Transportation Management

CVE-2026-60584 Jul 21, 22:17 HIGH This Week

Unauthorized data access and partial denial of service in Oracle Transportation Management 6.5.3 (CSV Management component) allow a low-privileged, network-authenticated attacker over HTTP to read all OTM-accessible data, perform limited unauthorized inserts/updates/deletes, and partially degrade availability. Rated CVSS 3.1 7.6 (High). No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.

CVE-2026-60583 Jul 21, 22:17 HIGH This Week

Full compromise of Oracle Transportation Management 6.5.3 (Supply Chain suite, Install component) is possible for a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability loss - Oracle describes the outcome as a 'takeover' of the product. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

CVE-2026-60434 Jul 21, 22:17 MEDIUM This Month

Unauthorized data exposure in Oracle Transportation Management 6.5.3 allows low-privileged remote attackers to read a subset of application data via HTTP, exploiting a flaw in the Authentication component. The vulnerability is tagged as an Authentication Bypass and is rated easily exploitable by Oracle, requiring only a low-privilege account and network access - no user interaction or complex conditions apply. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a constrained confidentiality-only impact.

CVE-2026-60433 Jul 21, 22:17 MEDIUM This Month

Critical data exposure and unauthorized modification in Oracle Transportation Management 6.5.3 allows a high-privileged network attacker to fully compromise the confidentiality and integrity of all data accessible within the platform. The vulnerability resides in the Integration component, accessible over HTTP, and enables complete read and write access to sensitive supply chain data including shipment records, carrier contracts, and operational logistics data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' tag alongside PR:H CVSS metrics suggests an authorization bypass rather than a full authentication bypass - warranting close review of privileged account hygiene.

CVE-2024-37171 Jul 09, 05:15 MEDIUM This Month

SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-39420 Oct 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Data, Functional Security). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-39411 Oct 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-39409 Oct 18, 21:15 LOW PATCH Monitor

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-21591 Oct 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-21480 Apr 19, 21:15 MEDIUM This Month

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: User Interface). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-35616 Oct 20, 11:17 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-2476 Oct 20, 11:16 MEDIUM This Month

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Authentication). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-14544 Jul 15, 18:15 MEDIUM This Month

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Data, Domain & Function Security). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-9484 May 20, 19:15 Maven HIGH POC PATCH THREAT GHSA Act Now

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;. Rated high severity (CVSS 7.0). This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-2744 Apr 15, 14:15 MEDIUM This Month

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Security). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-1938 Feb 24, 22:15 Maven CRITICAL POC KEV PATCH THREAT Act Now

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-1935 Feb 24, 22:15 Maven MEDIUM PATCH This Month

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2019-17563 Dec 23, 17:15 Maven HIGH PATCH This Week

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required.

CVE-2019-2709 Apr 23, 19:32 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-11358 Apr 20, 00:29 LIB MEDIUM POC PATCH THREAT This Month

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2019-2487 Jan 16, 19:30 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: UI Infrastructure). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2018-2823 Apr 19, 02:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Database). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2018-2662 Jan 18, 02:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2018-2631 Jan 18, 02:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-12617 Oct 04, 01:29 Maven HIGH POC KEV PATCH THREAT Act Now

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

CVE-2017-10032 Aug 08, 15:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Access Control List). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-3530 Apr 24, 19:59 MEDIUM PATCH This Month

Vulnerability in the Oracle Transportation Manager component of Oracle Supply Chain Products Suite (subcomponent: Security). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2016-8735 Apr 06, 21:59 Maven CRITICAL POC KEV PATCH THREAT Act Now

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

CVE-2016-3490 Jul 21, 10:12 LOW PATCH Monitor

Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, and 6.4.1 allows. Rated low severity (CVSS 3.0), this vulnerability is remotely exploitable.

CVE-2016-3470 Jul 21, 10:12 HIGH PATCH This Week

Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.4.1 allows remote authenticated users to affect confidentiality and integrity via. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2015-3195 Dec 06, 20:59 MEDIUM This Month

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.