ByteOS

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.11% / 29.44%

||

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-26 Feb, 2026 | 16:57

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-marketing Oracle Marketing

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2021-35587

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.27% / 99.94%

||

7 Day CHG~0.00%

Published-19 Jan, 2022 | 11:21

Updated-27 Oct, 2025 | 17:08

Known KEV||Action Due Date - 2022-12-19||Apply updates per vendor instructions.

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-access_manager Access Manager Fusion Middleware

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2024-21014

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.15% / 78.87%

||

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-17 Mar, 2025 | 16:15

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported versions that are affected are 19.1.0-19.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-hospitality_simphony Hospitality Simphony

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2026-46817

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.11% / 29.67%

||

7 Day CHG+0.06%

Published-28 May, 2026 | 20:17

Updated-04 Jun, 2026 | 13:45

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Oracle Payments

CWE ID-CWE-269

Improper Privilege Management

CWE ID-CWE-287

Improper Authentication

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2026-34275

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.12% / 31.21%

||

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-01 May, 2026 | 03:55

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-advanced_inbound_telephony Oracle Advanced Inbound Telephony

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-30727

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.94% / 76.67%

||

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-26 Feb, 2026 | 18:28

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in takeover of Oracle Scripting. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Oracle Scripting

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2026-21992

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.07% / 20.63%

||

7 Day CHG~0.00%

Published-20 Mar, 2026 | 02:24

Updated-24 Mar, 2026 | 03:55

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. Note: Oracle Web Services Manager is installed with an Oracle Fusion Middleware Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-web_services_manager identity_manager Oracle Web Services Manager Oracle Identity Manager

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-21535

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.00% / 77.43%

||

7 Day CHG~0.00%

Published-21 Jan, 2025 | 20:53

Updated-26 Feb, 2026 | 19:09

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server Oracle WebLogic Server

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-21524

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.18% / 79.14%

||

7 Day CHG~0.00%

Published-21 Jan, 2025 | 20:53

Updated-26 Feb, 2026 | 19:09

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-jd_edwards_enterpriseone_tools JD Edwards EnterpriseOne Tools

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2020-9480

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-88.27% / 99.51%

||

7 Day CHG~0.00%

Published-23 Jun, 2020 | 21:50

Updated-04 Aug, 2024 | 10:26

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Vendor-The Apache Software Foundation Oracle Corporation

Product-spark business_intelligence Apache Spark

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-62481

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.09% / 24.77%

||

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-26 Feb, 2026 | 16:57

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-marketing Oracle Marketing

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-61757

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-87.83% / 99.49%

||

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-26 Feb, 2026 | 16:57

Known KEV||Action Due Date - 2025-12-12||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-identity_manager Identity Manager Fusion Middleware

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2023-22069

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.50% / 66.41%

||

7 Day CHG~0.00%

Published-17 Oct, 2023 | 21:02

Updated-06 Mar, 2025 | 16:15

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2023-22072

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.66% / 71.62%

||

7 Day CHG~0.00%

Published-17 Oct, 2023 | 21:02

Updated-06 Mar, 2025 | 16:15

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-53037

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.13% / 32.58%

||

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:02

Updated-23 Oct, 2025 | 16:08

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-financial_services_analytical_applications_infrastructure Oracle Financial Services Analytical Applications Infrastructure

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2022-21587

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.40% / 99.98%

||

7 Day CHG~0.00%

Published-18 Oct, 2022 | 00:00

Updated-27 Oct, 2025 | 17:09

Known KEV||Action Due Date - 2023-02-23||Apply updates per vendor instructions.

