Oracle Secure Backup vulnerabilities

30 CVEs affecting Oracle Secure Backup, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-21578, published 2025-04-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability, published 2021-10-07. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by…
CVE-2009-1977, published 2009-07-14. High severity, CVSS 10.0. EPSS: 72.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.…
CVE-2021-26691, published 2021-06-10. Critical severity, CVSS 9.8. EPSS: 68.3% chance of exploitation in the next 30 days. In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
CVE-2009-1978, published 2009-07-14. High severity, CVSS 9.0. EPSS: 64.7% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2008-5444, published 2009-01-14. High severity, CVSS 10.0. EPSS: 60.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a…
CVE-2010-0904, published 2010-07-13. Medium severity, CVSS 5.0. EPSS: 50.6% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors.
CVE-2021-3712, published 2021-08-24. High severity, CVSS 7.4. EPSS: 50.4% chance of exploitation in the next 30 days. ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C…
CVE-2021-33193, published 2021-08-16. High severity, CVSS 7.5. EPSS: 46.2% chance of exploitation in the next 30 days. A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to…
CVE-2008-5448, published 2009-01-14. High severity, CVSS 10.0. EPSS: 40.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a…

Latest

CVE-2025-21578, published 2025-04-15. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in Oracle Secure Backup (component: General). Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and 18.1.0.2. Easily exploitable vulnerability…
CVE-2021-3450, published 2021-03-25. High severity, CVSS 7.4. EPSS: 18.3% chance of exploitation in the next 30 days. The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…
CVE-2015-1351, published 2015-03-30. High severity, CVSS 7.5. EPSS: 8.6% chance of exploitation in the next 30 days. Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly…
CVE-2011-2261, published 2011-07-20. High severity, CVSS 10.0. EPSS: 3.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a…