Oracle Micros Relate CRM Software vulnerabilities

4 CVEs affecting Oracle Micros Relate CRM Software, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-17563, published 2019-12-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability, published 2017-04-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 90.3% chance of exploitation in the next 30 days. Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an…
CVE-2018-1304, published 2018-02-28. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84…
CVE-2018-1305, published 2018-02-23. Medium severity, CVSS 6.5. EPSS: 14.5% chance of exploitation in the next 30 days. Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded.…
CVE-2019-17563, published 2019-12-23. High severity, CVSS 7.5. EPSS: 10.7% chance of exploitation in the next 30 days. When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The…