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Web Applications Desktop Integrator E-Business Suite

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-61882

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-90.86% / 99.65%

||

7 Day CHG+1.37%

Published-05 Oct, 2025 | 03:17

Updated-26 Feb, 2026 | 17:48

Known KEV||Action Due Date - 2025-10-27||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-concurrent_processing Oracle Concurrent Processing E-Business Suite

CWE ID-CWE-287

Improper Authentication

CVE-2020-14644

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-93.64% / 99.85%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-12 Jan, 2026 | 21:03

Known KEV||Action Due Date - 2024-10-09||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server weblogic_server WebLogic Server

CVE-2020-14645

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-92.31% / 99.74%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:27

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-14855

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-5.09% / 90.02%

||

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:10

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-universal_work_queue Universal Work Queue

CVE-2016-3427

Matching Score-8

Assigner-Oracle

Vendor-n/a Oracle Corporation Debian GNU/Linux SUSE NetApp, Inc.Red Hat, Inc.openSUSE Canonical Ltd.The Apache Software Foundation

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-93.29% / 99.82%

||

7 Day CHG~0.00%

Published-21 Apr, 2016 | 10:00

Updated-22 Apr, 2026 | 13:41

Known KEV||Action Due Date - 2023-06-02||Apply updates per vendor instructions.

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CWE ID-CWE-284

Improper Access Control

CVE-2020-14882

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.45% / 99.99%

||

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-12 Jan, 2026 | 20:22

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server WebLogic Server

CVE-2020-14750

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.44% / 99.99%

||

7 Day CHG~0.00%

Published-01 Nov, 2020 | 23:50

Updated-12 Jan, 2026 | 20:23

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server WebLogic Server

CVE-2016-5118

Matching Score-8

Assigner-MITRE Corporation

Product-debian_linux ubuntu_linux linux_enterprise_desktop imagemagick graphicsmagick linux_enterprise_workstation_extension studio_onsite linux_enterprise_debuginfo leap solaris linux_enterprise_server linux linux_enterprise_software_development_kit opensuse n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-37.74% / 97.30%

||

7 Day CHG~0.00%

Published-10 Jun, 2016 | 15:00

Updated-06 May, 2026 | 22:30

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

Vendor-n/a Canonical Ltd.ImageMagick Studio LLC openSUSE Oracle Corporation SUSE Debian GNU/Linux GraphicsMagick

CVE-2020-14859

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-7.64% / 92.07%

||

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:09

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-14756

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-83.39% / 99.29%

||

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:49

Updated-26 Sep, 2024 | 18:46

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-utilities_framework coherence Utilities Framework

CVE-2020-14625

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-7.09% / 91.72%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:30

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2021-44790

Matching Score-8

Matching Score-8

Vendor-Fedora Project Tenable, Inc.Oracle Corporation The Apache Software Foundation Apple Inc.Debian GNU/Linux NetApp, Inc.

CVSS Score-9.8||CRITICAL

EPSS-86.23% / 99.42%

||

7 Day CHG~0.00%

Published-20 Dec, 2021 | 00:00

Updated-01 May, 2025 | 15:38

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Product-communications_session_route_manager debian_linux fedora communications_element_manager communications_session_report_manager http_server tenable.sc mac_os_x zfs_storage_appliance_kit communications_operations_monitor macos instantis_enterprisetrack cloud_backup Apache HTTP Server

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-14841

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-13.49% / 94.37%

||

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:12

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-14687

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.90% / 83.63%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-26 Sep, 2024 | 20:42

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2021-42392

Matching Score-8

Assigner-JFrog

Matching Score-8

Assigner-JFrog

CVSS Score-9.8||CRITICAL

EPSS-90.59% / 99.63%

||

7 Day CHG~0.00%

Published-07 Jan, 2022 | 00:00

Updated-04 Aug, 2024 | 03:30

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

Vendor-h2database h2database Oracle Corporation Debian GNU/Linux

Product-communications_cloud_native_core_policy debian_linux h2 h2

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2021-42575

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.72% / 72.91%

||

7 Day CHG~0.00%

Published-18 Oct, 2021 | 14:38

Updated-04 Aug, 2024 | 03:38

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Vendor-owasp n/a Oracle Corporation

Product-middleware_common_libraries_and_tools java_html_sanitizer primavera_unifier n/a

CVE-2020-14825

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-20.26% / 95.66%

||

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:16

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2021-42013

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-94.41% / 99.98%

||

7 Day CHG~0.00%

Published-07 Oct, 2021 | 15:50

Updated-27 Oct, 2025 | 17:36

Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Vendor-Fedora Project The Apache Software Foundation Oracle Corporation NetApp, Inc.

