Webcenter Portal
Monthly
Complete takeover of Oracle WebCenter Portal is possible by a remote, unauthenticated attacker sending crafted HTTP requests to the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product. The flaw yields full high-impact compromise of confidentiality, integrity, and availability (CVSS 9.8) with no user interaction or credentials required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' language from Oracle and the pre-auth network vector make it a high-priority patch.
Unauthenticated remote data exposure in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows network-based attackers to access critical or all portal-accessible data via HTTP with no privileges or user interaction required. Tagged as an Authentication Bypass in the Oracle CPUAUG2026 advisory, the vulnerability carries a changed scope, meaning successful exploitation can cascade to impact additional Oracle Fusion Middleware products integrated with the portal. No public exploit has been identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update for August 2026.
Full takeover of Oracle WebCenter Portal is achievable by an unauthenticated remote attacker via HTTP, affecting the Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware stack. The CVSS vector rates this 8.1 due to high attack complexity (AC:H), meaning exploitation requires specific but unspecified preconditions to be met - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Oracle CPU August 2026 advisory confirms the vulnerability is vendor-acknowledged.
Unauthenticated remote compromise of Oracle WebCenter Portal's Runtime Tools component exposes critical data through an authentication bypass vulnerability patched in Oracle's August 2026 Critical Patch Update. Affected versions 12.2.1.4.0 and 14.1.2.0.0 allow any network-accessible attacker to gain complete read access to all data handled by the portal - and, due to a confirmed scope change, potentially reach data in additional connected Oracle Fusion Middleware products. No public exploit or KEV listing is confirmed at time of analysis, but the absence of authentication requirements and low attack complexity make this a high-priority remediation target.
Cross-context data exposure in Oracle WebCenter Portal's Runtime Tools component allows a low-privileged, network-authenticated attacker to compromise confidentiality at high severity and integrity at limited scope, with a scope change that can impact additional Oracle Fusion Middleware products. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and Oracle classifies this as 'easily exploitable' despite the user-interaction requirement. No public exploit or CISA KEV listing has been identified at time of analysis, but the Oracle-tagged 'Authentication Bypass' descriptor suggests privilege escalation beyond the attacker's granted access level is central to the vulnerability's mechanism.
Unauthenticated remote exploitation of Oracle WebCenter Portal's Runtime Tools component (versions 12.2.1.4.0 and 14.1.2.0.0) enables a network-based authentication bypass over HTTP, contingent on a single human-interaction step by a target user. Successful exploitation yields complete confidentiality exposure of all data accessible to the portal instance and limited unauthorized write capability, with scope-change implications that can cascade into co-hosted Oracle Fusion Middleware products. Oracle confirmed the issue through its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized read and write access to critical data in Oracle WebCenter Portal's Runtime Tools component is achievable by a low-privileged, network-authenticated attacker over HTTP, contingent on victim user interaction. Successful exploitation triggers a scope change - extending compromise beyond WebCenter Portal to additional Oracle Fusion Middleware products - resulting in full confidentiality and integrity impact on critical portal data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Oracle WebCenter Portal's Runtime Tools component exposes a high-severity, network-exploitable authentication bypass affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged, remote-authenticated attacker who can induce a victim user to interact with a malicious HTTP request can bypass authorization controls to gain complete read access to all WebCenter Portal data and perform unauthorized creation, deletion, or modification of critical data - including scope-change impact to additional Oracle Fusion Middleware products. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Full takeover of Oracle WebCenter Portal is achievable by any low-privileged authenticated user over HTTP, affecting both currently supported release lines - 12.2.1.4.0 and 14.1.2.0.0 - in the Runtime Tools component. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation demands minimal prerequisites: a valid portal account and network reachability, with no interaction from other users required and no special configuration needed beyond a standard supported deployment. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle CPU patches are routinely reverse-engineered shortly after release, narrowing the safe patching window significantly for exposed instances.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker exploiting a flaw in the Runtime Tools component via HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0 within the Oracle Fusion Middleware product line. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, with a confirmed scope change indicating that connected Fusion Middleware components beyond the portal itself may also be impacted. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's August 2026 Critical Security Patch Update (CSPU) confirms the vulnerability and is the primary remediation vehicle.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Runtime Tools component that allows a low-privileged, network-accessible attacker to gain complete read access to all portal-accessible data and perform limited data manipulation and partial denial of service via HTTP. The vulnerability is rated CVSS 7.6 and disclosed as part of Oracle's Critical Patch Update for August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence metadata suggests potential elevation from low-privilege access that warrants close attention.
