Priority MEDIUM 43
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00344 · Published 2026-01-20 · No fix listed
Priority LOW 27
Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00224 · Published 2026-01-20 · No fix listed
Priority MEDIUM 46
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00611 · Published 2025-01-21 · No fix listed CWE-400
Priority MEDIUM 41
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).
CVSS 3.1CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.00503 · Published 2024-10-15 · No fix listed
Priority MEDIUM 41
Vulnerability in the Advanced Networking Option component of Oracle Database Server.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.02432 · Published 2021-07-20 · No fix listed CWE-327
Priority CRITICAL 100KEV
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.96251 · Published 2020-12-11 · Fixed in 2.5.26 CWE-917
Priority LOW 27
Apache Groovy provides extension methods to aid with creating temporary directories.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.01027 · Published 2020-12-07 · Partial fix · 2.4.21, 2.5.14 +1 CWE-379
Priority MEDIUM 46
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.10867 · Published 2020-11-12 · Partial fix · 1.13 CWE-918
Priority MEDIUM 59
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.17823 · Published 2020-05-11 · Fixed in 2.0.10 CWE-611
Priority MEDIUM 61
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.29082 · Published 2019-08-20 · Partial fix · 1.9.4 CWE-502
THREATIST.IORead the docs