Jdeveloper

Local privilege-based compromise in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 (Security Framework component of Oracle Fusion Middleware) allows a low-privileged attacker with an interactive logon to the host to fully take over the JDeveloper installation, impacting confidentiality, integrity, and availability. Fixed in the Oracle July 2026 Critical Patch Update, the flaw is rated CVSS 7.0 but is explicitly high-complexity (AC:H) and requires local access, so no public exploit identified at time of analysis and no active exploitation is confirmed. It is tagged as an Information Disclosure issue by Oracle, though the vector shows full C/I/A impact consistent with a complete component takeover.

Unauthorized critical-data access in Oracle JDeveloper (Fusion Middleware, Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read all JDeveloper-accessible data and modify some of it over HTTP, with a scope change that can significantly impact adjacent Oracle products. Oracle rates it CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but non-trivial given the unauthenticated network vector.

Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and 14.1.2.0.0 lets a network attacker read critical data without credentials. Remote unauthenticated attackers reaching the product over HTTP can obtain complete access to all JDeveloper-accessible data, with a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the flaw stems from a missing or broken authentication check.

Unauthorized data read in Oracle JDeveloper's Data Visualization Tools component exposes a subset of accessible application data to remote unauthenticated attackers via HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, with Oracle tagging this as an authentication bypass class issue. Despite the network-accessible attack vector with no privilege requirement, the high attack complexity (AC:H) and limited confidentiality impact (C:L) anchor this at CVSS 3.7 (Low). No public exploit code exists and it is not listed in the CISA KEV catalog.

Partial data disclosure in Oracle JDeveloper's ADF Faces component (versions 12.2.1.4.0 and 14.1.2.0.0) allows low-privileged network-authenticated attackers to read a subset of JDeveloper-accessible data via crafted HTTP requests. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms full authentication is required - the bypass is best understood as an authorization or access-control bypass within ADF Faces rather than full session bypass. No public exploit has been identified and no CISA KEV listing exists; the low CVSS score of 3.1 reflects high exploit complexity and limited impact scope.

Unauthorized read access to a subset of Oracle JDeveloper data is possible via an unauthenticated HTTP-based attack against the ADF Faces component in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and while exploitation requires high attack complexity, no authentication is needed. No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and the CVSS 3.1 score of 3.7 (Low) reflects the limited confidentiality impact and elevated exploitation difficulty.

Oracle JDeveloper's ADF Faces component on versions 12.2.1.4.0 and 14.1.2.0.0 is susceptible to an authentication bypass exploitable over HTTP by unauthenticated network attackers. Successful exploitation yields partial unauthorized read and write/insert/delete access to data accessible within the JDeveloper context - confidentiality and integrity are both impacted at a limited scope. No public exploit has been identified at time of analysis, and the CVSS AC:H rating indicates meaningful technical barriers to exploitation, reducing the practical threat level despite the unauthenticated attack vector.

Local authentication bypass in Oracle JDeveloper's ADF Faces component exposes critical data to low-privileged local users on versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change (S:C) indicates successful exploitation can extend beyond JDeveloper itself to impact additional Oracle Fusion Middleware products sharing the same infrastructure. No public exploit has been identified at time of analysis, and neither EPSS data nor a CISA KEV listing is available - however, the low attack complexity and no user interaction requirement make exploitation straightforward once local access is established.

Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.

Unauthenticated network exploitation of the ADF Faces component in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 enables complete confidentiality compromise of all data accessible within the IDE environment via HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team (secalert_us@oracle.com), the flaw allows a remote attacker with no credentials to circumvent access controls, though the CVSS AC:H rating constrains opportunistic exploitation by requiring attacker-controlled preconditions to be met. No public exploit or CISA KEV listing exists at time of analysis, and the impact is limited strictly to data exfiltration - no integrity or availability risk is present.

Full compromise of Oracle JDeveloper (Oracle Fusion Middleware) is possible via the ADF Shared Components subcomponent, allowing an authenticated high-privileged attacker with HTTP network access to take over the product with high confidentiality, integrity, and availability impact. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, is disclosed in Oracle's July 2026 Critical Patch Update, and carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 72.2% and no vendor patch available.

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM). Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity.

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.

Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: ADF Faces). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, and 12.2.1.0.0 allows remote attackers to affect. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.