ByteOS

Product

Java SE JDK and JRE

Versions

Affected

Oracle Java SE:8u381
Oracle Java SE:8u381-perf
Oracle Java SE:11.0.20
Oracle Java SE:17.0.8
Oracle Java SE:21
Oracle GraalVM for JDK:17.0.8
Oracle GraalVM for JDK:21
Oracle GraalVM Enterprise Edition:20.3.11
Oracle GraalVM Enterprise Edition:21.3.7
Oracle GraalVM Enterprise Edition:22.3.3

Problem Types

Type	CWE ID	Description
N/A	N/A	Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.

Type: N/A

CWE ID: N/A

Description: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	vendor-advisory
https://security.netapp.com/advisory/ntap-20231027-0006/	N/A
https://www.debian.org/security/2023/dsa-5537	N/A
https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html	N/A
https://www.debian.org/security/2023/dsa-5548	N/A

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Resource:

vendor-advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20231027-0006/

Resource: N/A

Hyperlink: https://www.debian.org/security/2023/dsa-5537

Resource: N/A

Hyperlink: https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html

Resource: N/A

Hyperlink: https://www.debian.org/security/2023/dsa-5548

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	vendor-advisory x_transferred
https://security.netapp.com/advisory/ntap-20231027-0006/	x_transferred
https://www.debian.org/security/2023/dsa-5537	x_transferred
https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html	x_transferred
https://www.debian.org/security/2023/dsa-5548	x_transferred
https://security.netapp.com/advisory/ntap-20241108-0002/	N/A

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Resource:

vendor-advisory

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20231027-0006/

Resource:

x_transferred

Hyperlink: https://www.debian.org/security/2023/dsa-5537

Resource:

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html

Resource:

x_transferred

Hyperlink: https://www.debian.org/security/2023/dsa-5548

Resource:

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20241108-0002/

Resource: N/A

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-noinfo	CWE-noinfo Not enough information

Type: CWE

CWE ID: CWE-noinfo

Description: CWE-noinfo Not enough information

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:17 Oct, 2023 | 22:15

Updated At:03 Nov, 2025 | 22:16

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CPE Matches

cpe:2.3:a:oracle:graalvm_for_jdk:17.0.8:*:*:*:*:*:*:*

>>graalvm_for_jdk>>17.0.8

cpe:2.3:a:oracle:graalvm_for_jdk:21:*:*:*:*:*:*:*

>>graalvm_for_jdk>>21

cpe:2.3:a:oracle:jdk:1.8.0:update381:*:*:-:*:*:*

>>jdk>>1.8.0

cpe:2.3:a:oracle:jdk:1.8.0:update381:*:*:enterprise_performance_pack:*:*:*

>>jdk>>1.8.0

cpe:2.3:a:oracle:jdk:11.0.2:*:*:*:*:*:*:*

>>jdk>>11.0.2

cpe:2.3:a:oracle:jdk:17.0.8:*:*:*:*:*:*:*

>>jdk>>17.0.8

cpe:2.3:a:oracle:jdk:21.0.0:*:*:*:*:*:*:*

>>jdk>>21.0.0

cpe:2.3:a:oracle:jre:1.8.0:update381:*:*:-:*:*:*

>>jre>>1.8.0

cpe:2.3:a:oracle:jre:1.8.0:update381:*:*:enterprise_performance_pack:*:*:*

>>jre>>1.8.0

cpe:2.3:a:oracle:jre:11.0.2:*:*:*:*:*:*:*

>>jre>>11.0.2

cpe:2.3:a:oracle:jre:17.0.8:*:*:*:*:*:*:*

>>jre>>17.0.8

cpe:2.3:a:oracle:jre:21.0.0:*:*:*:*:*:*:*

>>jre>>21.0.0

NetApp, Inc.

>>cloud_insights_acquisition_unit>>-

cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*

NetApp, Inc.