Product-http_server instantis_enterprisetrack secure_backup jd_edwards_enterpriseone_tools fedora cloud_backup Apache HTTP Server HTTP Server

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2021-41773

Matching Score-8

Matching Score-8

CVSS Score-7.5||HIGH

EPSS-94.39% / 99.97%

||

7 Day CHG~0.00%

Published-05 Oct, 2021 | 08:40

Updated-17 Feb, 2026 | 19:49

Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Vendor-Fedora Project The Apache Software Foundation Oracle Corporation NetApp, Inc.

Product-http_server cloud_backup fedora instantis_enterprisetrack Apache HTTP Server HTTP Server

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-14343

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-13.70% / 94.43%

||

7 Day CHG~0.00%

Published-09 Feb, 2021 | 00:00

Updated-04 Aug, 2024 | 12:39

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Vendor-pyyaml n/a Oracle Corporation

Product-communications_cloud_native_core_network_function_cloud_native_environment pyyaml PyYAML

CWE ID-CWE-20

Improper Input Validation

CVE-2021-39085

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.3||MEDIUM

EPSS-0.23% / 45.63%

||

7 Day CHG~0.00%

Published-16 Aug, 2022 | 18:45

Updated-17 Sep, 2024 | 00:42

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 215888.

Product-sterling_b2b_integrator solaris linux_kernel hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2021-39275

Matching Score-8

Matching Score-8

Vendor-Fedora Project Oracle Corporation The Apache Software Foundation Debian GNU/Linux NetApp, Inc.Siemens AG

CVSS Score-9.8||CRITICAL

EPSS-33.66% / 97.06%

||

7 Day CHG-4.01%

Published-16 Sep, 2021 | 14:40

Updated-01 May, 2025 | 15:39

ap_escape_quotes buffer overflow

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

Product-debian_linux fedora sinec_nms http_server cloud_backup sinema_server zfs_storage_appliance_kit instantis_enterprisetrack storagegrid clustered_data_ontap Apache HTTP Server

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-3773

Matching Score-8

Assigner-Red Hat, Inc.

Product-linux_kernel enterprise_linux communications_cloud_native_core_binding_support_function communications_cloud_native_core_network_exposure_function communications_cloud_native_core_policy fedora kernel

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.60% / 69.82%

||

7 Day CHG~0.00%

Published-16 Feb, 2022 | 18:35

Updated-28 Mar, 2025 | 15:15

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks.

Vendor-n/a Oracle Corporation Linux Kernel Organization, Inc Fedora Project Red Hat, Inc.

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2020-11973

Matching Score-8

Matching Score-8

Product-communications_diameter_signaling_router camel enterprise_manager_base_platform flexcube_private_banking Apache Camel

CVSS Score-9.8||CRITICAL

EPSS-14.10% / 94.52%

||

7 Day CHG~0.00%

Published-14 May, 2020 | 16:22

Updated-04 Aug, 2024 | 11:48

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11984

Matching Score-8

Matching Score-8

Vendor-n/a Canonical Ltd.The Apache Software Foundation NetApp, Inc.openSUSE Fedora Project Debian GNU/Linux Oracle Corporation

CVSS Score-9.8||CRITICAL

EPSS-76.29% / 98.95%

||

7 Day CHG~0.00%

Published-07 Aug, 2020 | 15:27

Updated-04 Aug, 2024 | 11:48

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

Product-http_server clustered_data_ontap ubuntu_linux debian_linux instantis_enterprisetrack fedora communications_session_route_manager zfs_storage_appliance_kit communications_session_report_manager hyperion_infrastructure_technology enterprise_manager_ops_center communications_element_manager leap Apache HTTP Server

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2020-11998

Matching Score-8

Matching Score-8

Product-communications_diameter_signaling_router enterprise_repository communications_session_route_manager activemq flexcube_private_banking communications_session_report_manager communications_element_manager Apache ActiveMQ

CVSS Score-9.8||CRITICAL

EPSS-6.91% / 91.60%

||

7 Day CHG~0.00%

Published-10 Sep, 2020 | 18:10

Updated-04 Aug, 2024 | 11:48

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

Vendor-n/a The Apache Software Foundation Oracle Corporation

CVE-2020-11972

Matching Score-8

Matching Score-8

Product-communications_diameter_signaling_router camel enterprise_manager_base_platform flexcube_private_banking Apache Camel

CVSS Score-9.8||CRITICAL

EPSS-6.92% / 91.61%

||

7 Day CHG~0.00%

Published-14 May, 2020 | 16:26

Updated-04 Aug, 2024 | 11:48

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11656

Matching Score-8

Assigner-MITRE Corporation

Product-sinec_infrastructure_network_services communications_messaging_server ontap_select_deploy_administration_utility sqlite communications_network_charging_and_control zfs_storage_appliance_kit outside_in_technology tenable.sc hyperion_infrastructure_technology mysql_workbench enterprise_manager_ops_center mysql n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-6.08% / 90.95%

||

7 Day CHG-0.16%

Published-09 Apr, 2020 | 02:49

Updated-04 Aug, 2024 | 11:35

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

Vendor-sqlite n/a NetApp, Inc.Oracle Corporation Tenable, Inc.Siemens AG

CWE ID-CWE-416

Use After Free

CVE-2016-1283

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.37% / 85.31%

||

7 Day CHG~0.00%

Published-03 Jan, 2016 | 00:00

Updated-06 May, 2026 | 22:30

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Vendor-pcre n/a The PHP Group Oracle Corporation Fedora Project

Product-solaris pcre php fedora n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2020-10108

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.32% / 85.16%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 12:42

Updated-25 Nov, 2024 | 18:12

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Vendor-twisted n/a Oracle Corporation Canonical Ltd.Fedora Project Debian GNU/Linux

Product-ubuntu_linux debian_linux solaris fedora zfs_storage_appliance_kit twisted n/a

CWE ID-CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVE-2021-2382

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-2.32% / 85.14%

||

7 Day CHG~0.00%

Published-20 Jul, 2021 | 22:43

Updated-26 Sep, 2024 | 14:01

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2020-10683

Matching Score-8

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router ubuntu_linux banking_platform endeca_information_discovery_integrator agile_plm health_sciences_empirica_signal snapcenter communications_application_session_controller insurance_policy_administration_j2ee retail_order_broker financial_services_analytical_applications_infrastructure retail_price_management dom4j communications_unified_inventory_management documaker application_testing_suite fusion_middleware retail_customer_management_and_segmentation_foundation business_process_management_suite leap insurance_rules_palette oncommand_api_services rapid_planning retail_integration_bus oncommand_workflow_automation enterprise_data_quality utilities_framework storagetek_tape_analytics_sw_tool primavera_p6_enterprise_project_portfolio_management health_sciences_information_manager snapmanager flexcube_core_banking jdeveloper retail_xstore_point_of_service snap_creator_framework enterprise_manager_base_platform webcenter_portal data_integrator n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-6.96% / 91.64%

||

7 Day CHG~0.00%

Published-01 May, 2020 | 18:55

Updated-04 Aug, 2024 | 11:06

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Vendor-dom4j_project n/a NetApp, Inc.Canonical Ltd.Oracle Corporation openSUSE

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2020-10188

Matching Score-8

Assigner-MITRE Corporation

Vendor-netkit_telnet_project n/a Debian GNU/Linux Oracle Corporation Fedora Project Arista Networks, Inc.Juniper Networks, Inc.

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-8.40% / 92.51%

||

7 Day CHG~0.00%

Published-06 Mar, 2020 | 14:07

Updated-21 Jan, 2026 | 02:15

utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.

Product-netkit_telnet communications_performance_intelligence_center fedora junos debian_linux eos n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2024-21181

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.87% / 83.50%

||

7 Day CHG~0.00%

Published-16 Jul, 2024 | 22:40

Updated-27 Mar, 2025 | 16:53

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).