Oracle
Page 61 of 100 — Oracle CVEs from a corpus of 13325, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14556 | Medium | 4.8 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0… |
CVE-2020-14555 | Medium | 4.7 | 2020-07-15 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1… |
CVE-2020-14554 | Medium | 4.7 | 2020-07-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12… |
CVE-2020-14553 | Medium | 4.3 | 2020-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 5.7.30 and prior and 8… |
CVE-2020-14552 | Medium | 6.8 | 2020-07-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 11.1… |
CVE-2020-14551 | Medium | 4.3 | 2020-07-15 | Vulnerability in the Oracle AutoVue product of Oracle Supply Chain (component: Security). The supported version that is affected is 21.0. Easily exploitable vu… |
CVE-2020-14550 | Medium | 5.3 | 2020-07-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8… |
CVE-2020-14549 | Medium | 5.9 | 2020-07-15 | Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Server). Supported versions that are affecte… |
CVE-2020-14548 | Low | 3.4 | 2020-07-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions… |
CVE-2020-14547 | Medium | 4.9 | 2020-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.30 and prior and 8.0.20… |
CVE-2020-14546 | Medium | 4.2 | 2020-07-15 | Vulnerability in the Hyperion Financial Close Management product of Oracle Hyperion (component: Close Manager). The supported version that is affected is 11.1… |
CVE-2020-14545 | Medium | 5.0 | 2020-07-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Device Driver Utility). The supported version that is affected is 11. Difficult to ex… |
CVE-2020-14544 | Medium | 4.3 | 2020-07-15 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Data, Domain & Function Security). The supported version that… |
CVE-2020-14543 | High | 7.3 | 2020-07-15 | Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Installation). The supported versi… |
CVE-2020-14542 | Low | 3.3 | 2020-07-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: libsuri). The supported version that is affected is 11. Easily exploitable vulnerabil… |
CVE-2020-14541 | Low | 2.0 | 2020-07-15 | Vulnerability in the Hyperion Financial Close Management product of Oracle Hyperion (component: Close Manager). The supported version that is affected is 11.1… |
CVE-2020-14540 | Medium | 4.9 | 2020-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.30 and prior and 8.0.20 and pr… |
CVE-2020-14539 | Medium | 6.5 | 2020-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.48 and prior, 5.7.30 and… |
CVE-2020-14537 | Medium | 5.5 | 2020-07-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Packaging Scripts). The supported version that is affected is 11. Easily exploitable… |
CVE-2020-14536 | High | 7.4 | 2020-07-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Workbench). Supported versions t… |
CVE-2020-14535 | High | 7.4 | 2020-07-15 | Vulnerability in the Oracle Commerce Service Center product of Oracle Commerce (component: Commerce Service Center). Supported versions that are affected are 1… |
CVE-2020-14534 | High | 8.2 | 2020-07-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups). The supported version that is affected is 12.2.9. Ea… |
CVE-2020-14533 | Low | 3.5 | 2020-07-15 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11… |
CVE-2020-14532 | Medium | 4.7 | 2020-07-15 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11… |
CVE-2020-14531 | Medium | 5.9 | 2020-07-15 | Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: SWSE Server). Supported versions that are affected are 20.6 and prior. Diffic… |
CVE-2020-14530 | Medium | 5.9 | 2020-07-15 | Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: None). The supported version that is affected is 11.1.1.9.0. Diffi… |
CVE-2020-14529 | Medium | 5.4 | 2020-07-15 | Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Investor Module). Supported versions that are af… |
CVE-2020-14528 | Medium | 6.1 | 2020-07-15 | Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affecte… |
CVE-2020-14527 | Medium | 5.9 | 2020-07-15 | Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affecte… |
CVE-2020-8203 | High | 7.4 | 2020-07-15 | Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. |
CVE-2020-13935 | High | 7.5 | 2020-07-14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to… |
CVE-2020-13934 | High | 7.5 | 2020-07-14 | An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgra… |
CVE-2020-15719 | Medium | 4.2 | 2020-07-14 | libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN e… |
CVE-2019-20907 | High | 7.5 | 2020-07-13 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pa… |
CVE-2020-11994 | High | 7.5 | 2020-07-08 | Server-Side Template Injection and arbitrary file disclosure on Camel templating components |
CVE-2020-15389 | Medium | 6.5 | 2020-06-29 | jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated… |
CVE-2020-15358 | Medium | 5.5 | 2020-06-27 | In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive proper… |
CVE-2020-11996 | High | 7.5 | 2020-06-26 | A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usa… |
CVE-2019-20892 | Medium | 6.5 | 2020-06-25 | net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp pack… |
CVE-2020-15025 | Medium | 4.4 | 2020-06-24 | ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, becaus… |
CVE-2020-9480 | Critical | 9.8 | 2020-06-23 | In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret… |
CVE-2020-14422 | Medium | 5.9 | 2020-06-18 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to… |
CVE-2020-14195 | High | 8.1 | 2020-06-16 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRea… |
CVE-2020-4320 | Medium | 6.5 | 2020-06-16 | IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name… |
CVE-2020-4310 | High | 7.5 | 2020-06-16 | IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logi… |