>>cloud_insights_storage_workload_security_agent>>-

cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html	secalert_us@oracle.com	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20231027-0006/	secalert_us@oracle.com	Third Party Advisory
https://www.debian.org/security/2023/dsa-5537	secalert_us@oracle.com	Third Party Advisory
https://www.debian.org/security/2023/dsa-5548	secalert_us@oracle.com	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2023.html	secalert_us@oracle.com	Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20231027-0006/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://security.netapp.com/advisory/ntap-20241108-0002/	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.debian.org/security/2023/dsa-5537	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.debian.org/security/2023/dsa-5548	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2023.html	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html

Source: secalert_us@oracle.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20231027-0006/

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

Hyperlink: https://www.debian.org/security/2023/dsa-5537

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

Hyperlink: https://www.debian.org/security/2023/dsa-5548

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Source: secalert_us@oracle.com

Resource:

Patch

Vendor Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2023/10/msg00041.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20231027-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20241108-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://www.debian.org/security/2023/dsa-5537

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://www.debian.org/security/2023/dsa-5548

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Similar CVEs

87Records found

CVE-2022-21283

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.13% / 32.47%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:23

Updated-27 May, 2026 | 17:16

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Oracle Corporation NetApp, Inc.Debian GNU/Linux Fedora Project

CWE ID-CWE-693

Protection Mechanism Failure

CVE-2022-21360

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.11% / 29.35%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:25

Updated-27 May, 2026 | 15:16

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Oracle Corporation Debian GNU/Linux NetApp, Inc.

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2022-21626

Matching Score-8

Assigner-Oracle

Product-cloud_secure_agent santricity_web_services_proxy oncommand_workflow_automation jre e-series_santricity_storage_manager 7-mode_transition_tool jdk graalvm oncommand_insight santricity_storage_plugin e-series_santricity_os_controller zulu e-series_santricity_unified_manager fedora cloud_insights_acquisition_unit Java SE JDK and JRE

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.15% / 34.69%

7 Day CHG~0.00%

Published-18 Oct, 2022 | 00:00

Updated-27 May, 2026 | 15:16

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-azul Oracle Corporation NetApp, Inc.Fedora Project

CWE ID-CWE-693

Protection Mechanism Failure

CVE-2022-21293

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.10% / 26.49%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:23

Updated-27 May, 2026 | 17:16

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Oracle Corporation NetApp, Inc.Debian GNU/Linux Fedora Project

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2022-21574

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.40% / 60.88%

7 Day CHG~0.00%

Published-19 Jul, 2022 | 21:08

Updated-24 Sep, 2024 | 19:51

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Supported versions that are affected are 12.0.0.4.0-12.0.0.6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Product-communications_billing_and_revenue_management Communications Billing and Revenue Management

CVE-2024-25617

Matching Score-8

Assigner-GitHub, Inc.

Matching Score-8

Assigner-GitHub, Inc.

CVSS Score-5.3||MEDIUM

EPSS-1.29% / 80.01%

7 Day CHG~0.00%

Published-14 Feb, 2024 | 20:55

Updated-13 Feb, 2025 | 17:40

Denial of Service in HTTP Header parser in squid proxy

Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2

Vendor-NetApp, Inc.Squid Cache

Product-bluexp squid squid squid

CWE ID-CWE-182

Collapse of Data into Unsafe Value

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2021-2477

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-1.58% / 81.88%

7 Day CHG~0.00%

Published-20 Oct, 2021 | 10:49

Updated-25 Sep, 2024 | 19:39

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Framework. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Product-applications_framework Applications Framework

CVE-2021-21702

Matching Score-8

Assigner-PHP Group

Matching Score-8

Assigner-PHP Group

CVSS Score-5.3||MEDIUM

EPSS-0.30% / 53.21%

7 Day CHG~0.00%

Published-15 Feb, 2021 | 04:10

Updated-16 Sep, 2024 | 17:34

Null Dereference in SoapClient

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

Vendor-Debian GNU/Linux NetApp, Inc.Oracle Corporation The PHP Group

Product-communications_diameter_signaling_router clustered_data_ontap debian_linux php PHP

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2021-21252

Matching Score-8

Assigner-GitHub, Inc.

Matching Score-8

Assigner-GitHub, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.73% / 72.92%

7 Day CHG+0.06%

Published-13 Jan, 2021 | 00:00

Updated-03 Aug, 2024 | 18:09

Regular expression denial of service in jquery-validation

The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.

Vendor-jqueryvalidation jquery-validation NetApp, Inc.

