Oracle
Page 49 of 100 — Oracle CVEs from a corpus of 13325, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35551 | Medium | 5.5 | 2021-10-20 | Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 19c and 21c. Easily exploitable vul… |
CVE-2021-35550 | Medium | 5.9 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE… |
CVE-2021-35549 | Low | 3.9 | 2021-10-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Easily exploitable vulnerabil… |
CVE-2021-35546 | Medium | 4.9 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.26 and prior. Easily e… |
CVE-2021-35545 | Medium | 6.7 | 2021-10-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily… |
CVE-2021-35543 | High | 8.1 | 2021-10-20 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Activity Guide Composer). The supported versi… |
CVE-2021-35542 | Medium | 4.4 | 2021-10-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily… |
CVE-2021-35541 | Medium | 5.4 | 2021-10-20 | Vulnerability in the PeopleSoft Enterprise SCM product of Oracle PeopleSoft (component: Supplier Portal). The supported version that is affected is 9.2. Easily… |
CVE-2021-35540 | Medium | 5.5 | 2021-10-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily… |
CVE-2021-35539 | Medium | 6.5 | 2021-10-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulnera… |
CVE-2021-35538 | High | 7.8 | 2021-10-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily… |
CVE-2021-35537 | Medium | 4.9 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.25 and prior. Easily exploitab… |
CVE-2021-35536 | High | 8.1 | 2021-10-20 | Vulnerability in the Oracle Deal Management product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected are 12.1.1-12.1… |
CVE-2021-2485 | High | 8.1 | 2021-10-20 | Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Quotes). Supported versions that are affected are 12.1.1-12.1.3. Ea… |
CVE-2021-2484 | High | 8.1 | 2021-10-20 | Vulnerability in the Oracle Operations Intelligence product of Oracle E-Business Suite (component: BIS Operations Intelligence). Supported versions that are af… |
CVE-2021-2483 | High | 8.1 | 2021-10-20 | Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Content Item Manager). Supported versions that are affected are 12.1… |
CVE-2021-2482 | High | 8.1 | 2021-10-20 | Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Invoice Approvals). Supported versions that are affected are 12.1.1-12.1.3… |
CVE-2021-2481 | Medium | 6.5 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.26 and prior. Easily exp… |
CVE-2021-2480 | Low | 3.7 | 2021-10-20 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 11.1.1.9.0. Di… |
CVE-2021-2479 | Medium | 4.9 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.26 and prior. Easily exploitab… |
CVE-2021-2478 | Medium | 4.9 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.26 and prior. Easily exploitab… |
CVE-2021-2477 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). Supported versions that are affected are… |
CVE-2021-2476 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Authentication). The supported version that is affected is 6.4… |
CVE-2021-2475 | Medium | 4.4 | 2021-10-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily… |
CVE-2021-2474 | High | 8.1 | 2021-10-20 | Vulnerability in the Oracle Web Analytics product of Oracle E-Business Suite (component: Admin). Supported versions that are affected are 12.1.1-12.1.3. Easily… |
CVE-2021-2471 | Medium | 5.9 | 2021-10-20 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to… |
CVE-2021-2461 | High | 8.3 | 2021-10-20 | Vulnerability in the Oracle Communications Interactive Session Recorder product of Oracle Communications (component: Provision API). The supported version that… |
CVE-2021-2416 | Medium | 4.9 | 2021-10-20 | Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported versions that are affecte… |
CVE-2021-2414 | Medium | 6.8 | 2021-10-20 | Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported versions that are affecte… |
CVE-2021-2332 | Medium | 6.7 | 2021-10-20 | Vulnerability in the Oracle LogMiner component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitab… |
CVE-2021-2137 | High | 8.8 | 2021-10-20 | Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected… |
CVE-2021-42739 | Medium | 6.7 | 2021-10-20 | The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/fir… |
CVE-2021-37137 | High | 7.5 | 2021-10-19 | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable… |
CVE-2021-37136 | High | 7.5 | 2021-10-19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during… |
CVE-2021-42575 | Critical | 9.8 | 2021-10-18 | The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements. |
CVE-2021-42340 | High | 7.5 | 2021-10-14 | The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. Th… |
CVE-2021-42013 | Critical | 9.8 | 2021-10-07 | It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files… |
CVE-2021-20264 | High | 7.8 | 2021-10-06 | An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the c… |
CVE-2021-41773 | Critical | 9.8 | 2021-10-05 | A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outsid… |
CVE-2021-41524 | High | 7.5 | 2021-10-05 | While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. Th… |
CVE-2021-41099 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and… |
