Oracle
Page 45 of 100 — Oracle CVEs from a corpus of 13325, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21414 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21413 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.28 and prior. Easily exploitab… |
CVE-2022-21412 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21411 | Medium | 5.4 | 2022-04-19 | Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and… |
CVE-2022-21410 | High | 7.2 | 2022-04-19 | Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. The supported version that is affected is 19c. Easily e… |
CVE-2022-21409 | Medium | 6.1 | 2022-04-19 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). The supported version that is affected is Prior to 9… |
CVE-2022-21405 | Medium | 5.5 | 2022-04-19 | Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Oracle Explorer). The supported version that is affected is 18.3. Easily exp… |
CVE-2022-21404 | High | 8.1 | 2022-04-19 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer). Supported versions that are affected are 1.4.10 and 2.0.0-RC1… |
CVE-2022-22968 | Medium | 5.3 | 2022-04-14 | In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensiti… |
CVE-2022-24839 | High | 7.5 | 2022-04-11 | org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` excepti… |
CVE-2022-24801 | High | 8.1 | 2022-04-04 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in… |
CVE-2022-22965 | Critical | 9.8 | 2022-04-01 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires t… |
CVE-2022-22963 | Critical | 9.8 | 2022-04-01 | In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a speciall… |
CVE-2022-1154 | High | 7.8 | 2022-03-30 | Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646. |
CVE-2022-0322 | Medium | 5.5 | 2022-03-25 | A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privileg… |
CVE-2021-4203 | Medium | 6.8 | 2022-03-25 | A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Lin… |
CVE-2021-4157 | High | 8.0 | 2022-03-25 | An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files wi… |
CVE-2021-4197 | High | 7.8 | 2022-03-23 | An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some les… |
CVE-2022-1011 | High | 7.8 | 2022-03-18 | A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized ac… |
CVE-2022-24729 | Medium | 6.5 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vu… |
CVE-2022-24728 | Medium | 5.4 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all… |
CVE-2022-23943 | Critical | 9.8 | 2022-03-14 | Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue… |
CVE-2022-22721 | Critical | 9.1 | 2022-03-14 | If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out o… |
CVE-2022-22720 | Critical | 9.8 | 2022-03-14 | Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Re… |
CVE-2022-22719 | High | 7.5 | 2022-03-14 | A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52… |
CVE-2022-0002 | Medium | 6.5 | 2022-03-11 | Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclos… |
CVE-2022-0001 | Medium | 6.5 | 2022-03-11 | Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable informati… |
CVE-2020-36518 | High | 7.5 | 2022-03-11 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. |
CVE-2021-38296 | High | 7.5 | 2022-03-10 | Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it u… |
CVE-2021-3737 | High | 7.5 | 2022-03-04 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to… |
CVE-2022-22946 | Medium | 5.5 | 2022-03-04 | In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be co… |
CVE-2021-3744 | Medium | 5.5 | 2022-03-04 | A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denia… |
CVE-2021-3743 | High | 7.1 | 2022-03-04 | An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to ga… |
CVE-2022-0839 | Critical | 9.8 | 2022-03-04 | Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0. |
CVE-2022-22947 | Critical | 10.0 | 2022-03-03 | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enab… |
CVE-2021-4002 | Medium | 4.4 | 2022-03-03 | A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligne… |
CVE-2022-21716 | High | 7.5 | 2022-03-03 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to acce… |
CVE-2021-3772 | Medium | 6.5 | 2022-03-02 | A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP… |
CVE-2022-23308 | High | 7.5 | 2022-02-26 | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. |
CVE-2022-24329 | Medium | 5.3 | 2022-02-25 | In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. |
CVE-2022-21824 | High | 8.2 | 2022-02-24 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while s… |
CVE-2021-44533 | Medium | 5.3 | 2022-02-24 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subj… |
CVE-2021-44532 | Medium | 5.3 | 2022-02-24 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certifica… |
CVE-2021-44531 | High | 7.4 | 2022-02-24 | Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-const… |
CVE-2022-25636 | High | 7.8 | 2022-02-24 | net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is relat… |
CVE-2022-24407 | High | 8.8 | 2022-02-24 | In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. |
CVE-2021-35689 | Critical | 9.8 | 2022-02-24 | A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potential vulnerability allows attackers to per… |
CVE-2021-4115 | Medium | 5.5 | 2022-02-21 | There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from thi… |
