Oracle Primavera p6 Enterprise Project Portfolio Management vulnerabilities

63 CVEs affecting Oracle Primavera p6 Enterprise Project Portfolio Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-50061, published 2025-07-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2021-44832, published 2021-12-28. Medium severity, CVSS 6.6. EPSS: 97.9% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender…
CVE-2012-3137, published 2012-09-21. Medium severity, CVSS 6.4. EPSS: 31.4% chance of exploitation in the next 30 days. The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users,…
CVE-2009-2625, published 2009-08-06. Medium severity, CVSS 5.0. EPSS: 30.4% chance of exploitation in the next 30 days. XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote…
CVE-2018-14718, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 12.7% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2020-5421, published 2020-09-19. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed…
CVE-2018-19362, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-19361, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-19360, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2018-14719, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 9.7% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic…

Latest

CVE-2025-50061, published 2025-07-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are…
CVE-2025-21558, published 2025-01-21. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are…
CVE-2025-21528, published 2025-01-21. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are…
CVE-2025-21526, published 2025-01-21. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are…
CVE-2024-21095, published 2024-04-16. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are…
CVE-2020-36518, published 2022-03-11. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2021-2386, published 2021-07-21. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are…
CVE-2021-2366, published 2021-07-21. Medium severity, CVSS 6.4. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are…