CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Oracle WebLogic Server T3/IIOP Protocol Remote Code Execution (RCE) Vulnerability (CVE-2020-14644) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
[Impact] Unauthenticated remote attackers can exploit T3 or IIOP protocols to achieve complete takeover and execute arbitrary code on the target server
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/block T3 and IIOP protocol access using connection filters
Oracle WebLogic Server T3/IIOP Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2020-2883) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0
[Impact] Unauthenticated remote attackers can execute arbitrary code and take full control of the Oracle WebLogic Server by sending malicious serialized data via T3 or IIOP protocols
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict external access to T3/IIOP protocols using connection filters and firewalls
Oracle Coherence and WebLogic Server T3 Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2020-2555)
[Affected Scope] Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0, including WebLogic Server environments utilizing these components
[Impact] Unauthenticated remote attackers can exploit this vulnerability via the T3 protocol to execute arbitrary code and achieve complete takeover of the target system
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3/T3S protocols (default port 7001) using connection filters
Oracle WebLogic Server T3 Protocol Deserialization Remote Code Execution Vulnerability (CVE-2018-2628) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.2, and 12.2.1.3
[Impact] Unauthenticated remote attackers can exploit this vulnerability via the T3 protocol to execute arbitrary code and completely take over the WebLogic Server
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external T3 protocol access (Port 7001) using connection filters or firewalls
Oracle WebLogic Server T3 Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2015-4852) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0
[Impact] Unauthenticated remote attackers can execute arbitrary system commands via a crafted serialized Java object sent over the T3 protocol to TCP port 7001
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3 protocol using WebLogic Connection Filters