VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 20 hours ago
Reset
More filters (1)
Columns
Oracle product: Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Santuario XML Security For Java)✕
Overview 2 matches, all in RASP scope · 0 protected · 0 KEV · 0 public PoC · 0 CISA SSVC · 0 EPSS ≥ 0.5 · 0 disputed
2matches, all in RASP scope 0protected0.0% 0KEV0.0% 0public PoC0.0% 0CISA SSVC0.0% 0EPSS ≥ 0.50.0% 0disputed0.0%
Critical 0 0.0% High 1 50.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 50.0% No exploit published 0 0.0% No fix identified 1 50.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%
split by peak 1 / quarter
Unknown: 0None: 0Low: 0Medium: 1High: 1Critical: 0 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 1No exploit published: 0Mitigation candidate: 1Rule in development: 0Protected by RASP: 0 unrecorded: 0not established: 0not blocked: 2blocked by ARMR today: 0 No public exploit: 2Forecast only: 0Proof of concept only: 0Working exploit published: 0Exploited in the wild: 0 Q3 2021: 1 CVE Q4 2021: 0 CVEs Q1 2022: 0 CVEs Q2 2022: 0 CVEs Q3 2022: 0 CVEs Q4 2022: 0 CVEs Q1 2023: 0 CVEs Q2 2023: 0 CVEs Q3 2023: 0 CVEs Q4 2023: 1 CVE
Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22Q1 23Q2 23Q3 23Q4 23
2 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2023-44483 Medium 2023-10-20 No fix identified No public exploit All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.
CVE-2021-40690 High 2021-09-19 Mitigation candidate No public exploit All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.