Enterprise Manager Base Platform

CVE-2026-70684 Aug 18, 21:17 HIGH This Week

Remote takeover of Oracle Enterprise Manager Base Platform is achievable by unauthenticated network attackers via HTTP targeting the Agent Next Gen component in versions 13.5 and 24.1. Despite the high attack complexity requirement (CVSS AC:H), successful exploitation yields complete compromise - high confidentiality, integrity, and availability impact, effectively full platform control. No public exploit or active exploitation has been identified at time of analysis, but the Oracle CPU August 2026 advisory documents this as a supported-version vulnerability requiring immediate attention.

CVE-2026-61300 Aug 18, 21:16 HIGH This Week

Full platform takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by a local attacker holding low-privileged OS credentials on the host where the Agent Next Gen component executes. Oracle's advisory explicitly characterizes this as 'easily exploitable,' with no user interaction and no elevated authentication beyond an initial local logon required. No public exploit has been identified at time of analysis, but the combination of low attack complexity, high-impact outcome across all three pillars, and Oracle's own severity language makes this a priority for any enterprise Oracle infrastructure team.

CVE-2026-61298 Aug 18, 21:16 MEDIUM This Month

Local privilege escalation with scope change in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 exposes critical data to a low-privileged local attacker. The Enterprise Manager Install component can be compromised by an authenticated local user under difficult but achievable conditions, with successful exploitation yielding complete confidentiality breach of all data accessible to the platform - including data from additional managed products due to scope change. No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.

CVE-2026-61286 Aug 18, 21:16 HIGH This Week

Unauthenticated remote exploitation of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 via HTTP allows an attacker to create, delete, or modify critical platform-managed data through the Event Management component, with secondary impacts on confidentiality and service availability. The Oracle-published CVSS 8.6 score reflects a low-complexity, no-privilege-required attack path, making this accessible to non-sophisticated threat actors with network access. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.

CVE-2026-61284 Aug 18, 21:16 HIGH This Week

Full platform takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by any low-privileged attacker with HTTP access to the Application Config Console component. The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms low attack complexity, no user interaction, and full confidentiality, integrity, and availability impact - directly corroborated by Oracle's own characterization of the outcome as complete platform compromise. No public exploit has been identified at time of analysis, but Oracle has released a fix via the August 2026 Critical Security Patch Update.

CVE-2024-21067 Apr 16, 22:15 HIGH This Week

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2024-20917 Feb 17, 02:15 HIGH This Week

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Log Management). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2022-21623 Oct 18, 21:15 HIGH PATCH This Week

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Config Console). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-29577 Apr 21, 23:15 Maven MEDIUM PATCH This Month

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-21469 Apr 19, 21:15 MEDIUM This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-23307 Jan 18, 16:15 Maven HIGH PATCH This Week

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2022-23305 Jan 18, 16:15 Maven CRITICAL PATCH GHSA Act Now

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

CVE-2022-23302 Jan 18, 16:15 Maven HIGH PATCH This Week

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-45105 Dec 18, 12:15 Maven MEDIUM PATCH This Month

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

CVE-2021-4104 Dec 14, 12:15 Maven HIGH Act Now

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 72.2% and no vendor patch available.

CVE-2021-2137 Oct 20, 11:16 HIGH This Week

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-36160 Sep 16, 15:15 HIGH PATCH This Week

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).4.30 to 2.4.48 (inclusive). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2021-34798 Sep 16, 15:15 HIGH PATCH This Week

Malformed requests may cause the server to dereference a NULL pointer.4.48 and earlier. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

CVE-2021-2351 Jul 21, 15:15 HIGH POC PATCH This Week

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

CVE-2021-3517 May 19, 14:15 Ruby HIGH PATCH This Week

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

CVE-2021-3518 May 18, 12:15 Ruby HIGH PATCH This Week

There's a flaw in libxml2 in versions before 2.9.11. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

CVE-2021-3537 May 14, 20:15 Ruby MEDIUM PATCH This Month

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

CVE-2021-2053 Apr 22, 22:15 MEDIUM POC PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-1971 Dec 08, 16:15 MEDIUM PATCH This Month

The X.509 GeneralName type is a generic type for representing different types of names. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

CVE-2020-24977 Sep 04, 00:15 MEDIUM POC PATCH This Month

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-2982 Jul 15, 18:15 HIGH PATCH This Week

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-11994 Jul 08, 16:15 Maven HIGH PATCH This Week

Server-Side Template Injection and arbitrary file disclosure on Camel templating components. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-12723 Jun 05, 15:15 HIGH PATCH This Week

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

CVE-2020-10878 Jun 05, 14:15 HIGH PATCH This Week

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-10543 Jun 05, 14:15 HIGH PATCH This Week

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-11973 May 14, 17:15 Maven CRITICAL PATCH Act Now

Apache Camel Netty enables Java deserialization by default. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-11972 May 14, 17:15 Maven CRITICAL PATCH Act Now

Apache Camel RabbitMQ enables Java deserialization by default. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-11971 May 14, 17:15 Maven HIGH PATCH This Week

Apache Camel's JMX is vulnerable to Rebind Flaw. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-10683 May 01, 19:15 Maven CRITICAL PATCH Act Now

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

CVE-2020-1967 Apr 21, 14:15 Cargo HIGH POC PATCH THREAT This Week

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-2961 Apr 15, 14:15 CRITICAL PATCH Act Now

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (Oracle OHS)). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-11620 Apr 07, 23:15 Maven HIGH PATCH This Week

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2020-11619 Apr 07, 23:15 Maven HIGH PATCH This Week

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-1954 Apr 01, 21:15 Maven MEDIUM PATCH This Month

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required.

CVE-2020-11113 Mar 31, 05:15 Maven HIGH PATCH Act Now

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 60.7%.

CVE-2020-11112 Mar 31, 05:15 Maven HIGH PATCH This Week

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-11111 Mar 31, 05:15 Maven HIGH PATCH This Week

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-10969 Mar 26, 13:15 Maven HIGH PATCH This Week

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-10968 Mar 26, 13:15 Maven HIGH PATCH This Week

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-10673 Mar 18, 22:15 Maven HIGH PATCH This Week

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-10672 Mar 18, 22:15 Maven HIGH PATCH This Week

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-9548 Mar 02, 04:15 Maven CRITICAL POC PATCH THREAT Act Now

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-9547 Mar 02, 04:15 Maven CRITICAL POC PATCH THREAT Act Now

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-9546 Mar 02, 04:15 Maven CRITICAL PATCH GHSA Act Now

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-7595 Jan 21, 23:15 Ruby HIGH PATCH This Week

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-5397 Jan 17, 19:15 Maven MEDIUM POC PATCH This Month

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-5398 Jan 17, 00:15 Maven HIGH PATCH This Week

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-2646 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Command Line Interface). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2645 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2644 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2643 Jan 15, 17:15 MEDIUM This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Job System). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-2642 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2639 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2636 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2635 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: System Monitoring). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2634 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Configuration Standard Framewk). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2633 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2632 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: System Monitoring). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2631 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2630 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2629 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2628 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2626 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Cloud Control Manager - OMS). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2625 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Job System). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2624 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2623 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metrics Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2622 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2621 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2620 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2619 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2618 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2617 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2616 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Repository). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2615 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2613 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Global EM Framework). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2612 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2611 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2610 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2609 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-2608 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Repository). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2019-10219 Nov 08, 15:15 Maven MEDIUM POC PATCH This Month

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-12419 Nov 06, 21:15 Maven CRITICAL PATCH Act Now

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

CVE-2019-12415 Oct 23, 20:15 Maven MEDIUM PATCH This Month

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2019-2897 Oct 16, 18:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2019-17195 Oct 15, 14:15 Maven CRITICAL PATCH Act Now

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.