Summary
Oracle heeft meerdere kwetsbaarheden verholpen in diverse producten, waaronder Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware (inclusief Helidon) en Oracle HTTP Server.
Details
Interpretaties
De kwetsbaarheden betreffen onder andere onveilige deserialisatie, onvoldoende authenticatie- en toegangscontroles, kwetsbaarheden in netwerkprotocollen zoals HTTP, HTTP/2, SOAP, T3, IIOP en LDAP, en fouten in cryptografische bibliotheken zoals Bouncy Castle en Jackson-databind. Aanvallers kunnen hierdoor onder meer:
- Arbitrary code execution uitvoeren via crafted input of deserialisatieprocessen.
- Volledige systeemcompromittering bereiken via netwerktoegang zonder authenticatie.
- Ongeautoriseerde toegang verkrijgen tot gevoelige of kritieke data.
- Data manipuleren, creëren, verwijderen of wijzigen zonder juiste rechten.
- Denial-of-Service veroorzaken door resource-uitputting, crashes of hangs.
- Privilege escalation uitvoeren binnen het systeem.
- Cross-site scripting en spoofing aanvallen uitvoeren.
- Kwetsbaarheden in authenticatie- en autorisatiemechanismen misbruiken.
De kwetsbaarheden zijn aanwezig in specifieke versies van de genoemde Oracle producten en sommige onderliggende open source componenten die Oracle gebruikt. Exploitatie kan plaatsvinden via netwerktoegang, vaak zonder authenticatie, en in sommige gevallen is gebruikersinteractie vereist. Diverse kwetsbaarheden hebben een CVSS score tot 10.0, wat duidt op een hoog potentieel impactniveau. Er is (nog) geen specifieke proof-of-concept-code (PoC) bekend, maar de aard van de kwetsbaarheden maakt exploitatie mogelijk via gerichte netwerkverzoeken of gemanipuleerde data en het NCSC verwacht, vanwege de wijde verspreiding van deze producten, op korte termijn een toename in scan- en misbruikverkeer.
Oplossingen
Oracle heeft updates en patches uitgebracht voor de getroffen producten om de beschreven kwetsbaarheden te verhelpen. Gebruikers van de genoemde Oracle producten wordt geadviseerd de beschikbare updates te installeren om de beveiliging van hun systemen te waarborgen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 194
-
Critical 10.0
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
Critical 10.0
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 10.0
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 10.0
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions tha…
-
Critical 9.9
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Wor…
-
Critical 9.9
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.9
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.9
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions tha…
-
Critical 9.9
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions tha…
-
Critical 9.9
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
Critical 9.8
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported…
-
Critical 9.8
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE
Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class…
-
Critical 9.8
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-…
-
Critical 9.8CVE-2026-42779 Public exploit
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the cl…
-
Critical 9.8
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.re…
-
Critical 9.8
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explor…
-
Critical 9.8
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explor…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.8
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.8
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Wor…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Su…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Su…
-
Critical 9.8
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). S…
-
Critical 9.8
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Critical 9.6
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported version…
-
Critical 9.6
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.6
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric La…
-
Critical 9.3
Name Constraints bypass via trailing dot in rfc822Name and URI
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.…
-
Critical 9.3
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.1
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported …
-
Critical 9.1
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.1
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions tha…
-
Critical 9.1
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
Critical 9.1
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). S…
-
High 8.9
Non-constant time comparisons risk private key leakage in FrodoKEM.
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, fro…
-
High 8.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported …
-
High 8.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported …
-
High 8.8
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that …
-
High 8.8
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that …
-
High 8.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 8.8
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that …
-
High 8.8
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). The supported version th…
-
High 8.8
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Compo…
-
High 8.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 8.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 8.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 8.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported …
-
High 8.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 8.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Support…
-
High 8.8
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Sup…
-
High 8.7
OpenPGP AEAD decryption skips final tag on chunk-aligned data
In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2…
-
High 8.7
OpenPGP user-attribute subpacket length bounded only by JVM max memory
In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), …
-
High 8.7
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Serv…
-
High 8.7
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
High 8.7
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Serv…
-
High 8.7
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Pl…
-
High 8.7
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and C…
-
High 8.7
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Suppo…
-
High 8.6
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
High 8.6
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 8.6
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). S…
-
High 8.6
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 8.6
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 8.6
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 8.6
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 8.4
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 8.3
Remote Code execution in SnakeYAML
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…
-
High 8.2
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms). Supported…
-
High 8.2
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 8.2
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 8.2
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 8.2
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case mana…
-
High 8.1
In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with f…
-
High 8.1
Spring Framework Unsafe Deserialization via Jackson JMS Converters
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions vi…
-
High 8.1
jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…
-
High 8.1
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
High 7.8
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported ver…
-
High 7.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Expo…
-
High 7.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 7.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Expo…
-
High 7.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Expo…
-
High 7.8
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported ve…
-
High 7.8
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 7.5
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (comp…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versio…
-
High 7.5
Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with e…
-
High 7.5
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized com…
-
High 7.5
JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in Telne…
-
High 7.5
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
High 7.5
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that …
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
High 7.5
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 7.5
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 7.5
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 7.5
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export…
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export…
-
High 7.5
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). S…
-
High 7.5
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Su…
-
High 7.5
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported…
-
High 7.5
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported…
-
High 7.5
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl …
-
High 7.5
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default ma…
-
High 7.4
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). S…
-
High 7.3
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
High 7.2
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server). Supported versions t…
-
High 7.2
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors). Supported versions that are…
-
High 7.1
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 7.1
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
High 7.1
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). S…
-
High 7.1
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). S…
-
High 7.0
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper). Supported versions…
-
Medium 6.9
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: OIDC). Supported versions that are affecte…
-
Medium 6.9
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Medium 6.8
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-http-auth). Sup…
-
Medium 6.8
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 6.8
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 6.8
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported ve…
-
Medium 6.8
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported ve…
-
Medium 6.6
Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). Suppo…
-
Medium 6.6
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
Medium 6.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-concurrency-limits). Suppor…
-
Medium 6.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected…
-
Medium 6.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-dns-resolver-round-robin…
-
Medium 6.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-websocket). Supported ve…
-
Medium 6.5
Apache Neethi: Unrestricted HTTP Redirect Following in Policy References
Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitr…
-
Medium 6.5
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrap…
-
Medium 6.5
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 6.5
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 6.5
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 6.5
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 6.5
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 6.5
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versio…
-
Medium 6.5
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versio…
-
Medium 6.5
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported ve…
-
Medium 6.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
Medium 6.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The…
-
Medium 6.5
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Medium 6.5
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported …
-
Medium 6.5
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported v…
-
Medium 6.3
Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.s…
-
Medium 6.3CVE-2026-49844 Public exploit
Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-…
-
Medium 6.3
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Medium 6.1
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported …
-
Medium 6.1
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 6.1
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported …
-
Medium 6.1
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
Medium 6.0
Jakarta Mail vulnerable to SMTP Injection
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
-
Medium 5.9
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars…
-
Medium 5.9
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported…
-
Medium 5.9
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported …
-
Medium 5.9
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Databinding). Supported vers…
-
Medium 5.9
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects). Supporte…
-
Medium 5.8
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-jwt). Supported…
-
Medium 5.8
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integrations-vault). Supported ver…
-
Medium 5.7
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported ve…
-
Medium 5.6
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper). S…
-
Medium 5.5
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions t…
-
Medium 5.5
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versio…
-
Medium 5.5
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer). Supported vers…
-
Medium 5.5
Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remot…
-
Medium 5.4
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 5.4
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Medium 5.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-health). Supported versions that a…
-
Medium 5.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-google-login). …
-
Medium 5.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient). Supported versions tha…
-
Medium 5.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versio…
-
Medium 5.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are af…
-
Medium 5.3
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not …
-
Medium 5.3
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Medium 5.3
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported …
-
Medium 5.3
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
Medium 5.0
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Medium 4.3
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Connector Framework). Supp…
-
Medium 4.3
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Medium 4.3
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versio…
-
Medium 4.0
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export…
-
Low 3.7
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Supported versio…
-
Low 3.7
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected…
-
Low 3.7
Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remot…
-
Low 3.3
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported ve…
-
Low 3.1
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors). Supported versions that are…
-
Low 3.1
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Unscored —
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" a…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://www.oracle.com/security-alerts/cpuoct2026.html