Oracle Secure Global Desktop vulnerabilities

33 CVEs affecting Oracle Secure Global Desktop, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-35650, published 2021-10-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2018-11784, published 2018-10-04. Medium severity, CVSS 4.3. EPSS: 97.7% chance of exploitation in the next 30 days. When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested…
CVE-2019-0227, published 2019-05-01. High severity, CVSS 7.5. EPSS: 91.9% chance of exploitation in the next 30 days. A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x…
CVE-2014-0226, published 2014-07-20. Medium severity, CVSS 6.8. EPSS: 85.7% chance of exploitation in the next 30 days. Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive…
CVE-2019-10092, published 2019-09-26. Medium severity, CVSS 6.1. EPSS: 81.5% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and…
CVE-2021-33037, published 2021-07-12. Medium severity, CVSS 5.3. EPSS: 74.7% chance of exploitation in the next 30 days. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2017-7668, published 2017-06-20. High severity, CVSS 7.5. EPSS: 57.5% chance of exploitation in the next 30 days. The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously…
CVE-2017-9788, published 2017-07-13. Critical severity, CVSS 9.1. EPSS: 56.8% chance of exploitation in the next 30 days. In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value…
CVE-2018-11763, published 2018-09-25. Medium severity, CVSS 5.9. EPSS: 50.8% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This…

Latest

CVE-2021-35650, published 2021-10-20. Medium severity, CVSS 4.6. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low…
CVE-2021-35649, published 2021-10-20. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low…
CVE-2021-2447, published 2021-07-21. Critical severity, CVSS 9.9. EPSS: 1.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low…
CVE-2021-2446, published 2021-07-21. Critical severity, CVSS 9.6. EPSS: 1.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affected is 5.6. Easily exploitable vulnerability allows…
CVE-2021-2248, published 2021-04-22. Critical severity, CVSS 10.0. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported version that is affected is 5.6. Easily exploitable vulnerability allows…
CVE-2021-2221, published 2021-04-22. Critical severity, CVSS 9.6. EPSS: 2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affected is 5.6. Easily exploitable vulnerability allows…
CVE-2021-2177, published 2021-04-22. Critical severity, CVSS 10.0. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway). The supported version that is affected is 5.6. Easily exploitable vulnerability allows…
CVE-2021-3450, published 2021-03-25. High severity, CVSS 7.4. EPSS: 18.3% chance of exploitation in the next 30 days. The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to…