Oracle Enterprise Repository vulnerabilities

21 CVEs affecting Oracle Enterprise Repository, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-36374, published 2021-07-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11998, published 2020-09-10. Critical severity, CVSS 9.8. EPSS: 48.9% chance of exploitation in the next 30 days. A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it…
CVE-2018-8013, published 2018-05-24. Critical severity, CVSS 9.8. EPSS: 18.9% chance of exploitation in the next 30 days. In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of…
CVE-2019-2904, published 2019-10-16. Critical severity, CVSS 9.8. EPSS: 14.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily…
CVE-2020-11987, published 2021-02-24. High severity, CVSS 8.2. EPSS: 13.3% chance of exploitation in the next 30 days. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this…
CVE-2019-0222, published 2019-03-28. High severity, CVSS 7.5. EPSS: 12% chance of exploitation in the next 30 days. In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
CVE-2019-17566, published 2020-11-12. High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days. Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this…
CVE-2019-0188, published 2019-05-28. High severity, CVSS 7.5. EPSS: 9.8% chance of exploitation in the next 30 days. Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson…
CVE-2020-11979, published 2020-10-01. High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days. As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task…
CVE-2020-1941, published 2020-05-14. Medium severity, CVSS 6.1. EPSS: 7.2% chance of exploitation in the next 30 days. In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
CVE-2018-11775, published 2018-09-10. High severity, CVSS 7.4. EPSS: 7% chance of exploitation in the next 30 days. TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client…

Latest

CVE-2021-36374, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.6% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs.…
CVE-2021-36373, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.5% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used…
CVE-2021-1994, published 2021-01-20. Critical severity, CVSS 9.8. EPSS: 5.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable…
CVE-2020-11994, published 2020-07-08. High severity, CVSS 7.5. EPSS: 4.5% chance of exploitation in the next 30 days. Server-Side Template Injection and arbitrary file disclosure on Camel templating components
CVE-2020-1945, published 2020-05-14. Medium severity, CVSS 6.3. EPSS: 1.8% chance of exploitation in the next 30 days. Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The…