Oracle WebCenter Portal 14.1.2.0.0 exposes critical confidential data through an authentication bypass in its Runtime Tools component, reachable by any low-privileged user over HTTP. Oracle explicitly classifies this as 'easily exploitable' and assigns a scope-change designation (S:C), meaning successful exploitation can spill over into additional Oracle Fusion Middleware products integrated with the portal. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and broad network accessibility make this straightforward to trigger once the bypass mechanism is understood.
Authentication bypass in Oracle WebCenter Portal's Runtime Tools component allows unauthenticated remote attackers to compromise confidentiality and integrity of critical portal data across affected versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability carries a CVSS 3.1 score of 8.7 with scope change (S:C), meaning successful exploitation can cascade beyond WebCenter Portal to impact additional products within the Oracle Fusion Middleware stack. No public exploit code has been identified at time of analysis, and high attack complexity (AC:H) limits opportunistic exploitation, though the authentication bypass nature and scope change elevate priority for Oracle-heavy environments.
Oracle WebCenter Portal Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged, network-authenticated attackers to bypass authorization controls and achieve full read and write access to critical portal data via HTTP. The vulnerability is tagged as an Authentication Bypass, meaning an authenticated user with minimal privileges can escalate access beyond their intended authorization boundary. No public exploit has been identified at time of analysis, and it is not currently listed in the CISA KEV catalog, though the low attack complexity makes it a realistic threat in any environment where untrusted low-privileged accounts exist.
Oracle WebCenter Portal's Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable over HTTP by unauthenticated remote attackers, subject to victim user interaction, enabling unauthorized modification or deletion of portal data and a partial denial of service. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector confirms low-complexity network exploitation requiring no credentials, only that a victim user be induced to interact with attacker-controlled content. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's August 2026 Critical Patch Update.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege-escalating account/system takeover in Oracle WebCenter Portal (Fusion Middleware, Composer component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an authenticated low-privileged attacker reach full compromise over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can pivot beyond WebCenter Portal to impact additional products, and Oracle rates it CVSS 9.9. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and minimal privilege requirement make it a top-tier patch priority.
Full takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged, network-authenticated attacker targeting the Composer component over HTTP. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' with high impact across confidentiality, integrity, and availability and no user interaction required. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, low privilege requirement, and complete portal compromise warrants urgent patching priority for all affected deployments.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) affects versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with HTTP network access can take over the portal and, because of a scope change, significantly impact other products. Oracle rates this CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.
Full product takeover of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a remote, unauthenticated attacker over HTTP against the Runtime Tools component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) reflects that no credentials, user interaction, or special conditions are needed, and a successful attack fully compromises confidentiality, integrity, and availability. This is a July 2026 Oracle Critical Patch Update item with no public exploit identified at time of analysis and no CISA KEV listing.
Full takeover of Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) is achievable by a low-privileged attacker with network access over HTTP, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), successful exploitation can significantly impact additional products beyond WebCenter Portal itself, driving the CVSS 3.1 base score to 9.9. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege/authorization bypass in Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated network attacker read and modify all portal-accessible data over HTTP. The scope-changing flaw (CVSS 3.1 base 9.6) can significantly impact additional products beyond the portal itself and is tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed via the Oracle Critical Patch Update of July 2026.
Full account/system takeover in Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0, Runtime Tools component) allows an authenticated low-privileged attacker to compromise the product over HTTP and gain complete control. Oracle rates this 'easily exploitable' with CVSS 8.8 (C:H/I:H/A:H), meaning any user with minimal portal credentials can escalate to full compromise. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and Oracle's own 'easily exploitable' characterization make it a high-priority patch.
Privilege-escalating account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 (Runtime Tools component) lets a low-privileged, network-authenticated attacker fully compromise the portal over HTTP and, because of a scope change (S:C), pivot into other components of the Oracle Fusion Middleware stack. Oracle rates it CVSS 9.9 with full confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Account/instance takeover in Oracle WebCenter Portal (Fusion Middleware component: Runtime Tools) lets a low-privileged remote attacker fully compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can spill beyond the portal into other Fusion Middleware components, and Oracle rates full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.9). No public exploit has been identified at time of analysis, but the low attack complexity and 'easily exploitable' vendor wording make this a high-priority patch item.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Content integration). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
jsoup is a Java library for working with HTML. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Epss exploitation probability 41.1%.
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity.
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 60.7%.
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available.
Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: WebCenter Spaces Application). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: WebCenter Spaces Application). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Complete takeover of Oracle WebCenter Portal is possible by a remote, unauthenticated attacker sending crafted HTTP requests to the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product. The flaw yields full high-impact compromise of confidentiality, integrity, and availability (CVSS 9.8) with no user interaction or credentials required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' language from Oracle and the pre-auth network vector make it a high-priority patch.
Unauthenticated remote data exposure in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows network-based attackers to access critical or all portal-accessible data via HTTP with no privileges or user interaction required. Tagged as an Authentication Bypass in the Oracle CPUAUG2026 advisory, the vulnerability carries a changed scope, meaning successful exploitation can cascade to impact additional Oracle Fusion Middleware products integrated with the portal. No public exploit has been identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update for August 2026.
Full takeover of Oracle WebCenter Portal is achievable by an unauthenticated remote attacker via HTTP, affecting the Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware stack. The CVSS vector rates this 8.1 due to high attack complexity (AC:H), meaning exploitation requires specific but unspecified preconditions to be met - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Oracle CPU August 2026 advisory confirms the vulnerability is vendor-acknowledged.
Unauthenticated remote compromise of Oracle WebCenter Portal's Runtime Tools component exposes critical data through an authentication bypass vulnerability patched in Oracle's August 2026 Critical Patch Update. Affected versions 12.2.1.4.0 and 14.1.2.0.0 allow any network-accessible attacker to gain complete read access to all data handled by the portal - and, due to a confirmed scope change, potentially reach data in additional connected Oracle Fusion Middleware products. No public exploit or KEV listing is confirmed at time of analysis, but the absence of authentication requirements and low attack complexity make this a high-priority remediation target.
Cross-context data exposure in Oracle WebCenter Portal's Runtime Tools component allows a low-privileged, network-authenticated attacker to compromise confidentiality at high severity and integrity at limited scope, with a scope change that can impact additional Oracle Fusion Middleware products. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and Oracle classifies this as 'easily exploitable' despite the user-interaction requirement. No public exploit or CISA KEV listing has been identified at time of analysis, but the Oracle-tagged 'Authentication Bypass' descriptor suggests privilege escalation beyond the attacker's granted access level is central to the vulnerability's mechanism.
Unauthenticated remote exploitation of Oracle WebCenter Portal's Runtime Tools component (versions 12.2.1.4.0 and 14.1.2.0.0) enables a network-based authentication bypass over HTTP, contingent on a single human-interaction step by a target user. Successful exploitation yields complete confidentiality exposure of all data accessible to the portal instance and limited unauthorized write capability, with scope-change implications that can cascade into co-hosted Oracle Fusion Middleware products. Oracle confirmed the issue through its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized read and write access to critical data in Oracle WebCenter Portal's Runtime Tools component is achievable by a low-privileged, network-authenticated attacker over HTTP, contingent on victim user interaction. Successful exploitation triggers a scope change - extending compromise beyond WebCenter Portal to additional Oracle Fusion Middleware products - resulting in full confidentiality and integrity impact on critical portal data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Oracle WebCenter Portal's Runtime Tools component exposes a high-severity, network-exploitable authentication bypass affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged, remote-authenticated attacker who can induce a victim user to interact with a malicious HTTP request can bypass authorization controls to gain complete read access to all WebCenter Portal data and perform unauthorized creation, deletion, or modification of critical data - including scope-change impact to additional Oracle Fusion Middleware products. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Full takeover of Oracle WebCenter Portal is achievable by any low-privileged authenticated user over HTTP, affecting both currently supported release lines - 12.2.1.4.0 and 14.1.2.0.0 - in the Runtime Tools component. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation demands minimal prerequisites: a valid portal account and network reachability, with no interaction from other users required and no special configuration needed beyond a standard supported deployment. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle CPU patches are routinely reverse-engineered shortly after release, narrowing the safe patching window significantly for exposed instances.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker exploiting a flaw in the Runtime Tools component via HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0 within the Oracle Fusion Middleware product line. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, with a confirmed scope change indicating that connected Fusion Middleware components beyond the portal itself may also be impacted. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's August 2026 Critical Security Patch Update (CSPU) confirms the vulnerability and is the primary remediation vehicle.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Runtime Tools component that allows a low-privileged, network-accessible attacker to gain complete read access to all portal-accessible data and perform limited data manipulation and partial denial of service via HTTP. The vulnerability is rated CVSS 7.6 and disclosed as part of Oracle's Critical Patch Update for August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence metadata suggests potential elevation from low-privilege access that warrants close attention.
