Oracle Utilities Testing Accelerator vulnerabilities

27 CVEs affecting Oracle Utilities Testing Accelerator, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-4104, published 2021-12-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-39144: XStream Remote Code Execution Vulnerability, published 2021-08-23. High severity, CVSS 8.5. Actively exploited: in CISA KEV since 2023-03-10. EPSS: 98.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2021-33037, published 2021-07-12. Medium severity, CVSS 5.3. EPSS: 74.7% chance of exploitation in the next 30 days. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request…
CVE-2020-13936, published 2021-03-10. High severity, CVSS 8.8. EPSS: 22.7% chance of exploitation in the next 30 days. An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This…
CVE-2021-39141, published 2021-08-23. High severity, CVSS 8.5. EPSS: 16.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39146, published 2021-08-23. High severity, CVSS 8.5. EPSS: 14.3% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-36090, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35516, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.4% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35515, published 2021-07-13. High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack…
CVE-2021-39152, published 2021-08-23. High severity, CVSS 8.5. EPSS: 11.4% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not…

Latest

CVE-2021-39150, published 2021-08-23. High severity, CVSS 8.5. EPSS: 3.4% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not…
CVE-2021-39140, published 2021-08-23. Medium severity, CVSS 6.3. EPSS: 5.9% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on…
CVE-2021-39154, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39153, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.5% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39151, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39149, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39148, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39147, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…