Read the docs

Oracle

Records14201All Threatist records
Exploited (KEV)82In CISA KEV
CVSS critical1606CVSS 9.0–10.0
CVSS high4615CVSS 7.0–8.9

Exploited now

Oracle records in CISA KEV
TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-17661 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-08-24TI-2026-34425 Oracle E-Business Suite Improper Privilege Management Vulnerability Priority CRITICAL 100KEV 2026-07-15TI-2026-27421 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Priority CRITICAL 100KEV 2026-06-12

Components

Products in the NVD configurations · select one to filter the records
Mysql 1328 records HIGH Jre 817 records CRITICAL Jdk 805 records CRITICAL Solaris 564 records CRITICAL Database Server 531 records HIGH Vm Virtualbox 483 records CRITICAL Peoplesoft Enterprise Peopletools 468 records CRITICAL E-business Suite 462 records CRITICAL

Records

34 records in Rest Data Services · all components

TI-2020-08897 CVE-2020-11023 · GHSA-jpcq-cgw6-v4j6

Potential XSS vulnerability in jQuery

Priority CRITICAL 88KEV

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.84887 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 CWE-79
TI-2021-09394 CVE-2021-28165 · GHSA-26vr-8j45-3r4w

Uncontrolled resource consumption in Eclipse Jetty

Priority HIGH 71

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.53861 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-400
TI-2021-13463 CVE-2021-34429 · GHSA-vjv5-gp2w-65vm

Information disclosure in Eclipse Jetty

Priority HIGH 69

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.9933 Published 2021-07-15 Partial fix · 9.4.43, 10.0.6 +1 CWE-200
TI-2021-09398 CVE-2021-28169 · GHSA-gwcr-j4wh-j3cq

Information disclosure in Eclipse Jetty

Priority MEDIUM 64

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.7848 Published 2021-06-09 Partial fix · 9.4.41, 10.0.3 +1 CWE-200
TI-2020-16549 CVE-2020-27223 · GHSA-m394-8rww-3jr7

Uncontrolled resource consumption in Eclipse Jetty

Priority MEDIUM 64

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.78031 Published 2021-02-26 Partial fix · 9.4.37, 10.0.1 +1 CWE-407
TI-2017-05294 CVE-2017-7658 · GHSA-6x9x-8qw9-9pp6

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x…

Priority MEDIUM 60

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18996 Published 2018-06-26 Partial fix · 9.2.25, 9.3.24 +4 CWE-444
TI-2021-18023 CVE-2021-41184 · GHSA-gpqq-952q-5327

XSS in the `of` option of the `.position()` util

Priority MEDIUM 57

jQuery-UI is the official jQuery user interface library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.40768 Published 2021-10-26 Partial fix · 1.13.0, 7.0.0 CWE-79
TI-2017-05293 CVE-2017-7657 · GHSA-vgg8-72f2-qm23

Integer overflow in Eclipse Jetty

Priority MEDIUM 57

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14371 Published 2018-06-26 Partial fix · 9.3.24, 9.4.11 +2 CWE-444
TI-2021-10139 CVE-2021-29425 · GHSA-gwrp-pvrq-jmwv

Possible limited path traversal vulnerabily in Apache Commons IO

Priority MEDIUM 48

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.10549 Published 2021-04-13 Partial fix · 2.7 CWE-20
TI-2017-07121 CVE-2017-9735 · GHSA-wfcc-pff6-rgc5

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which…

Priority MEDIUM 45

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09639 Published 2017-06-16 Partial fix · 9.4.6.v20170531, 9.3.20.v20170531 +1 CWE-203
TI-2021-18022 CVE-2021-41183 · GHSA-j7qv-pgf6-hvh4

XSS in `*Text` options of the Datepicker widget

Priority MEDIUM 40

jQuery-UI is the official jQuery user interface library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.08533 Published 2021-10-26 Partial fix · 1.13.0, 7.0.0 CWE-79
TI-2019-07556 CVE-2019-10241 · GHSA-7vx9-xjhr-rw6h

Cross-site scripting in Eclipse Jetty

Priority LOW 39

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandle…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.09365 Published 2019-04-22 Partial fix · 9.2.27.v20190403, 9.3.26.v20190403 +1 CWE-79
TI-2020-16544 CVE-2020-27218 · GHSA-86wm-rrjm-8wh8

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2…

Priority LOW 33

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.08277 Published 2020-11-28 Partial fix · 9.4.35.v20201120 CWE-226
TI-2019-07561 CVE-2019-10246 · GHSA-r28m-g6j9-r2h5

Information disclosure in Eclipse Jetty

Priority LOW 31

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for sho…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.04094 Published 2019-04-22 Fixed in 9.2.28.v20190418, 9.3.27.v20190418 +1 CWE-213
TI-2019-07539 CVE-2019-10219 · GHSA-m8p2-495h-ccmh

Cross-site scripting in hibernate-validator

Priority LOW 31

A vulnerability was found in Hibernate-Validator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02157 Published 2019-11-08 Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79
Load more
Open these records in search →