Oracle Autovue vulnerabilities

5 CVEs affecting Oracle Autovue, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-35728, published 2020-12-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-35728, published 2020-12-27. High severity, CVSS 8.1. EPSS: 12.5% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka…
CVE-2019-10247, published 2019-04-22. Medium severity, CVSS 5.3. EPSS: 5.9% chance of exploitation in the next 30 days. In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified…
CVE-2019-10246, published 2019-04-22. Medium severity, CVSS 5.3. EPSS: 4.1% chance of exploitation in the next 30 days. In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it…
CVE-2020-2592, published 2020-01-15. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle AutoVue product of Oracle Supply Chain (component: Security). The supported version that is affected is 21.0.2. Easily exploitable vulnerability allows unauthenticated…
CVE-2020-14551, published 2020-07-15. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle AutoVue product of Oracle Supply Chain (component: Security). The supported version that is affected is 21.0. Easily exploitable vulnerability allows low privileged…