Oracle WebCenter Portal 14.1.2.0.0 exposes critical confidential data through an authentication bypass in its Runtime Tools component, reachable by any low-privileged user over HTTP. Oracle explicitly classifies this as 'easily exploitable' and assigns a scope-change designation (S:C), meaning successful exploitation can spill over into additional Oracle Fusion Middleware products integrated with the portal. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and broad network accessibility make this straightforward to trigger once the bypass mechanism is understood.
Authentication bypass in Oracle WebCenter Portal's Runtime Tools component allows unauthenticated remote attackers to compromise confidentiality and integrity of critical portal data across affected versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability carries a CVSS 3.1 score of 8.7 with scope change (S:C), meaning successful exploitation can cascade beyond WebCenter Portal to impact additional products within the Oracle Fusion Middleware stack. No public exploit code has been identified at time of analysis, and high attack complexity (AC:H) limits opportunistic exploitation, though the authentication bypass nature and scope change elevate priority for Oracle-heavy environments.
Oracle WebCenter Portal Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged, network-authenticated attackers to bypass authorization controls and achieve full read and write access to critical portal data via HTTP. The vulnerability is tagged as an Authentication Bypass, meaning an authenticated user with minimal privileges can escalate access beyond their intended authorization boundary. No public exploit has been identified at time of analysis, and it is not currently listed in the CISA KEV catalog, though the low attack complexity makes it a realistic threat in any environment where untrusted low-privileged accounts exist.
Oracle WebCenter Portal's Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable over HTTP by unauthenticated remote attackers, subject to victim user interaction, enabling unauthorized modification or deletion of portal data and a partial denial of service. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector confirms low-complexity network exploitation requiring no credentials, only that a victim user be induced to interact with attacker-controlled content. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's August 2026 Critical Patch Update.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege-escalating account/system takeover in Oracle WebCenter Portal (Fusion Middleware, Composer component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an authenticated low-privileged attacker reach full compromise over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can pivot beyond WebCenter Portal to impact additional products, and Oracle rates it CVSS 9.9. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and minimal privilege requirement make it a top-tier patch priority.
Full takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged, network-authenticated attacker targeting the Composer component over HTTP. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' with high impact across confidentiality, integrity, and availability and no user interaction required. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, low privilege requirement, and complete portal compromise warrants urgent patching priority for all affected deployments.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) affects versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with HTTP network access can take over the portal and, because of a scope change, significantly impact other products. Oracle rates this CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.
Full product takeover of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a remote, unauthenticated attacker over HTTP against the Runtime Tools component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) reflects that no credentials, user interaction, or special conditions are needed, and a successful attack fully compromises confidentiality, integrity, and availability. This is a July 2026 Oracle Critical Patch Update item with no public exploit identified at time of analysis and no CISA KEV listing.
Full takeover of Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) is achievable by a low-privileged attacker with network access over HTTP, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), successful exploitation can significantly impact additional products beyond WebCenter Portal itself, driving the CVSS 3.1 base score to 9.9. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege/authorization bypass in Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated network attacker read and modify all portal-accessible data over HTTP. The scope-changing flaw (CVSS 3.1 base 9.6) can significantly impact additional products beyond the portal itself and is tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed via the Oracle Critical Patch Update of July 2026.
Full account/system takeover in Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0, Runtime Tools component) allows an authenticated low-privileged attacker to compromise the product over HTTP and gain complete control. Oracle rates this 'easily exploitable' with CVSS 8.8 (C:H/I:H/A:H), meaning any user with minimal portal credentials can escalate to full compromise. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and Oracle's own 'easily exploitable' characterization make it a high-priority patch.
Privilege-escalating account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 (Runtime Tools component) lets a low-privileged, network-authenticated attacker fully compromise the portal over HTTP and, because of a scope change (S:C), pivot into other components of the Oracle Fusion Middleware stack. Oracle rates it CVSS 9.9 with full confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Account/instance takeover in Oracle WebCenter Portal (Fusion Middleware component: Runtime Tools) lets a low-privileged remote attacker fully compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can spill beyond the portal into other Fusion Middleware components, and Oracle rates full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.9). No public exploit has been identified at time of analysis, but the low attack complexity and 'easily exploitable' vendor wording make this a high-priority patch item.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Content integration). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available.
XStream is a simple library to serialize objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
jsoup is a Java library for working with HTML. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Epss exploitation probability 41.1%.
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity.
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 60.7%.
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available.
Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: WebCenter Spaces Application). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: WebCenter Spaces Application). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.