Product-jquery_validation snapcenter jquery-validation

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2024-20915

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.09% / 25.12%

7 Day CHG~0.00%

Published-17 Feb, 2024 | 01:50

Updated-07 May, 2025 | 12:26

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Product-application_object_library Application Object Library application_object_library

CWE ID-CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVE-2020-7760

Matching Score-8

Assigner-Snyk

Product-codemirror application_express essbase hyperion_data_relationship_management enterprise_manager_express_user_interface spatial_studio codemirror org.apache.marmotta.webjars:codemirror

Matching Score-8

Assigner-Snyk

CVSS Score-5.3||MEDIUM

EPSS-0.34% / 56.94%

7 Day CHG~0.00%

Published-30 Oct, 2020 | 11:10

Updated-17 Sep, 2024 | 01:06

Regular Expression Denial of Service (ReDoS)

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*

Vendor-codemirror n/a Oracle Corporation

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2020-29508

Matching Score-8

Assigner-Dell

Product-http_server weblogic_server_proxy_plug-in bsafe_crypto-c-micro-edition database bsafe_micro-edition-suite security_service Dell BSAFE Micro Edition Suite

Matching Score-8

Assigner-Dell

CVSS Score-5.3||MEDIUM

EPSS-1.05% / 77.84%

7 Day CHG~0.00%

Published-11 Jul, 2022 | 19:25

Updated-16 Sep, 2024 | 16:13

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnerability.

Vendor-Oracle Corporation Dell Inc.

CWE ID-CWE-331

Insufficient Entropy

CWE ID-CWE-20

Improper Input Validation

CVE-2020-28469

Matching Score-8

Assigner-Snyk

Matching Score-8

Assigner-Snyk

CVSS Score-5.3||MEDIUM

EPSS-0.96% / 76.84%

7 Day CHG-0.03%

Published-03 Jun, 2021 | 15:15

Updated-16 Sep, 2024 | 18:43

Regular Expression Denial of Service (ReDoS)

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Vendor-gulpjs n/a Oracle Corporation

Product-glob-parent communications_cloud_native_core_policy glob-parent

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2020-2830

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.22% / 44.86%

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-27 Sep, 2024 | 19:06

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Debian GNU/Linux McAfee, LLC NetApp, Inc.Fedora Project openSUSE Oracle Corporation Canonical Ltd.

CVE-2020-28500

Matching Score-8

Assigner-Snyk

Matching Score-8

Assigner-Snyk

CVSS Score-5.3||MEDIUM

EPSS-0.24% / 47.90%

7 Day CHG~0.00%

Published-15 Feb, 2021 | 11:10

Updated-16 Sep, 2024 | 22:15

Regular Expression Denial of Service (ReDoS)

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Vendor-lodash n/a Oracle Corporation Siemens AG

CVE-2020-27223

Matching Score-8

Assigner-Eclipse Foundation

Vendor-Debian GNU/Linux Oracle Corporation NetApp, Inc.Eclipse Foundation AISBL The Apache Software Foundation

Matching Score-8

Assigner-Eclipse Foundation

CVSS Score-5.2||MEDIUM

EPSS-27.87% / 96.55%

7 Day CHG~0.00%

Published-26 Feb, 2021 | 21:55

Updated-20 Aug, 2025 | 10:15

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Product-debian_linux snapcenter rest_data_services solidfire snap_creator_framework e-series_santricity_os_controller spark hci management_services_for_element_software e-series_santricity_web_services jetty nifi solr hci_management_node snapmanager element_plug-in_for_vcenter_server Eclipse Jetty

CWE ID-CWE-407

Inefficient Algorithmic Complexity

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2020-2781

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.27% / 50.47%

7 Day CHG+0.01%

Published-15 Apr, 2020 | 13:29

Updated-30 Sep, 2024 | 15:05

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Debian GNU/Linux McAfee, LLC NetApp, Inc.Fedora Project openSUSE Oracle Corporation Canonical Ltd.

CVE-2020-26420

Matching Score-8

Assigner-GitLab Inc.

Matching Score-8

Assigner-GitLab Inc.

CVSS Score-3.1||LOW

EPSS-0.43% / 62.66%

7 Day CHG~0.00%

Published-11 Dec, 2020 | 17:20

Updated-04 Aug, 2024 | 15:56

Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.

Vendor-Wireshark Foundation Oracle Corporation Fedora Project

Product-wireshark fedora zfs_storage_appliance_kit Wireshark

CWE ID-CWE-401

Missing Release of Memory after Effective Lifetime

CVE-2020-2545

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-3.92% / 88.50%

7 Day CHG~0.00%

Published-15 Jan, 2020 | 16:34

Updated-30 Sep, 2024 | 17:25

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Product-http_server Security Service

CVE-2020-26421

Matching Score-8

Assigner-GitLab Inc.

Matching Score-8

Assigner-GitLab Inc.

CVSS Score-4.2||MEDIUM

EPSS-0.10% / 27.37%

7 Day CHG~0.00%

Published-11 Dec, 2020 | 17:25

Updated-04 Aug, 2024 | 15:56

Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.

Vendor-Wireshark Foundation Oracle Corporation Debian GNU/Linux Fedora Project

Product-wireshark debian_linux zfs_storage_appliance_kit fedora Wireshark

CWE ID-CWE-125

Out-of-bounds Read

CVE-2020-26422

Matching Score-8

Assigner-GitLab Inc.

Matching Score-8

Assigner-GitLab Inc.

CVSS Score-3.7||LOW

EPSS-0.27% / 50.77%

7 Day CHG-0.03%

Published-21 Dec, 2020 | 17:15

Updated-04 Aug, 2024 | 15:56

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file

Vendor-Wireshark Foundation Oracle Corporation

Product-wireshark zfs_storage_appliance_kit Wireshark

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2020-26419

Matching Score-8

Assigner-GitLab Inc.

Matching Score-8

Assigner-GitLab Inc.

CVSS Score-3.1||LOW

EPSS-0.43% / 62.66%

7 Day CHG~0.00%

Published-11 Dec, 2020 | 17:17

Updated-04 Aug, 2024 | 15:56

Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file.

Vendor-Wireshark Foundation Oracle Corporation Fedora Project

Product-wireshark fedora zfs_storage_appliance_kit Wireshark

CWE ID-CWE-401

Missing Release of Memory after Effective Lifetime

CVE-2020-1730

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.11% / 29.08%

7 Day CHG~0.00%

Published-13 Apr, 2020 | 00:00

Updated-04 Aug, 2024 | 06:46

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

Vendor-libssh Red Hat, Inc.NetApp, Inc.Canonical Ltd.Oracle Corporation Fedora Project

Product-ubuntu_linux cloud_backup fedora enterprise_linux libssh mysql_workbench libssh

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2020-14155

Matching Score-8

Assigner-MITRE Corporation

Vendor-pcre n/a GitLab Inc.Apple Inc.NetApp, Inc.Splunk LLC (Cisco Systems, Inc.)Oracle Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.23% / 45.81%

7 Day CHG~0.00%

Published-15 Jun, 2020 | 00:00

Updated-04 Aug, 2024 | 12:39

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2020-14562

Matching Score-8

Assigner-Oracle

Product-ubuntu_linux debian_linux e-series_santricity_unified_manager e-series_santricity_os_controller e-series_santricity_storage_manager fedora jdk e-series_santricity_web_services_proxy leap Java

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.59% / 69.50%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:40

Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-openSUSE Oracle Corporation NetApp, Inc.Canonical Ltd.Debian GNU/Linux Fedora Project

CVE-2023-5680

Matching Score-8

Assigner-Internet Systems Consortium (ISC)

Matching Score-8

Assigner-Internet Systems Consortium (ISC)

CVSS Score-5.3||MEDIUM

EPSS-0.10% / 28.17%

7 Day CHG~0.00%

Published-13 Feb, 2024 | 14:05

Updated-17 Mar, 2025 | 15:04

Cleaning an ECS-enabled cache may cause excessive CPU load

If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Vendor-NetApp, Inc.Internet Systems Consortium, Inc.

Product-bind active_iq_unified_manager BIND 9

CVE-2025-26516

Matching Score-8

Assigner-NetApp, Inc.

Matching Score-8

Assigner-NetApp, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.14% / 33.13%

7 Day CHG+0.01%

Published-19 Sep, 2025 | 18:51

Updated-23 Sep, 2025 | 14:31

CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node.

Vendor-NetApp, Inc.

Product-storagegrid StorageGRID

CWE ID-CWE-405

Asymmetric Resource Consumption (Amplification)

CVE-2019-2762

Matching Score-8

Assigner-Oracle

Product-enterprise_linux_server ubuntu_linux debian_linux epolicy_orchestrator xp7_command_view jre enterprise_linux_workstation enterprise_linux enterprise_linux_eus satellite jdk enterprise_linux_desktop leap Java

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.64% / 70.85%

7 Day CHG~0.00%

Published-23 Jul, 2019 | 22:31

Updated-15 Oct, 2024 | 18:59

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Canonical Ltd.Debian GNU/Linux openSUSE McAfee, LLC HP Inc.Oracle Corporation Red Hat, Inc.

