Oracle Database vulnerabilities

66 CVEs affecting Oracle Database, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21934, published 2023-04-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-3566, published 2014-10-15. Low severity, CVSS 3.4. EPSS: 100% chance of exploitation in the next 30 days. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a…
CVE-2016-2183, published 2016-09-01. High severity, CVSS 7.5. EPSS: 94.7% chance of exploitation in the next 30 days. The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for…
CVE-2020-9484, published 2020-05-20. High severity, CVSS 7.0. EPSS: 55.5% chance of exploitation in the next 30 days. When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;…
CVE-2021-25122, published 2021-03-01. High severity, CVSS 7.5. EPSS: 18.1% chance of exploitation in the next 30 days. When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body…
CVE-2021-25329, published 2021-03-01. High severity, CVSS 7.0. EPSS: 9.5% chance of exploitation in the next 30 days. The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly…
CVE-2018-1288, published 2018-07-26. Medium severity, CVSS 5.4. EPSS: 4.8% chance of exploitation in the next 30 days. In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request…
CVE-2019-3740, published 2019-09-18. Medium severity, CVSS 6.5. EPSS: 3.9% chance of exploitation in the next 30 days. RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could…
CVE-2016-3479, published 2016-07-21. High severity, CVSS 7.5. EPSS: 3.7% chance of exploitation in the next 30 days. Unspecified vulnerability in the Portable Clusterware component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows remote attackers to affect availability via unknown vectors.
CVE-2016-3609, published 2016-07-21. Critical severity, CVSS 9.0. EPSS: 3.3% chance of exploitation in the next 30 days. Unspecified vulnerability in the OJVM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via…
CVE-2016-3454, published 2016-04-21. Critical severity, CVSS 9.0. EPSS: 2.9% chance of exploitation in the next 30 days. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via…

Latest

CVE-2023-21934, published 2023-04-18. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows low privileged attacker having User…
CVE-2023-21829, published 2023-01-18. Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged…
CVE-2023-21827, published 2023-01-18. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged…
CVE-2022-21596, published 2022-10-18. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged…
CVE-2022-21565, published 2022-07-19. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker…
CVE-2022-21511, published 2022-07-19. High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server. For supported versions that are affected see note. Easily exploitable vulnerability allows high…
CVE-2022-21510, published 2022-07-19. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. For supported versions that are affected see note. Easily exploitable vulnerability allows low…
CVE-2022-21432, published 2022-07-19. Low severity, CVSS 2.7. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Database - Enterprise Edition RDBMS Security component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable…
CVE-2020-35169, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulnerability.
CVE-2020-35168, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.