CVE-2022-25256 | Medium | 6.1 | 2022-02-19 | SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list… |
CVE-2021-20322 | High | 7.4 | 2022-02-18 | A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to q… |
CVE-2022-25315 | Critical | 9.8 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. |
CVE-2022-25314 | High | 7.5 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. |
CVE-2022-25313 | Medium | 6.5 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. |
CVE-2021-39034 | High | 7.5 | 2022-02-17 | IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964. |
CVE-2022-23632 | High | 7.4 | 2022-02-17 | Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configuration when the host… |
CVE-2021-3773 | Critical | 9.8 | 2022-02-16 | A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks. |
CVE-2021-3752 | High | 7.1 | 2022-02-16 | A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a ra… |
CVE-2021-3551 | High | 7.8 | 2022-02-16 | A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allow… |
CVE-2022-25236 | Critical | 9.8 | 2022-02-16 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. |
CVE-2022-25235 | Critical | 9.8 | 2022-02-16 | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain con… |
CVE-2022-0391 | High | 7.5 | 2022-02-09 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The is… |
CVE-2021-43859 | High | 7.5 | 2022-02-01 | XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU ti… |
CVE-2022-0286 | Medium | 5.5 | 2022-01-31 | A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service. |
CVE-2021-4160 | Medium | 5.9 | 2022-01-28 | There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Im… |
CVE-2021-4034 | High | 7.8 | 2022-01-28 | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users t… |
CVE-2022-23181 | High | 7.0 | 2022-01-27 | The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to… |
CVE-2022-23990 | High | 7.5 | 2022-01-26 | Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. |
CVE-2021-22570 | Medium | 6.5 | 2022-01-26 | Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name du… |
CVE-2022-23437 | Medium | 6.5 | 2022-01-24 | There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML… |
CVE-2022-23852 | Critical | 9.8 | 2022-01-24 | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. |
CVE-2022-23221 | Critical | 9.8 | 2022-01-19 | H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREAT… |
CVE-2022-22310 | Medium | 6.5 | 2022-01-19 | IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could exploit this weakness… |
CVE-2022-21403 | Medium | 6.6 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21402 | Medium | 4.8 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21401 | Medium | 6.6 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21400 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21399 | Medium | 6.6 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21398 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21397 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21396 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21395 | High | 7.2 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21394 | Medium | 6.5 | 2022-01-19 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.32. Easily… |
CVE-2022-21393 | Medium | 4.3 | 2022-01-19 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 19c and 21c. Easily exploitable… |
CVE-2022-21392 | High | 8.8 | 2022-01-19 | Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected… |
CVE-2022-21391 | Critical | 9.9 | 2022-01-19 | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor… |
CVE-2022-21390 | Critical | 10.0 | 2022-01-19 | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Webservices Manager). Suppo… |
CVE-2022-21389 | Critical | 10.0 | 2022-01-19 | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor… |
CVE-2022-21388 | Low | 3.3 | 2022-01-19 | Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications Applications (component: On Premise Install). Supported versi… |
CVE-2022-21387 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11… |
CVE-2022-21386 | Medium | 6.1 | 2022-01-19 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0… |
CVE-2022-21383 | Medium | 4.3 | 2022-01-19 | Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Log). Supported versions that are affected are 8… |
CVE-2022-21382 | High | 7.7 | 2022-01-19 | Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI). Supported versions that are affected are… |
CVE-2022-21381 | Medium | 6.4 | 2022-01-19 | Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI). Supported versions that are affected are… |
CVE-2022-21380 | Medium | 6.3 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21379 | Medium | 4.9 | 2022-01-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.27 and pr… |
CVE-2022-21378 | Medium | 5.5 | 2022-01-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exp… |
CVE-2022-21377 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web API). Supported versions that are affected a… |
CVE-2022-21376 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affecte… |
CVE-2022-21375 | Medium | 5.5 | 2022-01-19 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabili… |
CVE-2022-21374 | Medium | 4.9 | 2022-01-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.27 and prior. E… |