Oracle Transportation Management vulnerabilities

31 CVEs affecting Oracle Transportation Management, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-60584, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability, published 2020-02-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 99.3% chance of exploitation in the next 30 days. When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar…
CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability, published 2017-04-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 90.3% chance of exploitation in the next 30 days. Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2020-9484, published 2020-05-20. High severity, CVSS 7.0. EPSS: 55.5% chance of exploitation in the next 30 days. When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;…
CVE-2015-3195, published 2015-12-06. Medium severity, CVSS 5.3. EPSS: 38.7% chance of exploitation in the next 30 days. The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed…
CVE-2021-35616, published 2021-10-20. Medium severity, CVSS 5.4. EPSS: 28% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). The supported version that is affected is 6.4.3. Easily exploitable vulnerability…
CVE-2019-17563, published 2019-12-23. High severity, CVSS 7.5. EPSS: 10.7% chance of exploitation in the next 30 days. When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The…
CVE-2020-1935, published 2020-02-24. Medium severity, CVSS 4.8. EPSS: 9.4% chance of exploitation in the next 30 days. In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as…
CVE-2019-17569, published 2020-02-24. Medium severity, CVSS 4.8. EPSS: 8.9% chance of exploitation in the next 30 days. The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were…

Latest

CVE-2026-60584, published 2026-07-21. High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: CSV Management). The supported version that is affected is 6.5.3. Easily exploitable vulnerability…
CVE-2026-60583, published 2026-07-21. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows…
CVE-2026-60434, published 2026-07-21. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Authentication). The supported version that is affected is 6.5.3. Easily exploitable vulnerability…
CVE-2026-60433, published 2026-07-21. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Integration). The supported version that is affected is 6.5.3. Easily exploitable vulnerability…
CVE-2022-39420, published 2022-10-18. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Data, Functional Security). Supported versions that are affected are 6.4.3 and 6.5.1. Easily…
CVE-2022-39411, published 2022-10-18. Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). Supported versions that are affected are 6.4.3 and 6.5.1. Easily…
CVE-2022-39409, published 2022-10-18. Low severity, CVSS 2.7. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). Supported versions that are affected are 6.4.3 and 6.5.1. Easily…
CVE-2022-21591, published 2022-10-18. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable…
CVE-2022-21480, published 2022-04-19. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: User Interface). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable…