Oracle SQL Developer vulnerabilities

4 CVEs affecting Oracle SQL Developer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21969, published 2023-04-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2020-13956, published 2020-12-02. Medium severity, CVSS 5.3. EPSS: 9% chance of exploitation in the next 30 days. Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host…
CVE-2020-14740, published 2020-10-21. Low severity, CVSS 2.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the SQL Developer Install component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows…
CVE-2023-21969, published 2023-04-18. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in Oracle SQL Developer (component: Installation). Supported versions that are affected are Prior to 23.1.0. Easily exploitable vulnerability allows high privileged attacker with logon…