Oracle Tape Library Acsls vulnerabilities

11 CVEs affecting Oracle Tape Library Acsls, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-2729, published 2019-06-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-2725: Oracle WebLogic Server, Injection, published 2019-04-26. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-10. EPSS: 100% chance of exploitation in the next 30 days. Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2019-2729, published 2019-06-19. Critical severity, CVSS 9.8. EPSS: 88.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2018-1270, published 2018-04-06. Critical severity, CVSS 9.8. EPSS: 77.5% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1275, published 2018-04-11. Critical severity, CVSS 9.8. EPSS: 57.4% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2018-1271, published 2018-04-06. Medium severity, CVSS 5.9. EPSS: 34.4% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS,…
CVE-2018-15756, published 2018-10-18. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving…
CVE-2018-1272, published 2018-04-06. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux…
CVE-2018-1257, published 2018-05-11. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory…

Latest

CVE-2018-1258, published 2018-05-11. High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days. Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain…