Oracle Opensso vulnerabilities

4 CVEs affecting Oracle Opensso, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-7182, published 2015-11-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7182, published 2015-11-05. Critical severity, CVSS 9.8. EPSS: 10.2% chance of exploitation in the next 30 days. Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4…
CVE-2013-1620, published 2013-02-08. Medium severity, CVSS 4.3. EPSS: 3.7% chance of exploitation in the next 30 days. The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC…
CVE-2010-4444, published 2011-01-19. Medium severity, CVSS 6.8. EPSS: 2.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Sun Java System Access Manager and Oracle OpenSSO 7, 7.1, and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2012-0079, published 2012-01-18. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Administration.