CVE-2021-32762 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer over… |
CVE-2021-32687 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap… |
CVE-2021-32675 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory acco… |
CVE-2021-32672 | Medium | 5.3 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger… |
CVE-2021-32628 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be e… |
CVE-2021-32627 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap a… |
CVE-2021-32626 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-bas… |
CVE-2021-21705 | Medium | 4.3 | 2021-10-04 | In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VAL… |
CVE-2021-22947 | Medium | 5.9 | 2021-09-29 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and sen… |
CVE-2021-22946 | High | 7.5 | 2021-09-29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command l… |
CVE-2021-41617 | High | 7.0 | 2021-09-26 | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not i… |
CVE-2021-2464 | High | 7.8 | 2021-09-24 | Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily exploitable vulnerability allows low privileged… |
CVE-2021-22945 | Critical | 9.1 | 2021-09-23 | When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and bo… |
CVE-2021-38153 | Medium | 5.9 | 2021-09-22 | Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such… |
CVE-2021-40690 | High | 7.5 | 2021-09-19 | All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passe… |
CVE-2021-41303 | Critical | 9.8 | 2021-09-17 | Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update t… |
CVE-2021-3807 | High | 7.5 | 2021-09-17 | ansi-regex is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-29825 | High | 7.5 | 2021-09-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID… |
CVE-2021-29763 | Medium | 5.1 | 2021-09-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a proc… |
CVE-2021-40438 | Critical | 9.0 | 2021-09-16 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4… |
CVE-2021-39275 | Critical | 9.8 | 2021-09-16 | ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party… |
CVE-2021-36160 | High | 7.5 | 2021-09-16 | A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versio… |
CVE-2021-34798 | High | 7.5 | 2021-09-16 | Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. |
CVE-2021-23440 | High | 7.3 | 2021-09-12 | This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided… |
CVE-2021-3634 | Medium | 6.5 | 2021-08-31 | A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them… |
CVE-2021-39135 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guar… |
CVE-2021-39134 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to gu… |
CVE-2021-37713 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabil… |
CVE-2021-37712 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabil… |
CVE-2021-37701 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabili… |
CVE-2021-3749 | High | 7.5 | 2021-08-31 | axios is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-29728 | Medium | 4.9 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2021-29723 | High | 7.5 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-29722 | High | 7.5 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-3712 | High | 7.4 | 2021-08-24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buf… |
CVE-2021-3711 | Critical | 9.8 | 2021-08-24 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function… |
CVE-2021-36690 | High | 7.5 | 2021-08-24 | A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. N… |
CVE-2021-39152 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data fro… |
CVE-2021-39150 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data fro… |
CVE-2021-39140 | Medium | 6.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CP… |
CVE-2021-39154 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39153 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39151 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39149 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39148 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39147 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39146 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39145 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39144 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient righ… |
CVE-2021-39141 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39139 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-35940 | High | 7.1 | 2021-08-23 | An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue wa… |
CVE-2021-37750 | Medium | 6.5 | 2021-08-23 | The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a… |
CVE-2021-37714 | High | 7.5 | 2021-08-18 | jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If t… |
CVE-2021-21781 | Low | 3.3 | 2021-08-18 | An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to sti… |
CVE-2021-32827 | Medium | 6.1 | 2021-08-16 | MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visi… |
CVE-2021-22940 | High | 7.5 | 2021-08-16 | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to chang… |
CVE-2021-22939 | Medium | 5.3 | 2021-08-16 | If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to se… |
CVE-2021-22931 | Critical | 9.8 | 2021-08-16 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names retu… |