Oracle OSS Support Tools vulnerabilities

19 CVEs affecting Oracle OSS Support Tools, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-21405, published 2022-04-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2019-5436, published 2019-05-28. High severity, CVSS 7.8. EPSS: 49.7% chance of exploitation in the next 30 days. A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
CVE-2015-9251, published 2018-01-18. Medium severity, CVSS 6.1. EPSS: 29.7% chance of exploitation in the next 30 days. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVE-2018-2616, published 2018-01-18. High severity, CVSS 8.8. EPSS: 27.1% chance of exploitation in the next 30 days. Vulnerability in the OSS Support Tools component of Oracle Support Tools (subcomponent: Diagnostic Assistant). The supported version that is affected is Prior to 2.11.33. Easily exploitable…
CVE-2016-7103, published 2017-03-15. Medium severity, CVSS 6.1. EPSS: 22.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
CVE-2019-5482, published 2019-09-16. Critical severity, CVSS 9.8. EPSS: 17.9% chance of exploitation in the next 30 days. Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2015-3197, published 2016-02-15. Medium severity, CVSS 5.9. EPSS: 10.7% chance of exploitation in the next 30 days. ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection…
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2019-5481, published 2019-09-16. Critical severity, CVSS 9.8. EPSS: 7.5% chance of exploitation in the next 30 days. Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2021-41973, published 2021-11-01. Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days. In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer…

Latest

CVE-2022-21405, published 2022-04-19. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Oracle Explorer). The supported version that is affected is 18.3. Easily exploitable vulnerability allows high…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2021-30129, published 2021-07-12. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD…
CVE-2021-2303, published 2021-04-22. Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days. Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant). The supported version that is affected is Prior to 2.12.41. Easily exploitable vulnerability…
CVE-2021-27568, published 2021-02-23. Medium severity, CVSS 5.9. EPSS: 2.9% chance of exploitation in the next 30 days. An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…