6.1

CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Axis Version >= 1.0 <= 1.4
Oracle ≫ Application Testing Suite Version 13.2.0.1
Oracle ≫ Application Testing Suite Version 13.3.0.1
Oracle ≫ Big Data Discovery Version 1.6
Oracle ≫ Communications Design Studio Version 7.3.4.3.0
Oracle ≫ Communications Design Studio Version 7.3.5.5.0
Oracle ≫ Communications Design Studio Version 7.4.0.4.0
Oracle ≫ Communications Design Studio Version 7.4.1.1.0
Oracle ≫ Financial Services Funds Transfer Pricing Version >= 8.0.2 <= 8.0.7
Oracle ≫ Flexcube Core Banking Version 11.7.0
Oracle ≫ Flexcube Core Banking Version 11.8.0
Oracle ≫ Flexcube Core Banking Version 11.9.0
Oracle ≫ Flexcube Core Banking Version 11.10.0
Oracle ≫ Flexcube Private Banking Version 12.0.0
Oracle ≫ Flexcube Private Banking Version 12.1.0
Oracle ≫ Hospitality Guest Access Version 4.2.0
Oracle ≫ Hospitality Guest Access Version 4.2.1
Oracle ≫ Internet Directory Version 12.2.1.3.0
Oracle ≫ Internet Directory Version 12.2.1.4.0
Oracle ≫ Knowledge Version >= 8.6.0 <= 8.6.3
Oracle ≫ Primavera Gateway Version 16.2.11
Oracle ≫ Primavera Gateway Version 17.12.6
Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12
Oracle ≫ Primavera Unifier Version 16.1
Oracle ≫ Primavera Unifier Version 16.2
Oracle ≫ Primavera Unifier Version 18.8
Oracle ≫ Primavera Unifier Version 19.12
Oracle ≫ Rapid Planning Version 12.1
Oracle ≫ Rapid Planning Version 12.2
Oracle ≫ Real-time Decision Server Version 3.2.1.0
Oracle ≫ Retail Order Broker Version 15.0
Oracle ≫ Retail Order Broker Version 16.0
Oracle ≫ Retail Order Broker Version 18.0
Oracle ≫ Secure Global Desktop Version 5.4
Oracle ≫ Secure Global Desktop Version 5.5
Oracle ≫ Siebel Ui Framework Version <= 21.0
Oracle ≫ Tuxedo Version 12.1.1.0.0
Oracle ≫ Tuxedo Version 12.1.3
Oracle ≫ Webcenter Portal Version 12.2.1.3.0
Debian ≫ Debian Linux Version 9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.55% 0.952
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.oracle.com/security-alerts/cpujan2020.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E
https://issues.apache.org/jira/browse/AXIS-2924
Patch
Vendor Advisory
Issue Tracking
https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E
https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/11/msg00015.html
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20240621-0006/