Oracle

Weblogic Server

309 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2022-23457

Exploit
  • EPSS 0.64%
  • Veröffentlicht 25.04.2022 20:15:41
  • Zuletzt bearbeitet 03.11.2025 20:15:52

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat...

6.1

CVE-2022-29577

  • EPSS 0.24%
  • Veröffentlicht 21.04.2022 23:15:10
  • Zuletzt bearbeitet 21.11.2024 06:59:20

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix ...

5.8

CVE-2022-21453

  • EPSS 1.12%
  • Veröffentlicht 19.04.2022 21:15:16
  • Zuletzt bearbeitet 21.11.2024 06:44:44

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker wit...

5

CVE-2022-21441

  • EPSS 1.89%
  • Veröffentlicht 19.04.2022 21:15:15
  • Zuletzt bearbeitet 21.11.2024 06:44:42

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with n...

7.5

CVE-2022-24839

  • EPSS 0.45%
  • Veröffentlicht 11.04.2022 22:15:07
  • Zuletzt bearbeitet 21.11.2024 06:51:12

org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. ...

9.8

CVE-2022-22965

Warnung Exploit
  • EPSS 94.43%
  • Veröffentlicht 01.04.2022 23:15:13
  • Zuletzt bearbeitet 30.10.2025 19:56:43

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Sp...

7.5

CVE-2020-36518

Exploit
  • EPSS 0.47%
  • Veröffentlicht 11.03.2022 07:15:07
  • Zuletzt bearbeitet 27.08.2025 21:15:36

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

7.1

CVE-2022-23437

  • EPSS 0.09%
  • Veröffentlicht 24.01.2022 15:15:09
  • Zuletzt bearbeitet 21.11.2024 06:48:33

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolon...

5

CVE-2022-21371

Exploit
  • EPSS 93.42%
  • Veröffentlicht 19.01.2022 12:15:16
  • Zuletzt bearbeitet 21.11.2024 06:44:32

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenti...

5.8

CVE-2022-21386

  • EPSS 0.6%
  • Veröffentlicht 19.01.2022 12:15:16
  • Zuletzt bearbeitet 21.11.2024 06:44:34

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenti...