ByteOS

Product

WebLogic Server

Versions

Affected

12.2.1.4.0
14.1.1.0.0

Problem Types

Type	CWE ID	Description
N/A	N/A	Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

Type: N/A

CWE ID: N/A

Description: Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

Metrics

Version	Base score	Base severity	Vector
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpujan2024.html	vendor-advisory

Hyperlink: https://www.oracle.com/security-alerts/cpujan2024.html

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpujan2024.html	vendor-advisory x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpujan2024.html

Resource:

vendor-advisory

x_transferred

2. CISA ADP Vulnrichment

Affected Products

Vendor

Product

weblogic_server

CPEs

cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

12.2.1.4.0
14.1.1.0.0

Problem Types

Type	CWE ID	Description
CWE	CWE-284	CWE-284 Improper Access Control

Type: CWE

CWE ID: CWE-284

Description: CWE-284 Improper Access Control

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:17 Feb, 2024 | 02:15

Updated At:28 Mar, 2025 | 23:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*

>>weblogic_server>>12.2.1.4.0

cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*

>>weblogic_server>>14.1.1.0.0

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-284	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-284

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://www.oracle.com/security-alerts/cpujan2024.html	secalert_us@oracle.com	Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2024.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpujan2024.html

Source: secalert_us@oracle.com

Resource:

Vendor Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpujan2024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

591Records found

CVE-2024-21076

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.58% / 68.31%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-01 Aug, 2024 | 22:13

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Offer LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-Trade Management

CWE ID-CWE-284

Improper Access Control

CVE-2024-21074

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.95% / 76.00%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-01 Aug, 2024 | 22:13

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Finance LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-Trade Management

CWE ID-CWE-284

Improper Access Control

CVE-2025-30707

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.43% / 62.05%

7 Day CHG+0.31%

Published-15 Apr, 2025 | 20:31

Updated-21 Apr, 2025 | 19:28

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-istore Oracle iStore

CWE ID-CWE-284

Improper Access Control

CVE-2025-30728

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.43% / 62.05%

7 Day CHG+0.31%

Published-15 Apr, 2025 | 20:31

Updated-21 Apr, 2025 | 19:56

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-configurator Oracle Configurator

CWE ID-CWE-284

Improper Access Control

CVE-2020-14639

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-5.24% / 89.74%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:28

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2018-21026

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.47% / 63.89%

7 Day CHG~0.00%

Published-12 Nov, 2019 | 17:42

Updated-05 Aug, 2024 | 12:19

A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information.

Vendor-n/a Oracle Corporation Linux Kernel Organization, Inc Hitachi, Ltd.Microsoft Corporation

Product-solaris linux_kernel compute_systems_manager windows tuning_manager replication_manager device_manager tiered_storage_manager n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-1999002

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-92.75% / 99.75%

7 Day CHG~0.00%

Published-23 Jul, 2018 | 19:00

Updated-05 Aug, 2024 | 12:47

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

Vendor-n/a Jenkins Oracle Corporation

Product-communications_cloud_native_core_automated_test_suite jenkins n/a

CVE-2026-21940

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.05% / 14.87%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 21:56

Updated-29 Jan, 2026 | 20:35

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-supply_chain_products_suite Oracle Agile PLM

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-2183

Matching Score-8

Assigner-Red Hat, Inc.

Vendor-n/a Node.js (OpenJS Foundation)Cisco Systems, Inc.Red Hat, Inc.OpenSSL Oracle Corporation Python Software Foundation

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-7.5||HIGH

EPSS-40.02% / 97.22%

7 Day CHG~0.00%

Published-01 Sep, 2016 | 00:00

Updated-12 Apr, 2025 | 10:46

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Product-enterprise_linux python jboss_enterprise_web_server jboss_enterprise_application_platform content_security_management_appliance jboss_web_server node.js openssl database n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-2965

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.31% / 79.46%

7 Day CHG~0.00%

Published-16 Oct, 2019 | 17:40

Updated-15 Oct, 2024 | 18:46

Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration). Supported versions that are affected are 19.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - DB Deployment and Configuration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Core - DB Deployment and Configuration accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-siebel_crm Siebel Core - DB Deployment and Configuration

CVE-2022-21476

Matching Score-8

Assigner-Oracle

Product-bootstrap_os openjdk active_iq_unified_manager cloud_insights_acquisition_unit jdk hci_compute_node element_software solidfire santricity_unified_manager debian_linux graalvm zulu hci_management_node e-series_santricity_os_controller e-series_santricity_storage_manager e-series_santricity_web_services cloud_secure_agent oncommand_insight Java SE JDK and JRE

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.18% / 40.06%

7 Day CHG~0.00%

Published-19 Apr, 2022 | 20:38

Updated-03 Aug, 2024 | 02:38

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Vendor-azul Debian GNU/Linux NetApp, Inc.Oracle Corporation

CVE-2015-2802

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.15% / 83.90%

7 Day CHG~0.00%

Published-04 Feb, 2020 | 20:09

Updated-06 Aug, 2024 | 05:24

An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, and Asset Manager Cloudsystem Chargeback 9.40, which could let a remote malicious user obtain sensitive information. This is the TLS vulnerability known as the RC4 cipher Bar Mitzvah vulnerability.

Vendor-n/a Microsoft Corporation HP Inc.Oracle Corporation Linux Kernel Organization, Inc

Product-solaris linux_kernel asset_manager windows sitescope asset_manager_cloudsystem_chargeback n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2021-29723

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.14% / 34.50%

7 Day CHG~0.00%

Published-30 Aug, 2021 | 17:00

Updated-16 Sep, 2024 | 20:57

IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-ForceID: 201100.

Product-sterling_external_authentication_server solaris linux_kernel sterling_secure_proxy hp-ux linux_on_ibm_z windows aix Sterling Secure Proxy

CWE ID-CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CVE-2021-29688

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.56% / 67.70%

7 Day CHG~0.00%

Published-20 May, 2021 | 15:10

Updated-17 Sep, 2024 | 00:51

IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 200102.

Vendor-Oracle Corporation IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-security_identity_manager solaris linux_kernel windows aix Security Identity Manager

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2016-5842

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.03% / 76.94%

7 Day CHG~0.00%

Published-13 Dec, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.

Vendor-n/a ImageMagick Studio LLC Oracle Corporation

Product-imagemagick solaris n/a

CWE ID-CWE-125

Out-of-bounds Read

CVE-2021-29825

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.30% / 52.81%

7 Day CHG~0.00%

Published-16 Sep, 2021 | 15:50

Updated-16 Sep, 2024 | 19:14

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470.

Vendor-opengroup Oracle Corporation IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-solaris linux_kernel db2 windows aix unix DB2 for Linux, UNIX and Windows

CVE-2021-29722

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.14% / 34.50%

7 Day CHG~0.00%

Published-30 Aug, 2021 | 17:00

Updated-16 Sep, 2024 | 16:32

Product-sterling_external_authentication_server solaris linux_kernel sterling_secure_proxy hp-ux linux_on_ibm_z windows aix Sterling Secure Proxy

CWE ID-CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CVE-2021-29691

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.07% / 20.15%

7 Day CHG~0.00%

Published-20 May, 2021 | 15:10

Updated-16 Sep, 2024 | 23:36

IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 200252.

Vendor-Oracle Corporation IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-security_identity_manager solaris linux_kernel windows aix Security Identity Manager

CWE ID-CWE-798

Use of Hard-coded Credentials

CVE-2025-61884

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-40.22% / 97.24%

7 Day CHG-1.56%

Published-12 Oct, 2025 | 02:34

Updated-27 Oct, 2025 | 17:08

Known KEV||Action Due Date - 2025-11-10||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-configurator Oracle Configurator E-Business Suite

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE ID-CWE-287

Improper Authentication

CWE ID-CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE ID-CWE-501

Trust Boundary Violation

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CWE ID-CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVE-2021-25122

Matching Score-8

Matching Score-8

Product-graph_server_and_client debian_linux communications_cloud_native_core_security_edge_protection_proxy mysql_enterprise_monitor instantis_enterprisetrack siebel_ui_framework tomcat database communications_instant_messaging_server agile_plm communications_cloud_native_core_policy managed_file_transfer Apache Tomcat

CVSS Score-7.5||HIGH

EPSS-2.77% / 85.73%

7 Day CHG~0.00%

Published-01 Mar, 2021 | 12:00

Updated-13 Feb, 2025 | 16:27

Apache Tomcat h2c request mix-up

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

Vendor-Debian GNU/Linux Oracle Corporation The Apache Software Foundation

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2024-38320

Matching Score-8

Assigner-IBM Corporation

Vendor-Oracle Corporation IBM Corporation HP Inc.Microsoft Corporation Linux Kernel Organization, Inc Apple Inc.

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.50%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 15:43

Updated-18 Aug, 2025 | 18:05

IBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosure

IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0.0 through 8.1.23.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

Product-storage_protect_for_virtual_environments linux_kernel windows storage_protect macos solaris hp-ux aix Storage Protect for Virtual Environments: Data Protection for VMware Storage Protect Backup-Archive Client

CWE ID-CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CVE-2021-2400

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-7.27% / 91.46%

7 Day CHG~0.00%

Published-20 Jul, 2021 | 22:44

Updated-26 Sep, 2024 | 13:57

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-bi_publisher BI Publisher (formerly XML Publisher)

CVE-2021-2350

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.23% / 84.18%

7 Day CHG~0.00%

Published-20 Jul, 2021 | 22:43

Updated-26 Sep, 2024 | 14:03

Vulnerability in the Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Console). Supported versions that are affected are 11.1.2.4 and 21.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Essbase Administration Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hyperion Essbase Administration Services accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-hyperion_essbase_administration_services Hyperion Essbase Administration Services

CVE-2021-2157

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-4.79% / 89.23%

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:34

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-weblogic_server TopLink

CVE-2025-53066

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.09% / 26.45%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-03 Nov, 2025 | 18:16

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-graalvm_for_jdk graalvm jdk jre Oracle GraalVM for JDK Oracle Java SE Oracle GraalVM Enterprise Edition

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2021-20354

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.46% / 63.47%

7 Day CHG~0.00%

Published-18 Feb, 2021 | 15:10

Updated-16 Sep, 2024 | 20:57

IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 194883.

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2003-0411

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-9.27% / 92.55%

7 Day CHG~0.00%

Published-11 Jun, 2003 | 04:00

Updated-03 Apr, 2025 | 01:03

Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension.

Vendor-n/a Oracle Corporation Microsoft Corporation

Product-sun_one_application_server windows_xp windows_2000 n/a

CWE ID-CWE-178

Improper Handling of Case Sensitivity

CVE-2020-4937

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.11% / 29.87%

7 Day CHG~0.00%

Published-20 Nov, 2020 | 13:50

Updated-17 Sep, 2024 | 04:08

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 191814.

Product-sterling_b2b_integrator solaris linux_kernel i hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CVE-2020-8231

Matching Score-8

Assigner-HackerOne

Product-sinec_infrastructure_network_services libcurl debian_linux universal_forwarder communications_cloud_native_core_policy https://github.com/curl/curl

Matching Score-8

Assigner-HackerOne

CVSS Score-7.5||HIGH

EPSS-0.22% / 44.56%

7 Day CHG~0.00%

Published-14 Dec, 2020 | 19:39

Updated-04 Aug, 2024 | 09:56

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

Vendor-n/a Debian GNU/Linux Oracle Corporation Splunk LLC (Cisco Systems, Inc.)CURL Siemens AG

CWE ID-CWE-416

Use After Free

CVE-2020-7067

Matching Score-8

Assigner-PHP Group

Matching Score-8

Assigner-PHP Group

CVSS Score-7.5||HIGH

EPSS-9.98% / 92.88%

7 Day CHG~0.00%

Published-27 Apr, 2020 | 20:38

Updated-17 Sep, 2024 | 02:21

OOB Read in urldecode()

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Vendor-Oracle Corporation Debian GNU/Linux Tenable, Inc.The PHP Group

Product-communications_diameter_signaling_router php debian_linux tenable.sc PHP

CWE ID-CWE-125

Out-of-bounds Read

CWE ID-CWE-196

Unsigned to Signed Conversion Error

CVE-2020-29505

Matching Score-8

Assigner-Dell

Product-bsafe_micro-edition-suite bsafe_crypto-c-micro-edition retail_customer_insights Dell BSAFE Crypto-C Micro Edition

Matching Score-8

Assigner-Dell

CVSS Score-7.1||HIGH

EPSS-0.48% / 64.70%

7 Day CHG~0.00%

Published-11 Jul, 2022 | 19:25

Updated-16 Sep, 2024 | 22:09

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability.

Vendor-Oracle Corporation Dell Inc.

CWE ID-CWE-331

Insufficient Entropy

CVE-2020-2828

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.37% / 84.65%

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-27 Sep, 2024 | 19:07

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Web Services). The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2020-24584

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-3.29% / 86.90%

7 Day CHG~0.00%

Published-01 Sep, 2020 | 12:36

Updated-04 Aug, 2024 | 15:19

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

Vendor-n/a Canonical Ltd.Django Oracle Corporation Fedora Project

Product-ubuntu_linux django zfs_storage_appliance_kit fedora n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2022-21466

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.73% / 82.09%

7 Day CHG~0.00%

Published-19 Apr, 2022 | 20:38

Updated-24 Sep, 2024 | 20:08

Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-commerce_guided_search Commerce Guided Search / Oracle Commerce Experience Manager

CVE-2022-21614

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.65% / 81.67%

7 Day CHG~0.00%

Published-18 Oct, 2022 | 00:00

Updated-24 Sep, 2024 | 15:56

Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Data Quality. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Data Quality accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-enterprise_data_quality Enterprise Data Quality

CVE-2022-21500

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-93.82% / 99.86%

7 Day CHG~0.00%

Published-19 May, 2022 | 23:55

Updated-24 Sep, 2024 | 20:05

Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. Note: Authentication is required for successful attack, however the user may be self-registered. <br> <br>Oracle E-Business Suite 12.1 is not impacted by this vulnerability. Customers should refer to the Patch Availability Document for details. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-user_management e-business_suite User Management

CVE-2022-21567

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.68% / 81.83%

7 Day CHG~0.00%

Published-19 Jul, 2022 | 21:08

Updated-24 Sep, 2024 | 19:51

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Workflow accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-workflow Workflow

CVE-2022-21421

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-4.29% / 88.61%

7 Day CHG~0.00%

Published-19 Apr, 2022 | 20:37

Updated-24 Sep, 2024 | 20:12

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-business_intelligence Business Intelligence Enterprise Edition

CVE-2022-21566

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.87% / 85.96%

7 Day CHG~0.00%

Published-19 Jul, 2022 | 21:08

Updated-24 Sep, 2024 | 19:52

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.9-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-applications_framework Applications Framework

CVE-2022-21292

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-4.67% / 89.08%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:23

Updated-24 Sep, 2024 | 20:26

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2022-21300

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.23% / 84.18%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:23

Updated-24 Sep, 2024 | 20:26

Vulnerability in the PeopleSoft Enterprise CS SA Integration Pack product of Oracle PeopleSoft (component: Snapshot Integration). Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS SA Integration Pack. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS SA Integration Pack accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-peoplesoft_enterprise_cs_sa_integration_pack PeopleSoft Enterprise CS SA Integration Pack

CVE-2020-14864

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-94.02% / 99.89%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-12 Jan, 2026 | 20:36

Known KEV||Action Due Date - 2022-07-18||Apply updates per vendor instructions.

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-business_intelligence Business Intelligence Enterprise Edition Intelligence Enterprise Edition

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2022-21371

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-94.16% / 99.91%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:26

Updated-24 Sep, 2024 | 20:18

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-14820

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-5.86% / 90.35%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:17

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2022-21346

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-3.86% / 87.94%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:25

Updated-24 Sep, 2024 | 20:20

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-bi_publisher BI Publisher (formerly XML Publisher)

CVE-2022-21266

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.23% / 84.18%

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:22

Updated-24 Sep, 2024 | 20:29

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Pipeline Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-communications_billing_and_revenue_management Communications Billing and Revenue Management

CVE-2020-11971

Matching Score-8

Matching Score-8

Product-communications_diameter_signaling_router communications_diameter_intelligence_hub camel flexcube_private_banking enterprise_manager_base_platform Apache Camel

CVSS Score-7.5||HIGH

EPSS-10.71% / 93.16%

7 Day CHG~0.00%

Published-14 May, 2020 | 16:18

Updated-04 Aug, 2024 | 11:48

Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CVE-2024-21078

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.51% / 65.81%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-25 Mar, 2025 | 18:21

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Campaign LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-marketing Marketing

CVE-2024-21079

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.27% / 50.44%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-27 Mar, 2025 | 14:33

Product-marketing Marketing

CVE-2024-21075

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.62% / 81.48%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-27 Mar, 2025 | 16:47

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim Line LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).