CVE-2019-3027

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-1.74% / 82.80%

7 Day CHG-0.31%

Published-16 Oct, 2019 | 17:40

Updated-15 Oct, 2024 | 18:43

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login Help). Supported versions that are affected are 12.2.5-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Product-application_object_library Application Object Library

CVE-2019-2769

Matching Score-8

Assigner-Oracle

Product-enterprise_linux_server ubuntu_linux debian_linux xp7_command_view epolicy_orchestrator jre enterprise_linux_workstation enterprise_linux enterprise_linux_eus satellite jdk enterprise_linux_desktop leap Java

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.54% / 67.98%

7 Day CHG~0.00%

Published-23 Jul, 2019 | 22:31

Updated-15 Oct, 2024 | 18:58

Vendor-Canonical Ltd.Debian GNU/Linux openSUSE McAfee, LLC HP Inc.Oracle Corporation Red Hat, Inc.

CVE-2021-35578

Matching Score-8

Assigner-Oracle

Product-openjdk debian_linux graalvm snapmanager hci_management_node e-series_santricity_os_controller active_iq_unified_manager e-series_santricity_storage_manager fedora e-series_santricity_web_services oncommand_workflow_automation solidfire santricity_unified_manager oncommand_insight Java SE JDK and JRE graalvm_enterprise_edition java_se

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.14% / 34.37%

7 Day CHG~0.00%

Published-20 Oct, 2021 | 10:50

Updated-22 Aug, 2024 | 14:44

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Debian GNU/Linux NetApp, Inc.Oracle Corporation Fedora Project

CVE-2021-35561

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.18% / 38.84%

7 Day CHG~0.00%

Published-20 Oct, 2021 | 10:50

Updated-25 Sep, 2024 | 19:35

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Debian GNU/Linux NetApp, Inc.Oracle Corporation Fedora Project

CVE-2015-3195

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-5.3||MEDIUM

EPSS-3.48% / 87.77%

7 Day CHG~0.00%

Published-06 Dec, 2015 | 00:00

Updated-06 May, 2026 | 22:30

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

Vendor-n/a Canonical Ltd.Apple Inc.openSUSE Oracle Corporation SUSE OpenSSL Red Hat, Inc.Debian GNU/Linux Fedora Project

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-3214

Matching Score-8

Assigner-Oracle

Product-enterprise_linux_server ubuntu_linux debian_linux xp7_command_view enterprise_linux_server_eus jre enterprise_linux_server_aus enterprise_linux_workstation enterprise_linux_eus satellite jdk enterprise_linux_server_tus enterprise_linux_desktop jrockit Java

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.26% / 49.66%

7 Day CHG~0.00%

Published-17 Oct, 2018 | 01:00

Updated-02 Oct, 2024 | 19:35

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Sound). Supported versions that are affected are Java SE: 6u201, 7u191 and 8u182; Java SE Embedded: 8u181; JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Canonical Ltd.Debian GNU/Linux HP Inc.Oracle Corporation Red Hat, Inc.

CVE-2020-26418

Matching Score-8

Assigner-GitLab Inc.

Matching Score-8

Assigner-GitLab Inc.

CVSS Score-3.1||LOW

EPSS-0.72% / 72.69%

7 Day CHG+0.31%

Published-11 Dec, 2020 | 17:27

Updated-04 Aug, 2024 | 15:56

Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.

Vendor-Wireshark Foundation Oracle Corporation Debian GNU/Linux Fedora Project

Product-wireshark debian_linux zfs_storage_appliance_kit fedora Wireshark

CWE ID-CWE-401

Missing Release of Memory after Effective Lifetime

CVE-2022-21426

Matching Score-8

Assigner-Oracle

Product-solidfire_\&_hci_management_node active_iq_unified_manager jdk cloud_insights_acquisition_unit santricity_unified_manager debian_linux graalvm zulu jre e-series_santricity_os_controller 7-mode_transition_tool e-series_santricity_storage_manager e-series_santricity_web_services cloud_secure_agent solidfire\,_enterprise_sds_\&_hci_storage_node hci_compute_node_firmware oncommand_insight Java SE JDK and JRE

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.06% / 19.51%

7 Day CHG~0.00%

Published-19 Apr, 2022 | 20:37

Updated-24 Sep, 2024 | 20:12

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-azul Debian GNU/Linux NetApp, Inc.Oracle Corporation

CVE-2019-15165

Matching Score-8

Assigner-MITRE Corporation