CVE-2020-14147 | High | 7.7 | 2020-06-15 | An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis… |
CVE-2020-14155 | Medium | 5.3 | 2020-06-15 | libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. |
CVE-2020-14060 | High | 8.1 | 2020-06-14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JN… |
CVE-2020-14062 | High | 8.1 | 2020-06-14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.interna… |
CVE-2020-14061 | High | 8.1 | 2020-06-14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionF… |
CVE-2020-8172 | High | 7.4 | 2020-06-08 | TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. |
CVE-2020-13871 | High | 7.5 | 2020-06-06 | SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. |
CVE-2020-12723 | High | 7.5 | 2020-06-05 | regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. |
CVE-2020-10878 | High | 8.6 | 2020-06-05 | Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to mal… |
CVE-2020-10543 | High | 8.2 | 2020-06-05 | Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. |
CVE-2020-11080 | Low | 3.7 | 2020-06-03 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious cli… |
CVE-2020-3235 | High | 7.7 | 2020-06-03 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches cou… |
CVE-2020-13596 | Medium | 6.1 | 2020-06-03 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properl… |
CVE-2020-13254 | Medium | 5.9 | 2020-06-03 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed… |
CVE-2020-13632 | Medium | 5.5 | 2020-05-27 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. |
CVE-2020-13631 | Medium | 5.5 | 2020-05-27 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. |
CVE-2020-13630 | High | 7.0 | 2020-05-27 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. |
CVE-2020-13434 | Medium | 5.5 | 2020-05-24 | SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. |
CVE-2020-9484 | High | 7.0 | 2020-05-20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the con… |
CVE-2020-10726 | Medium | 6.0 | 2020-05-20 | A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_G… |
CVE-2020-10725 | High | 7.7 | 2020-05-20 | A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on t… |
CVE-2020-9410 | High | 7.3 | 2020-05-20 | The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Serv… |
CVE-2020-9409 | Critical | 9.8 | 2020-05-20 | The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Se… |
CVE-2020-7656 | Medium | 6.1 | 2020-05-19 | jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain… |
CVE-2020-10723 | Medium | 5.1 | 2020-05-19 | A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain cir… |
CVE-2020-10722 | Medium | 5.1 | 2020-05-19 | A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memo… |
CVE-2020-1941 | Medium | 6.1 | 2020-05-14 | In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue. |
CVE-2020-11973 | Critical | 9.8 | 2020-05-14 | Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgra… |
CVE-2020-11972 | Critical | 9.8 | 2020-05-14 | Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should up… |
CVE-2020-11971 | High | 7.5 | 2020-05-14 | Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0. |
CVE-2020-4365 | Medium | 4.3 | 2020-05-14 | IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker coul… |
CVE-2020-4299 | Medium | 4.3 | 2020-05-14 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user through a specially crafted HTTP request. IBM… |
CVE-2020-4259 | Medium | 6.5 | 2020-05-14 | IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add modules from the cook… |
CVE-2020-1945 | Medium | 6.3 | 2020-05-14 | Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and… |
CVE-2018-1285 | Critical | 9.8 | 2020-05-11 | Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in appli… |
CVE-2020-9315 | High | 7.5 | 2020-05-10 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console… |
CVE-2020-9314 | Medium | 4.8 | 2020-05-10 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter… |
CVE-2020-12771 | Medium | 5.5 | 2020-05-09 | An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails. |
CVE-2020-10693 | Medium | 5.3 | 2020-05-06 | A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if… |
CVE-2020-10683 | Critical | 9.8 | 2020-05-01 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular exte… |
CVE-2020-11022 | Medium | 6.9 | 2020-04-29 | In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (… |
CVE-2020-11023 | Medium | 6.9 | 2020-04-29 | In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it… |
CVE-2020-2575 | High | 7.5 | 2020-04-29 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-12243 | High | 7.5 | 2020-04-28 | In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). |
CVE-2020-7067 | High | 7.5 | 2020-04-27 | In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be ma… |
CVE-2020-9488 | Low | 3.7 | 2020-04-27 | Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-mid… |
CVE-2020-9489 | Medium | 5.5 | 2020-04-27 | A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or i… |
CVE-2020-1967 | High | 7.5 | 2020-04-21 | Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a res… |
CVE-2020-2964 | High | 7.1 | 2020-04-15 | Vulnerability in the Oracle Financial Services Data Foundation product of Oracle Financial Services Applications (component: User Interface). Supported version… |
CVE-2020-2963 | High | 7.2 | 2020-04-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0… |
CVE-2020-2961 | Critical | 9.8 | 2020-04-15 | Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (Oracle OHS)). Supported versions th… |
CVE-2020-2959 | High | 8.6 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-2958 | High | 7.5 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-2956 | High | 8.1 | 2020-04-15 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that are affected are 12… |
CVE-2020-2955 | Medium | 6.3 | 2020-04-15 | Vulnerability in the Oracle FLEXCUBE Core Banking product of Oracle Financial Services Applications (component: Transaction Processing). The supported version… |