WaratekVRT Sign in

Oracle Critical Patch Update October 2018

Released October 2018 · Oracle's advisory ↗ · ← Critical Patch Update, July 2018 · Critical Patch Update, January 2019 →

226 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update October 2018, one square per CVE: 105 Java CVEs, 22 protected by Waratek, 4 exploited, 121 other CVEs in this release.

Download the image

By status

22Protected by Waratek2Mitigation candidate81No exploit published46Outside Waratek scope75Not applicable 4Exploited, marked by the ring

No exploit published. For 81 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters (1)
Columns
Published from 2016-04-01✕
Overview 104 matches · 21 protected · 2 exploited · 1 CISA KEV · 8 public PoC · 6 EPSS ≥ 0.5
104matches 21protected20.2% 2exploited1.9% 1CISA KEV1.0% 8public PoC7.7% 6EPSS ≥ 0.55.8%
Protected by Waratek 21 20.2% Rule in development 0 0.0% Mitigation candidate 2 1.9% No exploit published 81 77.9%
Critical 15 14.4% High 32 30.8% Medium 55 52.9% Low 2 1.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 21 20.2% partly blocked 0 0.0% not blocked 83 79.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 1.9% Working exploit published 4 3.8% Proof of concept only 2 1.9% Forecast only 1 1.0% No public exploit 95 91.3%
split by peak 89 / quarter
No exploit published: 81Mitigation candidate: 2Protected by Waratek: 21 Low: 2Medium: 55High: 32Critical: 15 not blocked: 83blocked by ARMR today: 21 No public exploit: 95Forecast only: 1Proof of concept only: 2Working exploit published: 4Exploited: 2
Q3 161 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 162 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 Q1 170 Q2 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 Q3 172 Protected by Waratek2 Critical1 Medium1 blocked by ARMR today2 No public exploit2 Q4 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q1 182 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 Q2 184 Protected by Waratek2 No exploit published2 Critical2 High1 Medium1 blocked by ARMR today2 not blocked2 Forecast only1 No public exploit3 Q3 181 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q4 1889 Protected by Waratek8 Mitigation candidate2 No exploit published79 Critical6 High28 Medium53 Low2 blocked by ARMR today8 not blocked81 Working exploit published3 Proof of concept only2 No public exploit84 Q1 191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Q3 16Q4 16Q1 17Q2 17Q3 17Q4 17Q1 18Q2 18Q3 18Q4 18Q1 19
104 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2016-1000031 Critical 2016-10-25 Protected by Waratek No public exploit Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
CVE-2016-5019 Critical 2016-10-03 Protected by Waratek No public exploit CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.
CVE-2016-1182 High 2016-07-04 Protected by Waratek No public exploit ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
‹ prev page 2 of 2 next ›