WaratekVRT Sign in

Oracle Fusion Middleware Install (Apache Batik) CVEs

6 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Oracle product: Oracle Fusion Middleware / Install (Apache Batik)✕
Overview 6 matches · 2 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
6matches 2protected33.3% 0exploited0.0% 0CISA KEV0.0% 1public PoC16.7% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 33.3% Rule in development 0 0.0% Mitigation candidate 1 16.7% No exploit published 3 50.0%
Critical 1 16.7% High 5 83.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 33.3% partly blocked 0 0.0% not blocked 4 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 5 83.3%
split by peak 2 / quarter
No exploit published: 3Mitigation candidate: 1Protected by Waratek: 2 High: 5Critical: 1 not blocked: 4blocked by ARMR today: 2 No public exploit: 5Proof of concept only: 1
Q2 181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q1 211 No exploit published1 High1 not blocked1 No public exploit1 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 221 Mitigation candidate1 High1 not blocked1 Proof of concept only1 Q4 222 No exploit published2 High2 not blocked2 No public exploit2
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-42890 High 2022-10-25 No exploit published No public exploit A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
CVE-2022-41704 High 2022-10-25 No exploit published No public exploit A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
CVE-2022-40146 High 2022-09-22 Mitigation candidate Proof of concept only Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.
CVE-2020-11987 High 2021-02-24 No exploit published No public exploit Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2019-17566 High 2020-11-12 Protected by Waratek No public exploit Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2018-8013 Critical 2018-05-24 Protected by Waratek No public exploit In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.