Oracle Clusterware vulnerabilities

5 CVEs affecting Oracle Clusterware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-2860, published 2019-07-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-14719, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 9.7% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic…
CVE-2017-15095, published 2018-02-06. Critical severity, CVSS 9.8. EPSS: 8.4% chance of exploitation in the next 30 days. A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously…
CVE-2018-11307, published 2019-07-09. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4,…
CVE-2018-1000873, published 2018-12-20. Medium severity, CVSS 6.5. EPSS: 4.8% chance of exploitation in the next 30 days. Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to…
CVE-2019-2860, published 2019-07-23. Medium severity, CVSS 5.6. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Clusterware component of Oracle Support Tools (subcomponent: Trace File Analyzer (TFA) Collector). The supported version that is affected is 12.1.0.2.0. Difficult to…