Skip to content
Noroxi

oracle records

12,967 published records for vendor oracle.

Researcher profile

Entered KEV
84 · 0.6%
Weaponized
174 · 1.3%
Pre-auth RCE
269
With a fix record
22.9%
Median publish → KEV
1551 days

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

10,000+ records
  • CVE-2017-5638
    99Now

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mes

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · strutsMar 10, 2017

  • CVE-2017-9841
    99Now

    Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST da

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    phpunit project · phpunitJun 27, 2017

  • CVE-2014-6271
    99Now

    GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attac

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    gnu · bashSep 24, 2014

  • CVE-2013-2251
    99Now

    Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · archivaJul 19, 2013

  • CVE-2020-14882
    99Now

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    oracle · weblogic serverOct 21, 2020

  • CVE-2021-41773
    99Now

    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · http serverOct 5, 2021

  • CVE-2021-42013
    99Now

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · http serverOct 7, 2021

  • CVE-2019-2725
    99Now

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    oracle · agile product lifecycle managementApr 26, 2019

  • CVE-2018-2628
    99Now

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    oracle · weblogic serverApr 18, 2018

  • CVE-2014-7169
    99Now

    GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variabl

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    gnu · bashSep 24, 2014

  • CVE-2022-22963
    99Now

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    vmware · spring cloud functionApr 1, 2022

  • CVE-2025-61882
    99Now

    Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    oracle · concurrent processingOct 5, 2025

  • CVE-2017-1000353
    99Now

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    jenkins · jenkinsJan 29, 2018

  • CVE-2022-22965
    99Now

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    vmware · spring frameworkApr 1, 2022

  • CVE-2020-1938
    99Now

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · geodeFeb 24, 2020

  • CVE-2020-14750
    99Now

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    oracle · weblogic serverNov 2, 2020

  • CVE-2013-2465
    99Now

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    oracle · jreJun 18, 2013

  • CVE-2012-4681
    99Now

    Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    oracle · jdkAug 27, 2012

  • CVE-2022-21587
    99Now

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    oracle · e-business suiteOct 18, 2022

  • CVE-2022-22947
    99Now

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuat

    CriticalCVSS 10.0KEVWeaponizedEPSS 98%

    vmware · spring cloud gatewayMar 3, 2022

  • CVE-2012-0507
    98Now

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier,

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    oracle · jreJun 7, 2012

  • CVE-2020-2555
    98Now

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation).

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    oracle · access managerJan 15, 2020

  • CVE-2013-0422
    98Now

    Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBean

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    oracle · jdkJan 10, 2013

  • CVE-2018-1273
    98Now

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilit

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    broadcom · spring data commonsApr 11, 2018

  • CVE-2011-3544
    98Now

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remot

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    oracle · jdkOct 19, 2011