Identity Manager Connector
Monthly
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is achievable by a high-privileged, remote attacker exploiting the Microsoft Active Directory component via LDAP, with confirmed scope change impacting additional Oracle Fusion Middleware products. The vendor-assessed outcome is complete loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of serious but not actively weaponized vulnerabilities pending patch application.
High-severity data compromise in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a network-authenticated, high-privileged attacker to fully read and modify critical identity connector data, with confirmed scope change enabling impact on additional downstream products. The vulnerability is tagged 'Authentication Bypass', suggesting the flaw undermines access control enforcement within the Connector Server component despite requiring elevated initial credentials, resulting in a CVSS 3.1 base score of 8.7. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Local privilege escalation in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker with local logon access to the hosting infrastructure to achieve full takeover of the connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects straightforward exploitation once local access is obtained - no elevated privileges, no user interaction, and no complex attack conditions are required. No public exploit code or active exploitation has been identified at time of analysis; this is disclosed as part of Oracle's August 2026 Critical Patch Update. Note: The intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H impact profile and the 'takeover' language in the description - the actual scope of impact is broader than disclosure alone and should not be understated.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) is possible in supported versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the connector over HTTP can compromise it end to end. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. At the time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the low attack complexity and lack of any authentication make it a high-priority patching target.
Privileged tampering and data disclosure in the Oracle Identity Manager Connector (PeopleSoft Applications component) of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 lets a high-privileged, network-based attacker read, create, delete, or modify all connector-accessible data, with a scope change that can significantly impact additional products beyond the connector itself. The CVSS 3.1 base score is 7.7 (C:H/I:H/A:N), but exploitation is rated high-complexity and requires existing high privileges, so this is not a drive-by flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in the Oracle Identity Manager Connector (Generic Unix Connector component) of Oracle Fusion Middleware allows an unauthenticated attacker positioned on the adjacent physical communication segment to modify, create or delete connector-accessible data and to cause a complete, repeatable denial of service. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, and because of a scope change the attack may significantly impact additional integrated products beyond the connector itself. There is no public exploit identified at time of analysis; the flaw is rated CVSS 3.1 8.0 despite high attack complexity.
Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with HTTP network access fully compromise the connector, with a scope change that lets the attack significantly impact other products. Oracle rates it CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical based on the vendor's July 2026 Critical Patch Update disclosure.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware) allows a low-privileged remote attacker with SSH network access to compromise the Generic Unix Connector and pivot into additional Fusion Middleware components via a CVSS scope change. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, with Oracle rating the issue 9.9 due to high confidentiality, integrity, and availability impact across product boundaries. No public exploit identified at time of analysis, but the AV:N/AC:L profile and SSH-reachable attack surface make this a high-priority Oracle CPU item.
Takeover of Oracle Identity Manager Connector (Fusion Middleware) is achievable by a low-privileged remote attacker over HTTP, with a scope-changing impact that extends compromise to additional Oracle products. Oracle rates this 9.9 CVSS 3.1 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, with the fix delivered in Oracle's June 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) is achievable by a low-privileged remote attacker via HTTP against the Generic Unix Connector component, with scope-changed impact reaching additional Oracle Fusion Middleware products. Oracle rates this CVSS 9.9 due to high confidentiality, integrity, and availability impact combined with low attack complexity and minimal privileges. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover in Oracle Identity Manager Connector (Fusion Middleware, Mainframe Connectors component) versions 12.2.1.4.0 and 14.1.2.1.0 allows an authenticated low-privileged attacker to fully compromise the connector over HTTP and pivot to other products via a CVSS scope change. The flaw carries a 9.9 CVSS 3.1 score with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, and CISA KEV does not list it.
VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory). Rated high severity (CVSS 8.2), this vulnerability is no authentication required, low attack complexity.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is achievable by a high-privileged, remote attacker exploiting the Microsoft Active Directory component via LDAP, with confirmed scope change impacting additional Oracle Fusion Middleware products. The vendor-assessed outcome is complete loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of serious but not actively weaponized vulnerabilities pending patch application.
High-severity data compromise in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a network-authenticated, high-privileged attacker to fully read and modify critical identity connector data, with confirmed scope change enabling impact on additional downstream products. The vulnerability is tagged 'Authentication Bypass', suggesting the flaw undermines access control enforcement within the Connector Server component despite requiring elevated initial credentials, resulting in a CVSS 3.1 base score of 8.7. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Local privilege escalation in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker with local logon access to the hosting infrastructure to achieve full takeover of the connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects straightforward exploitation once local access is obtained - no elevated privileges, no user interaction, and no complex attack conditions are required. No public exploit code or active exploitation has been identified at time of analysis; this is disclosed as part of Oracle's August 2026 Critical Patch Update. Note: The intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H impact profile and the 'takeover' language in the description - the actual scope of impact is broader than disclosure alone and should not be understated.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) is possible in supported versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the connector over HTTP can compromise it end to end. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. At the time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the low attack complexity and lack of any authentication make it a high-priority patching target.
Privileged tampering and data disclosure in the Oracle Identity Manager Connector (PeopleSoft Applications component) of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 lets a high-privileged, network-based attacker read, create, delete, or modify all connector-accessible data, with a scope change that can significantly impact additional products beyond the connector itself. The CVSS 3.1 base score is 7.7 (C:H/I:H/A:N), but exploitation is rated high-complexity and requires existing high privileges, so this is not a drive-by flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in the Oracle Identity Manager Connector (Generic Unix Connector component) of Oracle Fusion Middleware allows an unauthenticated attacker positioned on the adjacent physical communication segment to modify, create or delete connector-accessible data and to cause a complete, repeatable denial of service. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, and because of a scope change the attack may significantly impact additional integrated products beyond the connector itself. There is no public exploit identified at time of analysis; the flaw is rated CVSS 3.1 8.0 despite high attack complexity.
Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with HTTP network access fully compromise the connector, with a scope change that lets the attack significantly impact other products. Oracle rates it CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical based on the vendor's July 2026 Critical Patch Update disclosure.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware) allows a low-privileged remote attacker with SSH network access to compromise the Generic Unix Connector and pivot into additional Fusion Middleware components via a CVSS scope change. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, with Oracle rating the issue 9.9 due to high confidentiality, integrity, and availability impact across product boundaries. No public exploit identified at time of analysis, but the AV:N/AC:L profile and SSH-reachable attack surface make this a high-priority Oracle CPU item.
Takeover of Oracle Identity Manager Connector (Fusion Middleware) is achievable by a low-privileged remote attacker over HTTP, with a scope-changing impact that extends compromise to additional Oracle products. Oracle rates this 9.9 CVSS 3.1 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, with the fix delivered in Oracle's June 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) is achievable by a low-privileged remote attacker via HTTP against the Generic Unix Connector component, with scope-changed impact reaching additional Oracle Fusion Middleware products. Oracle rates this CVSS 9.9 due to high confidentiality, integrity, and availability impact combined with low attack complexity and minimal privileges. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover in Oracle Identity Manager Connector (Fusion Middleware, Mainframe Connectors component) versions 12.2.1.4.0 and 14.1.2.1.0 allows an authenticated low-privileged attacker to fully compromise the connector over HTTP and pivot to other products via a CVSS scope change. The flaw carries a 9.9 CVSS 3.1 score with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, and CISA KEV does not list it.
VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory). Rated high severity (CVSS 8.2), this vulnerability is no authentication required, low attack complexity.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.