle Corporation Linux Kernel Organization, Inc

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.14% / 33.31%

7 Day CHG~0.00%

Published-17 Feb, 2023 | 16:51

Updated-18 Mar, 2025 | 15:44

IBM Db2 for Linux, UNIX and Windows information disclosure

IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used. IBM X-Force ID: 241671.

Product-solaris linux_kernel db2 hp-ux windows aix Db2 for Linux, UNIX and Windows

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-269

Improper Privilege Management

CVE-2018-8034

Matching Score-8

Matching Score-8

CVSS Score-7.5||HIGH

EPSS-11.72% / 93.72%

7 Day CHG~0.00%

Published-01 Aug, 2018 | 18:00

Updated-21 Oct, 2024 | 16:35

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

Vendor-Canonical Ltd.The Apache Software Foundation Debian GNU/Linux Oracle Corporation

Product-retail_order_broker ubuntu_linux debian_linux tomcat Apache Tomcat

CWE ID-CWE-295

Improper Certificate Validation

CVE-2020-24584

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-3.29% / 87.22%

7 Day CHG~0.00%

Published-01 Sep, 2020 | 12:36

Updated-04 Aug, 2024 | 15:19

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

Vendor-n/a Canonical Ltd.Django Oracle Corporation Fedora Project

Product-ubuntu_linux django zfs_storage_appliance_kit fedora n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2025-21511

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.24% / 47.55%

7 Day CHG~0.00%

Published-21 Jan, 2025 | 20:53

Updated-17 Mar, 2025 | 19:47

Product-jd_edwards_enterpriseone_tools JD Edwards EnterpriseOne Tools

CWE ID-CWE-346

Origin Validation Error

CVE-2020-14864

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-94.02% / 99.90%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-12 Jan, 2026 | 20:36

Known KEV||Action Due Date - 2022-07-18||Apply updates per vendor instructions.

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-business_intelligence Business Intelligence Enterprise Edition Intelligence Enterprise Edition

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2018-21026

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.47% / 64.47%

7 Day CHG~0.00%

Published-12 Nov, 2019 | 17:42

Updated-05 Aug, 2024 | 12:19

A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information.

Vendor-n/a Oracle Corporation Linux Kernel Organization, Inc Hitachi, Ltd.Microsoft Corporation

Product-solaris linux_kernel compute_systems_manager windows tuning_manager replication_manager device_manager tiered_storage_manager n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2022-21371

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-93.53% / 99.83%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:26

Updated-24 Sep, 2024 | 20:18

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2022-21566

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-3.23% / 87.08%

7 Day CHG~0.00%

Published-19 Jul, 2022 | 21:08

Updated-24 Sep, 2024 | 19:52

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.9-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-applications_framework Applications Framework

CVE-2022-21567

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.76% / 82.63%

7 Day CHG~0.00%

Published-19 Jul, 2022 | 21:08

Updated-24 Sep, 2024 | 19:51

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Workflow accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).