Webcenter Sites

Full system takeover of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker with network access over HTTP. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no user interaction required, classifying this as an easily exploitable, high-severity vulnerability within Oracle's Fusion Middleware portfolio. No public exploit has been identified at time of analysis, but Oracle's explicit use of 'takeover' language in the advisory indicates the potential for complete system compromise.

Authentication bypass in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) enables unauthenticated remote attackers to gain unauthorized read access to critical application data and perform limited write operations via HTTP. Rated CVSS 8.2, this flaw requires no credentials, no user interaction, and no special network position, making it exploitable against any internet-exposed WebCenter Sites deployment. No public exploit code has been identified at time of analysis; the vulnerability was disclosed through Oracle's August 2026 Critical Patch Update.

Unauthenticated network exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows remote attackers to compromise confidentiality, integrity, and availability via HTTP without requiring any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable,' and the Authentication Bypass tag corroborates the PR:N CVSS metric, indicating the flaw circumvents access controls entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite nature make this a high-priority patching target for any organization running the affected Fusion Middleware component.

Full system takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is achievable by any low-privileged attacker with network access over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially lowering the skill threshold for attackers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity, full-impact CVSS vector, and broad coverage across both active release branches warrant urgent remediation across Oracle Fusion Middleware deployments.

Full compromise of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by any low-privileged authenticated user with HTTP network access, requiring neither elevated rights nor user interaction. Oracle's own disclosure language characterizes this as 'easily exploitable,' and the resulting impact is described as complete system takeover - implying full loss of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack barrier and critical business function of enterprise WCM platforms make this an immediate patching priority.

Unauthenticated remote access in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 exposes the full confidential data set accessible to the platform and permits limited unauthorized data modification via standard HTTP, with no credentials or user interaction required. Oracle confirmed this in its August 2026 Critical Patch Update (CPU), classifying it as easily exploitable with a network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature and low attack complexity make this a high-priority remediation target for all organizations running the affected versions.

Full takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a high-privileged, network-based attacker over HTTP, with a scope change that lets impact spill into other Oracle Fusion Middleware components. The flaw yields complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1) and was addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-accessible attackers to achieve complete read access to all application-accessible data, perform limited unauthorized data modification, and cause partial denial of service - all via HTTP with no credentials or user interaction required. The 'Authentication Bypass' tag in multi-source intelligence corroborates the PR:N CVSS metric, indicating the flaw circumvents access controls prior to any authentication gate. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, though the low attack complexity (AC:L) makes opportunistic exploitation feasible once technical details circulate.

Full system takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged authenticated attacker over HTTP, with Oracle's own advisory characterizing the flaw as 'easily exploitable.' Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the affected WebCenter Sites instance. No public exploit code or active exploitation has been confirmed at time of analysis, though the low attack complexity and severity of impact make this a high-priority remediation target.

Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the platform over HTTP, with attacks capable of spilling beyond WebCenter Sites into other products due to a security scope change. Rated CVSS 9.0, the flaw yields complete confidentiality, integrity, and availability loss, though the high attack complexity (AC:H) means exploitation is non-trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 expose a full-takeover vulnerability that low-privileged, network-based attackers can exploit over HTTP without user interaction. Oracle's August 2026 Critical Patch Update characterizes this as 'easily exploitable,' with successful attacks achieving complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV active-exploitation listing has been identified at the time of analysis, but the low attack complexity combined with the severity of impact warrants urgent patching across all affected deployments.

Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, allows a low-privileged attacker with HTTP network access to fully compromise the server and, due to a scope change, significantly impact additional connected products. Oracle rates this CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's August 2026 Critical Patch Update.

Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the application over HTTP with low attack complexity. Rated CVSS 3.1 9.8 with complete confidentiality, integrity, and availability impact, this flaw was disclosed by Oracle in the August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Full system takeover of Oracle WebCenter Sites is achievable by a low-privileged, network-connected attacker via HTTP, with Oracle itself classifying this as 'easily exploitable.' Both currently supported versions - 12.2.1.4.0 and 14.1.2.0.0 - within the Oracle Fusion Middleware product line are confirmed affected, covering the entirety of the active install base. The CVSS 3.1 score of 8.8 (C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity, and availability; no public exploit code or CISA KEV listing has been identified at the time of this analysis.

