CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Oracle WebLogic Server T3/IIOP Protocol Unauthenticated Information Disclosure and RCE Vulnerability (CVE-2023-21839) Security Advisory
[Affected Scope] Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
[Impact] Unauthenticated remote attackers can compromise the server via T3/IIOP protocols, leading to unauthorized access to sensitive data or potential Remote Code Execution (RCE)
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to T3/IIOP protocols (typically port 7001)
Oracle WebLogic Server Console Remote Code Execution and Authentication Bypass Vulnerability (CVE-2020-14750) Security Advisory
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
[Impact] Unauthenticated remote attackers with network access via HTTP can bypass authentication on the administration console and achieve full remote code execution (RCE)
[Mitigation] Immediately apply the official Oracle security patches and restrict network access to the WebLogic Administration Console (/console)
Oracle WebLogic Server IIOP Deserialization Remote Code Execution Vulnerability (CVE-2020-2551) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0
[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the WebLogic Server via malicious IIOP requests
[Mitigation] Apply the official Oracle CPU patches immediately, or disable the IIOP protocol and restrict access to port 7001
Oracle WebLogic Server WLS Security XML Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2017-10271) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, and 12.2.1.2.0
[Impact] Unauthenticated remote attackers can execute arbitrary system commands and fully compromise the WebLogic Server via crafted XML payloads sent over HTTP/T3
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or disable the vulnerable 'wls-wsat' component and restrict T3 protocol access