CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Oracle Access Manager (OpenSSO Agent) Remote Code Execution and System Takeover Vulnerability (CVE-2021-35587) Security Advisory
[Affected Scope] Oracle Access Manager within Oracle Fusion Middleware, versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0
[Impact] Unauthenticated remote attackers can gain full control of the Oracle Access Manager system and execute arbitrary code via HTTP network access
[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to OpenSSO Agent endpoints
Oracle Fusion Middleware BI Publisher Security Bypass and Data Modification/Disclosure Vulnerability (CVE-2019-2616) Analysis and Mitigation Guide
[Affected Scope] Oracle Fusion Middleware BI Publisher (formerly XML Publisher) versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0
[Impact] Unauthenticated remote attackers can read, update, insert, or delete sensitive data via HTTP, potentially impacting connected downstream systems
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict access to BI Publisher endpoints using a WAF or reverse proxy
Oracle Fusion Middleware Reports Developer Remote Arbitrary File Read and Upload Vulnerability (CVE-2012-3152)
[Affected Scope] Oracle Fusion Middleware versions 11.1.1.4, 11.1.1.6, and 11.1.2.0 within the Oracle Reports Developer component.
[Impact] Unauthenticated remote attackers can read or upload arbitrary files via the URLPARAMETER functionality, which can be chained with CVE-2012-3153 to achieve Remote Code Execution (RCE) via JSP web shell upload.
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the rwservlet endpoint and implement strict URL filtering.
Oracle Fusion Middleware SSO Open Redirect Vulnerability (CVE-2012-0518) Analysis & Mitigation Guide
[Affected Scope] Oracle Application Server Single Sign-On (OSSO) component in Oracle Fusion Middleware 10.1.4.3.0
[Impact] Remote attackers can compromise integrity by redirecting authenticated users to untrusted external malicious websites, facilitating phishing and credential harvesting
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or configure URL redirection filtering on the Oracle HTTP Server (OHS)
Oracle WebCenter Forms Recognition Remote Code Execution Vulnerability (CVE-2012-1710) Security Advisory
[Affected Scope] Oracle WebCenter Forms Recognition (Designer component) in Oracle Fusion Middleware 10.1.3.5
[Impact] Unauthenticated remote attackers can compromise confidentiality, integrity, and availability, leading to complete system takeover
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict network access to the affected components