CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Oracle WebLogic Server T3/IIOP Protocol Information Disclosure Vulnerability Advisory (CVE-2024-21182)
[Affected Scope] Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0.
[Impact] Unauthenticated remote attackers can exploit this vulnerability via T3 or IIOP protocols to gain unauthorized access to critical data or compromise all accessible data.
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/disable T3 and IIOP protocols if they are not required.
Oracle WebLogic Server Console Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2020-14883)
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
[Impact] Unauthenticated or high-privileged network attackers can bypass authentication via HTTP to execute arbitrary code and take over the server
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict external access to the administration console
Oracle WebLogic Server T3/IIOP Protocol Remote Code Execution (RCE) Vulnerability (CVE-2020-14644) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
[Impact] Unauthenticated remote attackers can exploit T3 or IIOP protocols to achieve complete takeover and execute arbitrary code on the target server
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/block T3 and IIOP protocol access using connection filters
Oracle WebLogic Server Web Services XMLDecoder Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2017-3506)
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, and 12.2.1.2
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands via malicious HTTP POST requests, leading to complete compromise of the WebLogic server
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict access to the vulnerable 'wls-wsat' web service context