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 within the Fusion Middleware stack expose an unauthenticated remote attack surface over HTTP, enabling network-accessible attackers to perform unauthorized creation, deletion, or modification of critical content data across all accessible WebCenter Sites instances, as well as cause a partial denial of service. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) confirms minimal attack complexity with no authentication or user interaction required, which Oracle's own advisory characterizes as 'easily exploitable'. No public exploit or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite exploitation profile elevates urgency for exposed deployments.

Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-adjacent or internet-facing attackers to perform unauthorized creation, deletion, or modification of critical content data, and to partially degrade service availability via HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, user interaction, or special configuration is required, placing this in the highest-risk category for unauthenticated web vulnerabilities. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity warrants prompt remediation.

Full read/write compromise of Oracle WebCenter Sites is possible by remote, unauthenticated attackers over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw CVSS 9.1 and describes it as easily exploitable, granting an attacker unauthorized creation, deletion, and modification of critical data plus full read access to all WebCenter Sites accessible data, though availability is unaffected. It is tagged as an authentication bypass; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 expose all managed content to unauthenticated remote attackers via an HTTP-accessible authentication bypass. The flaw, tagged explicitly as Authentication Bypass by Oracle, enables complete unauthorized read access to every data asset within the WebCenter Sites platform without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-complexity, zero-authentication attack profile makes opportunistic exploitation readily achievable by any attacker with HTTP reach to the application.

Remote takeover in Oracle WebCenter Sites 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the product, yielding complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Disclosed in the Oracle Critical Patch Update of July 2026 and reported by Oracle's own security alert team, it is rated easily exploitable but has no public exploit identified at time of analysis. WebCenter Sites is Oracle's enterprise web experience/content management platform, so a compromise means attacker control over the delivery of managed web content.

Full compromise of Oracle WebCenter Sites (Fusion Middleware) is possible over the network by an unauthenticated attacker via HTTP, resulting in complete product takeover with high confidentiality, integrity, and availability impact. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle addresses it in the July 2026 Critical Patch Update. The high attack complexity (AC:H) tempers real-world risk, and there is no public exploit identified at time of analysis and no CISA KEV listing.

Unauthorized read access to all WebCenter Sites data is achievable by unauthenticated remote attackers via HTTP against Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 - two currently supported versions of Oracle Fusion Middleware's web content management component. The vulnerability is tagged as an Authentication Bypass requiring one-time victim interaction (UI:R), suggesting an attacker-controlled HTTP trigger that a legitimate user must initiate (e.g., by visiting a crafted URL or link), after which the attacker gains complete confidentiality access to all CMS data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Unauthorized data disclosure in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker reach and read all data accessible to the application over HTTP, with a scope change that can significantly impact other connected products. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 score of 8.6 driven entirely by confidentiality impact. No public exploit is identified at time of analysis, and it is fixed in the Oracle Critical Patch Update of July 2026.

Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a top-priority patching item.

Unauthenticated information disclosure in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote attacker with only HTTP network access to read critical data and potentially all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 with pure confidentiality impact; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Oracle addressed the issue in the July 2026 Critical Patch Update.

Unauthorized data compromise in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP, with a scope change that can significantly impact adjacent products. Oracle rates this CVSS 8.7 with high confidentiality and integrity impact but high attack complexity, and the vendor tags it as an authentication bypass. No public exploit identified at time of analysis and it is not on CISA KEV.

Full compromise of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a low-privileged attacker sending HTTP requests over the network, with successful attacks resulting in complete takeover of the product. Oracle rates this CVSS 3.1 9.9 with a scope change, meaning the impact extends beyond WebCenter Sites into adjacent products. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and minimal privilege requirement make it a high patch priority; a fix was delivered in the Oracle July 2026 Critical Patch Update.

Remote takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, resulting in complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Oracle rates the flaw 'easily exploitable' and disclosed it in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthorized data access in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a remote, unauthenticated attacker to reach all data accessible to the product over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact additional connected products beyond WebCenter Sites itself. Oracle rates it CVSS 3.1 8.6 (confidentiality-only); no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle tags it as an Authentication Bypass.

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.0.22 and prior 2.0.x versions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

A carefully crafted PDF file can trigger an infinite loop while loading the file.0.22 and prior 2.0.x versions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced User Interface). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable. Public exploit code available.

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools). Rated medium severity (CVSS 4.0), this vulnerability is no authentication required. Public exploit code available.

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Catalog Mover). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Catalog Mover). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Blob Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0 allows remote attackers to affect integrity via unknown vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 11.1.1.8 and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 11.1.1.8, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 69.7%.

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity.