CVE-2020-11022 jQuery
| Affected software | jQuery |
|---|---|
| Severity | 6.9 Medium CVSS 3.1 3 scores |
| Weakness | Cross-site scripting (CWE-79) |
| Published | 29 Apr 2020 |
| Updated | 2 Nov 2026 |
Description
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 2 citations · 2 exploits · earliest 2021-01-21.
- CISA Vulnrichment exploitation: none
- Indexed PoC 4 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC; first seen 2021-04-14.
- EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-11022 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | tenable.com | /blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts | 2021-01-21 |
| Reported exploitation | securin.io | /wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf | 2023-08-08 |
| Exploit reference | VulnCheck XDB fd3d077b394f | Exploit type: initial-access | 2020-11-02 |
| Exploit reference | VulnCheck XDB 3e25a29756c9 | Exploit type: client-side | 2021-10-16 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Little thing put together quickly to demonstrate this CVE | 34 | 2021-10-16 |
| GitHub PoC | Vulnearability Report of the New Jersey official site | 1 | 2022-05-23 |
| GitHub PoC | Домашняя работа по Pyton № 10 CVE-2020-11022 Краткое описание CVE-2020-11022 — уязвимость типа Reflected XSS (межсайтовый скриптинг), связанная с некорректной обработкой пользовательского ввода, который отражается в HTML-ответе без экранирования. Атакующий может внедрить JavaScript-код, который выполнится в браузере пользователя. | 2026-02-14 | |
| Exploit-DB | jQuery 1.2 - Cross-Site Scripting (XSS) | 2021-04-14 |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
6.9 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
3 metrics
CVSS
6.9 MEDIUM v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
security-advisories@github.com | Secondary | published |
| CVSS 3.1 | 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
NVD | Primary | |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:N/I:P/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2024 ↗ | CPU | 2024-Q4 | Oracle Utilities Applications / General (jQuery) (4.0.0.0.0, 4.0.0.2.0, 4.0.0.3.0, 4.3.0.3.0-4.3.0.6.0, 4.5.0.0.0) |
| Oracle Critical Patch Update October 2023 ↗ | CPU | 2023-Q4 | Oracle Analytics / Mobile Service (jQuery) (12.2.1.4.0) |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle Communications / Platform (HTTP) (12.4.0) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Supply Chain / Security (jQuery) (9.3.6) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Blockchain Platform / Backend (jQuery) (Prior to 21.1.2) Oracle Systems / Software (jQuery) (8.5.1) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications / API Portal (jQuery) (7.0) Oracle Communications / Platform (jQuery) (16.1-16.4) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Fusion Middleware / Web Services (jQuery) (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle Health Sciences Applications / UI (jQuery) (6.2.0, 6.3.0) Oracle Hospitality Applications / Next-Gen SPMS (jQuery) (20.1.0) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Financial Services Applications / Dashboards (jQuery) (2.7.0, 2.8.0) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Commerce / Business Control Center (jQuery) (11.3.0, 11.3.1, 11.3.2) Oracle Commerce / Workbench, Experience Manager (jQuery) (11.3.0, 11.3.1, 11.3.2) Oracle Construction and Engineering / Core UI (jQuery) (16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12) Oracle Fusion Middleware / BI Platform Security (jQuery) (5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / Install (jQuery) (12.2.1.4.0) Oracle JD Edwards / Web Runtime (jQuery) (Prior to 9.2.5.0) Oracle PeopleSoft / Common Objects (jQuery) (9.2) Oracle PeopleSoft / Expenses (jQuery) (9.2) Oracle PeopleSoft / Manage Requisition Status (jQuery) (9.2) Oracle PeopleSoft / Purchasing (jQuery) (9.2) Oracle PeopleSoft / Weblogic (jQuery) (8.56, 8.57, 8.58) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Enterprise Manager / Load Testing for Web Apps (jQuery) (13.3.0.1) Oracle Fusion Middleware / Sample apps (jQuery) (12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle Fusion Middleware / WebCenter Sites (jQuery) (12.2.1.3.0, 12.2.1.4.0) Oracle Hyperion / Installation (jQuery) (11.1.2.4) Oracle's note: This CVE is not exploitable in Hyperion Financial Reporting. The CVSS v3.1 Base Score for this CVE in the National Vulnerability Database (NVD) is 6.1. jQuery is removed from Hyperion Financial Reporting with the January 2021 Critical Patch Update. Oracle JD Edwards / E1 Dev Platform Tech - Cloud (jQuery) (Prior to 9.2.5.0) Oracle JD Edwards / E1 IOT Orchestrator Security (jQuery) (Prior to 9.2.5.0) Oracle JD Edwards / Web Runtime (jQuery) (Prior to 9.2.5.0) Oracle PeopleSoft / Company Dir / Org Chart Viewer, Employee Snapshot (jQuery) (9.2) Oracle Siebel CRM / Open UI (jQuery) (20.12 and prior) Oracle Systems / Software (jQuery) (2.3.1) |
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Communications / Core (jQuery) (3.8m0) Oracle Communications / Core (jQuery) (8.4) Oracle Communications / IDIH (jQuery) (IDIH: 8.0.0-8.2.2) Oracle Communications / ME (jQuery) (7.2) Oracle Communications Applications / Billing Operation Center and Oracle Communication Billing Care (jQuery) (7.5.0.23.0, 12.0.0.3.0) Oracle Enterprise Manager / Reports in Ops Center (jQuery) (12.4.0.0) Oracle Financial Services Applications / Framework (jQuery) (18.1, 18.2, 18.3, 19.1, 19.2, 20.1) Oracle Financial Services Applications / IFRS17 (jQuery) (8.0.9) Oracle Financial Services Applications / Infrastructure (jQuery) (8.0.6, 8.0.8) Oracle Financial Services Applications / Infrastructure (jQuery) (8.0.6-8.1.0) Oracle Financial Services Applications / Infrastructure (jQuery) (8.0.6-8.1.0) Oracle Financial Services Applications / Infrastructure (jQuery) (8.0.6-8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6, 8.0.7) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6, 8.0.7, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6, 8.0.7, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6, 8.0.7, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6, 8.0.7, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6, 8.0.7, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6-8.0.8, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6-8.0.8, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6-8.0.8, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6-8.0.8, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6-8.0.8, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6-8.0.9) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6-8.0.9) Oracle Financial Services Applications / User Interface (jQuery) (8.0.6-8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.7, 8.0.8, 8.1.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.8) Oracle Financial Services Applications / User Interface (jQuery) (8.0.8, 8.1.0) Oracle Food and Beverage Applications / Mobile Authorization (jQuery) (18.1) Oracle Food and Beverage Applications / Simphony Apps (jQuery) (18.1, 18.2, 19.1.0-19.1.2) Oracle Fusion Middleware / ADF Faces (jQuery) (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / Console (jQuery) (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle Health Sciences Applications / Admin Console (jQuery) (7.1.1, 7.2.0, 7.2.1, 7.3.0) Oracle Insurance Applications / Framework Administrator IBFA (jQuery) (5.0.0.0 - 5.6.0.0, 5.6.1.0) Oracle PeopleSoft / PIA Core Technology (jQuery) (8.56, 8.57, 8.58) Oracle PeopleSoft / Portal, Charting (jQuery) (8.56, 8.57, 8.58) Oracle Policy Automation / Core (jQuery) (10.4.6) Oracle Policy Automation / Core (jQuery) (12.2.0 - 12.2.20) Oracle Policy Automation / Core (jQuery) (12.2.0 - 12.2.20) Oracle Retail Applications / Security (jQuery) (14.0, 14.1) Oracle Retail Applications / Security (jQuery) (14.0, 14.1) Oracle Retail Applications / Security (jQuery) (14.0, 14.1) Oracle Retail Applications / Segments (jQuery) (19.0) Oracle Siebel CRM / UIF Open UI (jQuery) (20.8) Oracle Supply Chain / Supplier Portal (jQuery) (6.2.0.0) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Communications Applications / Dashboard (jQuery) (6.1-6.4) Oracle Communications Applications / Mediation Engine, Dashboard, Grapahs, Calls (jQuery) (3.4, 4.1-4.3) Oracle Communications Applications / Platform (jQuery) (12.1.1) Oracle Communications Applications / User Interface (jQuery) (8.1.1, 8.2.0, 8.2.1) Oracle Communications Applications / User Interface (jQuery) (8.1.1, 8.2.0, 8.2.1) Oracle Communications Applications / User Interface (jQuery) (8.1.1, 8.2.0, 8.2.1) Oracle Construction and Engineering / Admin (jQuery) (16.2.0-16.2.11, 17.12.0-17.12.7, 18.8.0-18.8.9, 19.12.0-19.12.4) Oracle Financial Services Applications / User Interface (jQuery) (2.4.0-2.10.0) Oracle Financial Services Applications / User Interface (jQuery) (2.7.0-2.8.0) Oracle Financial Services Applications / User Interface (jQuery) (8.0.4) Oracle Health Sciences Applications / Cohort Explorer (jQuery) (3.2.1, 3.3.1, 3.3.2, 3.4.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Mobile Service (jQuery) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Blockchain Platform | Backend (jQuery) | Prior to 21.1.2 | |
| Oracle Commerce | Business Control Center (jQuery) | 11.3.0, 11.3.1, 11.3.2 | 11.3.0 · 11.3.1 · 11.3.2 |
| Oracle Commerce | Workbench, Experience Manager (jQuery) | 11.3.0, 11.3.1, 11.3.2 | 11.3.0 · 11.3.1 · 11.3.2 |
| Oracle Communications | API Portal (jQuery) | 7.0 | 7.0 |
| Oracle Communications | Core (jQuery) | 3.8m0 | 3.8.0 · 8.4 |
| Oracle Communications | IDIH (jQuery) | IDIH: 8.0.0-8.2.2 | |
| Oracle Communications | ME (jQuery) | 7.2 | 7.2 |
| Oracle Communications | Platform (HTTP) | 12.4.0 | 12.4.0 |
| Oracle Communications | Platform (jQuery) | 16.1-16.4 | |
| Oracle Communications Applications | Billing Operation Center and Oracle Communication Billing Care (jQuery) | 7.5.0.23.0, 12.0.0.3.0 | 7.5.0.23.0 · 12.0.0.3.0 |
| Oracle Communications Applications | Dashboard (jQuery) | 6.1-6.4 | |
| Oracle Communications Applications | Mediation Engine, Dashboard, Grapahs, Calls (jQuery) | 3.4, 4.1-4.3 | 3.4 |
| Oracle Communications Applications | Platform (jQuery) | 12.1.1 | 12.1.1 |
| Oracle Communications Applications | User Interface (jQuery) | 8.1.1, 8.2.0, 8.2.1 | 8.1.1 · 8.2.0 · 8.2.1 |
| Oracle Construction and Engineering | Admin (jQuery) | 16.2.0-16.2.11, 17.12.0-17.12.7, 18.8.0-18.8.9, 19.12.0-19.12.4 | |
| Oracle Construction and Engineering | Core UI (jQuery) | 16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12 | 16.1 · 16.2 · 18.8 · 19.12 · 20.12 |
| Oracle Enterprise Manager | Load Testing for Web Apps (jQuery) | 13.3.0.1 | 13.3.0.1 |
| Oracle Enterprise Manager | Reports in Ops Center (jQuery) | 12.4.0.0 | 12.4.0.0 |
| Oracle Financial Services Applications | Dashboards (jQuery) | 2.7.0, 2.8.0 | 2.7.0 · 2.8.0 |
| Oracle Financial Services Applications | Framework (jQuery) | 18.1, 18.2, 18.3, 19.1, 19.2, 20.1 | 18.1 · 18.2 · 18.3 · 19.1 · 19.2 · 20.1 |
| Oracle Financial Services Applications | IFRS17 (jQuery) | 8.0.9 | 8.0.9 |
| Oracle Financial Services Applications | Infrastructure (jQuery) | 8.0.6-8.1.0 | 8.0.6 · 8.0.8 |
| Oracle Financial Services Applications | User Interface (jQuery) | 2.4.0-2.10.0 | 8.0.4 · 8.0.6 · 8.0.7 · 8.0.8 · 8.1.0 |
| Oracle Food and Beverage Applications | Mobile Authorization (jQuery) | 18.1 | 18.1 |
| Oracle Food and Beverage Applications | Simphony Apps (jQuery) | 18.1, 18.2, 19.1.0-19.1.2 | 18.1 · 18.2 |
| Oracle Fusion Middleware | ADF Faces (jQuery) | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | BI Platform Security (jQuery) | 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | 5.5.0.0.0 · 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Console (jQuery) | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Install (jQuery) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Sample apps (jQuery) | 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Web Services (jQuery) | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | WebCenter Sites (jQuery) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Health Sciences Applications | Admin Console (jQuery) | 7.1.1, 7.2.0, 7.2.1, 7.3.0 | 7.1.1 · 7.2.0 · 7.2.1 · 7.3.0 |
| Oracle Health Sciences Applications | Cohort Explorer (jQuery) | 3.2.1, 3.3.1, 3.3.2, 3.4.0 | 3.2.1 · 3.3.1 · 3.3.2 · 3.4.0 |
| Oracle Health Sciences Applications | UI (jQuery) | 6.2.0, 6.3.0 | 6.2.0 · 6.3.0 |
| Oracle Hospitality Applications | Next-Gen SPMS (jQuery) | 20.1.0 | 20.1.0 |
| Oracle Hyperion | Installation (jQuery) | 11.1.2.4 | 11.1.2.4 |
| Oracle Insurance Applications | Framework Administrator IBFA (jQuery) | 5.0.0.0 - 5.6.0.0, 5.6.1.0 | 5.6.1.0 |
| Oracle JD Edwards | E1 Dev Platform Tech - Cloud (jQuery) | Prior to 9.2.5.0 | |
| Oracle JD Edwards | E1 IOT Orchestrator Security (jQuery) | Prior to 9.2.5.0 | |
| Oracle JD Edwards | Web Runtime (jQuery) | Prior to 9.2.5.0 | |
| Oracle PeopleSoft | Common Objects (jQuery) | 9.2 | 9.2 |
| Oracle PeopleSoft | Company Dir / Org Chart Viewer, Employee Snapshot (jQuery) | 9.2 | 9.2 |
| Oracle PeopleSoft | Expenses (jQuery) | 9.2 | 9.2 |
| Oracle PeopleSoft | Manage Requisition Status (jQuery) | 9.2 | 9.2 |
| Oracle PeopleSoft | PIA Core Technology (jQuery) | 8.56, 8.57, 8.58 | 8.56 · 8.57 · 8.58 |
| Oracle PeopleSoft | Portal, Charting (jQuery) | 8.56, 8.57, 8.58 | 8.56 · 8.57 · 8.58 |
| Oracle PeopleSoft | Purchasing (jQuery) | 9.2 | 9.2 |
| Oracle PeopleSoft | Weblogic (jQuery) | 8.56, 8.57, 8.58 | 8.56 · 8.57 · 8.58 |
| Oracle Policy Automation | Core (jQuery) | 12.2.0 - 12.2.20 | 10.4.6 |
| Oracle Retail Applications | Security (jQuery) | 14.0, 14.1 | 14.0 · 14.1 |
| Oracle Retail Applications | Segments (jQuery) | 19.0 | 19.0 |
| Oracle Siebel CRM | Open UI (jQuery) | 20.12 and prior | |
| Oracle Siebel CRM | UIF Open UI (jQuery) | 20.8 | 20.8 |
| Oracle Supply Chain | Security (jQuery) | 9.3.6 | 9.3.6 |
| Oracle Supply Chain | Supplier Portal (jQuery) | 6.2.0.0 | 6.2.0.0 |
| Oracle Systems | Software (jQuery) | 2.3.1 | 2.3.1 · 8.5.1 |
| Oracle Utilities Applications | General (jQuery) | 4.0.0.0.0, 4.0.0.2.0, 4.0.0.3.0, 4.3.0.3.0-4.3.0.6.0, 4.5.0.0.0 | 4.0.0.0.0 · 4.0.0.2.0 · 4.0.0.3.0 · 4.5.0.0.0 |
Products and versions
70 products, 121 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | debian | debian linux | generic | 9.0 |
| nvd | drupal | drupal | generic | ≥ 7.0 and ＜ 7.70 · ≥ 8.7.0 and ＜ 8.7.14 · ≥ 8.8.0 and ＜ 8.8.6 |
| nvd | fedoraproject | fedora | generic | 31 · 32 · 33 |
| nvd | jquery | jquery | generic | ≥ 1.2 and ＜ 3.5.0 |
| nvd | netapp | h300e firmware | generic | any version |
| nvd | netapp | h300s firmware | generic | any version |
| nvd | netapp | h410c firmware | generic | any version |
| nvd | netapp | h410s firmware | generic | any version |
| nvd | netapp | h500e firmware | generic | any version |
| nvd | netapp | h500s firmware | generic | any version |
| nvd | netapp | h700e firmware | generic | any version |
| nvd | netapp | h700s firmware | generic | any version |
| nvd | netapp | max data | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | oncommand system manager | generic | ≥ 3.0 and ≤ 3.1.3 |
| nvd | netapp | snap creator framework | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | opensuse | leap | generic | 15.1 · 15.2 |
| nvd | oracle | agile product lifecycle management for process | generic | 6.2.0.0 |
| nvd | oracle | agile product supplier collaboration for process | generic | 6.2.0.0 |
| nvd | oracle | application testing suite | generic | 13.3.0.1 |
| nvd | oracle | banking digital experience | generic | 18.1 · ≥ 18.1 and ≤ 20.1 · 18.2 · 18.3 · 19.1 · 19.2 · 20.1 |
| nvd | oracle | blockchain platform | generic | ＜ 21.1.2 |
| nvd | oracle | communications application session controller | generic | 3.8m0 |
| nvd | oracle | communications billing and revenue management | generic | 7.5.0.23.0 · 12.0.0.3.0 |
| nvd | oracle | communications diameter signaling router idih\ | generic | ≥ 8.0.0 and ≤ 8.2.2 |
| nvd | oracle | communications eagle application processor | generic | ≥ 16.1.0 and ≤ 16.4.0 |
| nvd | oracle | communications services gatekeeper | generic | 7.0 |
| nvd | oracle | communications webrtc session controller | generic | 7.2 |
| nvd | oracle | enterprise manager ops center | generic | 12.4.0.0 |
| nvd | oracle | enterprise session border controller | generic | 8.4 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 8.0.6 and ≤ 8.1.0 · ≥ 8.0.6.0.0 and ≤ 8.1.0.0.0 |
| nvd | oracle | financial services analytical applications reconciliation framework | generic | ≥ 8.0.6 and ≤ 8.0.8 · 8.1.0 |
| nvd | oracle | financial services asset liability management | generic | 8.0.6 · 8.0.7 · 8.1.0 |
| nvd | oracle | financial services balance sheet planning | generic | 8.0.8 |
| nvd | oracle | financial services basel regulatory capital basic | generic | ≥ 8.0.6 and ≤ 8.0.8 · 8.1.0 |
| nvd | oracle | financial services basel regulatory capital internal ratings based approach | generic | ≥ 8.0.6 and ≤ 8.0.8 · 8.1.0 |
| nvd | oracle | financial services data foundation | generic | ≥ 8.0.6 and ≤ 8.1.0 |
| nvd | oracle | financial services data governance for us regulatory reporting | generic | ≥ 8.0.6 and ≤ 8.0.9 |
| nvd | oracle | financial services data integration hub | generic | 8.0.6 · 8.0.7 · 8.1.0 |
| nvd | oracle | financial services funds transfer pricing | generic | 8.0.6 · 8.0.7 · 8.1.0 |
| nvd | oracle | financial services hedge management and ifrs valuations | generic | ≥ 8.0.6 and ≤ 8.0.8 · 8.1.0 |
| nvd | oracle | financial services institutional performance analytics | generic | 8.0.6 · 8.0.7 · 8.1.0 |
| nvd | oracle | financial services liquidity risk management | generic | 8.0.6 |
| nvd | oracle | financial services liquidity risk measurement and management | generic | 8.0.7 · 8.0.8 · 8.1.0 |
| nvd | oracle | financial services loan loss forecasting and provisioning | generic | ≥ 8.0.6 and ≤ 8.0.8 · 8.1.0 |
| nvd | oracle | financial services market risk measurement and management | generic | 8.0.6 · 8.0.8 |
| nvd | oracle | financial services price creation and discovery | generic | 8.0.6 · 8.0.7 |
| nvd | oracle | financial services profitability management | generic | 8.0.6 · 8.0.7 · 8.1.0 |
| nvd | oracle | financial services regulatory reporting for european banking authority | generic | ≥ 8.0.6 and ≤ 8.1.0 |
| nvd | oracle | financial services regulatory reporting for us federal reserve | generic | ≥ 8.0.6 and ≤ 8.0.9 |
| nvd | oracle | healthcare foundation | generic | 7.1.1 · 7.2.0 · 7.2.1 · 7.3.0 |
| nvd | oracle | hospitality materials control | generic | 18.1 |
| nvd | oracle | hospitality simphony | generic | 18.1 · 18.2 · ≥ 19.1.0 and ≤ 19.1.2 · 19.1.0-19.1.2 |
| nvd | oracle | insurance accounting analyzer | generic | 8.0.9 |
| nvd | oracle | insurance allocation manager for enterprise profitability | generic | 8.0.8 · 8.1.0 |
| nvd | oracle | insurance data foundation | generic | ≥ 8.0.6 and ≤ 8.1.0 · 8.0.6-8.1.0 |
| nvd | oracle | insurance insbridge rating and underwriting | generic | ≥ 5.0.0.0 and ≤ 5.6.0.0 · 5.6.1.0 |
| nvd | oracle | jdeveloper | generic | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.56 · 8.57 · 8.58 |
| nvd | oracle | policy automation | generic | ≥ 12.2.0 and ≤ 12.2.20 |
| nvd | oracle | policy automation connector for siebel | generic | 10.4.6 |
| nvd | oracle | policy automation for mobile devices | generic | ≥ 12.2.0 and ≤ 12.2.20 |
| nvd | oracle | retail back office | generic | 14.0 · 14.1 |
| nvd | oracle | retail customer management and segmentation foundation | generic | 19.0 |
| nvd | oracle | retail returns management | generic | 14.0 · 14.1 |
| nvd | oracle | siebel ui framework | generic | 20.8 |
| nvd | oracle | storagetek acsls | generic | 8.5.1 |
| nvd | oracle | weblogic server | generic | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| nvd | tenable | log correlation engine | generic | ＜ 6.0.9 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** E1 DEV PLATFORM TECH - CLOUD (JQUERY), BI PLATFORM SECURITY (JQUERY), SOFTWARE (JQUERY), GRAPAHS, IFRS17 (JQUERY), SEE NOTE 2, UIF OPEN UI (JQUERY), CHARTING (JQUERY), COMMON OBJECTS (JQUERY), COMPANY DIR / ORG CHART VIEWER, DASHBOARD (JQUERY), FRAMEWORK ADMINISTRATOR IBFA (JQUERY), HTTP, DASHBOARD, WEB RUNTIME (JQUERY), CALLS (JQUERY), INSTALL (JQUERY), PIA CORE TECHNOLOGY (JQUERY), CONSOLE (JQUERY), MOBILE AUTHORIZATION (JQUERY), OPEN UI (JQUERY), ADF FACES (JQUERY), WORKBENCH, CORE (JQUERY), E1 IOT ORCHESTRATOR SECURITY (JQUERY), EXPERIENCE MANAGER (JQUERY), ME (JQUERY), SEGMENTS (JQUERY), COHORT EXPLORER (JQUERY), MANAGE REQUISITION STATUS (JQUERY), LOAD TESTING FOR WEB APPS (JQUERY), NO AUTH REMOTE EXPLOIT, PURCHASING (JQUERY), SECURITY (JQUERY), WEBLOGIC (JQUERY), SAMPLE APPS (JQUERY), CORE UI (JQUERY), BUSINESS CONTROL CENTER (JQUERY), WEBCENTER SITES (JQUERY), EMPLOYEE SNAPSHOT (JQUERY), MEDIATION ENGINE, INFRASTRUCTURE (JQUERY), EXPENSES (JQUERY), SUPPLIER PORTAL (JQUERY), PLATFORM (JQUERY), BILLING OPERATION CENTER AND ORACLE COMMUNICATION BILLING CARE (JQUERY), DASHBOARDS (JQUERY), ADMIN (JQUERY), SIMPHONY APPS (JQUERY), FRAMEWORK (JQUERY), ADMIN CONSOLE (JQUERY), PORTAL, REPORTS IN OPS CENTER (JQUERY), INSTALLATION (JQUERY), IDIH (JQUERY), USER INTERFACE (JQUERY), WEB SERVICES (JQUERY), UI (JQUERY), NEXT-GEN SPMS (JQUERY), API PORTAL (JQUERY) **Products:** ORACLE FOOD AND BEVERAGE APPLICATIONS, ORACLE ENTERPRISE MANAGER, ORACLE FUSION MIDDLEWARE, ORACLE SIEBEL CRM, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE COMMUNICATIONS, ORACLE SYSTEMS, ORACLE POLICY AUTOMATION, ORACLE PEOPLESOFT, ORACLE RETAIL APPLICATIONS, ORACLE SUPPLY CHAIN, JQUERY, ORACLE HYPERION, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE JD EDWARDS, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE INSURANCE APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE WEBLOGIC SERVER, ORACLE HEALTH SCIENCES CENTRAL CODING, ORACLE HOSPITALITY APPLICATIONS, ORACLE HOSPITALITY CRUISE SHIPBOARD PROPERTY MANAGEMENT SYSTEM, ORACLE COMMUNICATIONS EAGLE APPLICATION PROCESSOR, ORACLE COMMUNICATIONS SERVICES GATEKEEPER
References
Timeline
Timeline
| Published | 2020-04-29 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2021-01-21 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2023-08-08 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-11-02 | NVD's own last-modified date for this record. |