Oracle Service Architecture Leveraging Tuxedo vulnerabilities

6 CVEs affecting Oracle Service Architecture Leveraging Tuxedo, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1258, published 2018-05-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1270, published 2018-04-06. Critical severity, CVSS 9.8. EPSS: 77.5% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1275, published 2018-04-11. Critical severity, CVSS 9.8. EPSS: 57.4% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1271, published 2018-04-06. Medium severity, CVSS 5.9. EPSS: 34.4% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS,…
CVE-2018-1272, published 2018-04-06. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux…
CVE-2018-1257, published 2018-05-11. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1258, published 2018-05-11. High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days. Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain…