|
CVE-2013-5573
|
Medium
|
2013-12-31
|
Mitigation candidate
|
Working exploit published
|
Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.
|
|
CVE-2013-4452
|
Low
|
2013-12-24
|
No fix identified
|
No public exploit
|
Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows local users to obtain authentication credentials and other unspecified sensitive information by reading these files.
|
|
CVE-2013-4424
|
Medium
|
2013-12-23
|
No fix identified
|
No public exploit
|
Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
|
CVE-2013-5676
|
Medium
|
2013-12-13
|
Mitigation candidate
|
Working exploit published
|
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
|
|
CVE-2013-5763
|
Low
|
2013-12-12
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Maintenance. NOTE: the original disclosure of this issue erroneously mapped it to CVE-2013-3624.
|
|
CVE-2013-6408
|
Medium
|
2013-12-07
|
Protected by RASP
|
No public exploit
|
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
|
|
CVE-2013-6407
|
Medium
|
2013-12-07
|
Protected by RASP
|
No public exploit
|
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
|
|
CVE-2013-6397
|
Medium
|
2013-12-07
|
Protected by RASP
|
Forecast only
|
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
|
|
CVE-2012-6612
|
High
|
2013-12-07
|
Protected by RASP
|
No public exploit
|
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
|
|
CVE-2013-2133
|
Medium
|
2013-12-06
|
No fix identified
|
No public exploit
|
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.
|
|
CVE-2013-6374
|
Low
|
2013-11-25
|
No exploit published
|
No public exploit
|
Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
|
|
CVE-2013-6373
|
Medium
|
2013-11-25
|
No exploit published
|
No public exploit
|
The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.
|
|
CVE-2013-5458
|
High
|
2013-11-24
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6 allows remote attackers to execute arbitrary code via unspecified vectors.
|
|
CVE-2013-5457
|
High
|
2013-11-24
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to execute arbitrary code via unspecified vectors.
|
|
CVE-2013-5456
|
High
|
2013-11-24
|
No fix identified
|
No public exploit
|
The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.
|
|
CVE-2013-5418
|
Low
|
2013-11-18
|
No fix identified
|
No public exploit
|
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
|
|
CVE-2013-5417
|
Medium
|
2013-11-18
|
No fix identified
|
No public exploit
|
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote attackers to inject arbitrary web script or HTML via HTTP response data.
|
|
CVE-2013-5414
|
Low
|
2013-11-18
|
No fix identified
|
No public exploit
|
The migration functionality in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 does not properly support the distinction between the admin role and the adminsecmanager role, which allows remote authenticated users to gain privileges in opportunistic circumstances by accessing resources in between a migration and a role evaluation.
|
|
CVE-2013-4204
|
Medium
|
2013-11-18
|
No exploit published
|
No public exploit
|
Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
|
CVE-2013-4006
|
Medium
|
2013-11-18
|
No fix identified
|
No public exploit
|
IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations.
|
|
CVE-2013-6357
|
Medium
|
2013-11-13
|
Mitigation candidate
|
Working exploit published
|
Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.
|
|
CVE-2013-6348
|
Medium
|
2013-11-02
|
No exploit published
|
No public exploit
|
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
|
|
CVE-2013-2186
|
High
|
2013-10-28
|
Protected by RASP
|
Proof of concept only
|
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
|
|
CVE-2013-2102
|
Low
|
2013-10-28
|
No exploit published
|
No public exploit
|
The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.
|
|
CVE-2012-4572
|
Low
|
2013-10-28
|
No fix identified
|
No public exploit
|
Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.
|
|
CVE-2012-4529
|
Medium
|
2013-10-28
|
No fix identified
|
No public exploit
|
The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.
|
|
CVE-2013-4390
|
Medium
|
2013-10-24
|
No exploit published
|
No public exploit
|
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
|
|
CVE-2013-4373
|
Low
|
2013-10-24
|
No exploit published
|
No public exploit
|
The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files.
|
|
CVE-2013-4295
|
Medium
|
2013-10-24
|
Protected by RASP
|
Working exploit published
|
The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
|
|
CVE-2013-4293
|
Low
|
2013-10-24
|
No exploit published
|
No public exploit
|
The server in Red Hat JBoss Operations Network (JON) 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files.
|
|
CVE-2013-2254
|
Medium
|
2013-10-17
|
No exploit published
|
No public exploit
|
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
|
|
CVE-2013-5867
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via vectors related to SISNAPI & Network Infrastructure.
|
|
CVE-2013-5859
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Instantis EnterpriseTrack component in Oracle Primavera Products Suite 8.0.6 and 8.5 allows remote attackers to affect confidentiality via unknown vectors.
|
|
CVE-2013-5857
|
Low
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Health Sciences InForm component in Oracle Industry Applications 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1, and 5.0 SP1a-b allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Web.
|
|
CVE-2013-5856
|
Low
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Health Sciences InForm component in Oracle Industry Applications 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1, 5.0 SP1a-b, 5.5 SP0, 5.5 SP0b, 5.5.1, and 6.0.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Web.
|
|
CVE-2013-5854
|
Low
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality via unknown vectors.
|
|
CVE-2013-5851
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to JAXP.
|
|
CVE-2013-5850
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-5842.
|
|
CVE-2013-5849
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to AWT.
|
|
CVE-2013-5847
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise HRMS eCompensation component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to eCompensation.
|
|
CVE-2013-5845
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 5.2.1 and 6.0 allows remote attackers to affect integrity via unknown vectors related to Learner Administration.
|
|
CVE-2013-5843
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JavaFX 2.2.40 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
|
|
CVE-2013-5842
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-5850.
|
|
CVE-2013-5841
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Portal, a different vulnerability than CVE-2013-5794.
|
|
CVE-2013-5840
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
|
|
CVE-2013-5838
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u25 and earlier, and Java SE Embedded 7u25 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
|
|
CVE-2013-5837
|
Low
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Health Sciences InForm component in Oracle Industry Applications 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1, 5.0 SP1a-b, 5.0.3, and 5.0.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Cognos.
|
|
CVE-2013-5836
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Business Interlink.
|
|
CVE-2013-5835
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Open_UI.
|
|
CVE-2013-5830
|
High
|
2013-10-16
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
|
|
CVE-2013-5829
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-5809.
|
|
CVE-2013-5828
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2 and 12.1.0.3 allows remote attackers to affect integrity via unknown vectors related to Storage Management.
|
|
CVE-2013-5827
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Storage Management.
|
|
CVE-2013-5826
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3 and 6.3.1 allows remote attackers to affect availability via unknown vectors related to Install / Installation.
|
|
CVE-2013-5825
|
Medium
|
2013-10-16
|
Mitigation candidate
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JAXP.
|
|
CVE-2013-5823
|
Medium
|
2013-10-16
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via unknown vectors related to Security.
|
|
CVE-2013-5822
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 5.2.1 and 6.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Learner Administration.
|
|
CVE-2013-5820
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via vectors related to JAX-WS.
|
|
CVE-2013-5817
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI.
|
|
CVE-2013-5816
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2 allows remote attackers to affect availability via unknown vectors related to Metro.
|
|
CVE-2013-5815
|
High
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Identity Analytics component in Oracle Fusion Middleware Oracle Identity Analytics 11.1.1.5 and Sun Role Manager 4.1 and 5.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.
|
|
CVE-2013-5814
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.
|
|
CVE-2013-5813
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1, 11.1.1.6.0, 11.1.1.7.0, and 11.1.1.8.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Content Server.
|
|
CVE-2013-5811
|
Low
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Health Sciences InForm component in Oracle Industry Applications 4.5 SP3, 4.5 SP3a-k, 4.6 SP0, 4.6 SP0a-c, 4.6 SP1, 4.6 SP1a-c, 4.6 SP2, 4.6 SP2a-c, 5.0 SP0, 5.0 SP0a, 5.0 SP1, and 5.0 SP1a-b allows remote authenticated users to affect confidentiality via unknown vectors related to Web.
|
|
CVE-2013-5810
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
|
|
CVE-2013-5809
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-5829.
|
|
CVE-2013-5806
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing, a different vulnerability than CVE-2013-5805.
|
|
CVE-2013-5805
|
High
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing, a different vulnerability than CVE-2013-5806.
|
|
CVE-2013-5804
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, and JRockit R27.7.6 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Javadoc.
|
|
CVE-2013-5802
|
High
|
2013-10-16
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP.
|
|
CVE-2013-5801
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D.
|
|
CVE-2013-5800
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to JGSS.
|
|
CVE-2013-5799
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.2 allows remote attackers to affect integrity via unknown vectors related to Security.
|
|
CVE-2013-5798
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.2.0.0 and 11.1.2.1.0 allows remote attackers to affect integrity via unknown vectors related to End User Self Service.
|
|
CVE-2013-5797
|
Low
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and JavaFX 2.2.40 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.
|
|
CVE-2013-5796
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via unknown vectors related to Web Services.
|
|
CVE-2013-5794
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Portal, a different vulnerability than CVE-2013-5841.
|
|
CVE-2013-5792
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Techstack component in Oracle E-Business Suite 12.1 allows remote attackers to affect confidentiality via unknown vectors related to Apache.
|
|
CVE-2013-5791
|
Low
|
2013-10-16
|
Mitigation candidate
|
Working exploit published
|
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.4.1 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters. NOTE: the previous information is from the October 2013 CPU. Oracle has not commented on claims from a third party that the issue is a stack-based buffer overflow in the Microsoft Access 1.x parser in vsacs.dll before 8.4.0.108 and before 8.4.1.52, which allows attackers to execute arbitrary code via a long field (aka column) name.
|
|
CVE-2013-5790
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to BEANS.
|
|
CVE-2013-5784
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via vectors related to SCRIPTING.
|
|
CVE-2013-5783
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Swing.
|
|
CVE-2013-5782
|
High
|
2013-10-16
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
|
|
CVE-2013-5780
|
Medium
|
2013-10-16
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
|
|
CVE-2013-5779
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote authenticated users to affect confidentiality via vectors related to PIA Core Technology.
|
|
CVE-2013-5778
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D.
|
|
CVE-2013-5774
|
Medium
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.
|
|
CVE-2013-5773
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5.0 allows remote attackers to affect integrity via unknown vectors related to Servlet Runtime.
|
|
CVE-2013-5772
|
Low
|
2013-10-16
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u40 and earlier and Java SE 6u60 and earlier allows remote attackers to affect integrity via unknown vectors related to jhat.
|
|
CVE-2013-5769
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 allows remote authenticated users to affect availability via unknown vectors related to Web Services.
|
|
CVE-2013-5768
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to ActiveX Controls.
|
|
CVE-2013-5766
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2 and 12.1.0.3 allows remote attackers to affect integrity via unknown vectors related to DB Performance Advisories/UIs.
|
|
CVE-2013-5765
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect availability via vectors related to XML Publisher.
|
|
CVE-2013-5762
|
Low
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Siebel CTMS component in Oracle Industry Applications 8.1.1.x allows local users to affect confidentiality and availability via unknown vectors related to SC-OC Integration.
|
|
CVE-2013-5761
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Integration - Scripting.
|
|
CVE-2013-3841
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Web Services.
|
|
CVE-2013-3840
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Services.
|
|
CVE-2013-3836
|
Low
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Web Cache component in Oracle Fusion Middleware 11.1.1.6 and 11.1.1.7 allows remote authenticated users to affect confidentiality via vectors related to ESI/Partial Page Caching.
|
|
CVE-2013-3835
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker.
|
|
CVE-2013-3833
|
Medium
|
2013-10-16
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5.0 and 11.1.2.0.0 allows remote attackers to affect integrity via unknown vectors related to Authentication Engine.
|
VRT
391,192 CVEs tracked ·
15,442 in RASP scope ·
data as of 16 hours ago