Oracle Virtual Desktop Infrastructure vulnerabilities

2 CVEs affecting Oracle Virtual Desktop Infrastructure, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-4852, published 2015-11-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-4852: Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability, published 2015-11-18. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95% chance of exploitation in the next 30 days. The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3…
CVE-2015-7940, published 2015-11-09. Medium severity, CVSS 5.0. EPSS: 4.8% chance of exploitation in the next 30 days. The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic…