WaratekVRT Sign in

Oracle Critical Patch Update July 2019

Released July 2019 · Oracle's advisory ↗ · ← Critical Patch Update, April 2019 · Critical Patch Update, October 2019 →

207 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidate, exploitedMitigation candidate, exploitedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update July 2019, one square per CVE: 91 Java CVEs, 25 protected by Waratek, 11 exploited, 116 other CVEs in this release.

Download the image

By status

25Protected by Waratek2Mitigation candidate64No exploit published55Outside Waratek scope61Not applicable 11Exploited, marked by the ring

No exploit published. For 58 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 207 matches · 91 in Waratek scope · 25 protected · 11 exploited · 2 CISA KEV · 14 public PoC · 13 EPSS ≥ 0.5
207matches 91in Waratek scope44.0% 25protected12.1% 11exploited5.3% 2CISA KEV1.0% 14public PoC6.8% 13EPSS ≥ 0.56.3%
Protected by Waratek 25 12.1% Rule in development 0 0.0% Mitigation candidate 2 1.0% No exploit published 64 30.9% Outside Waratek scope 55 26.6% Not applicable 61 29.5% Withdrawn CVE 0 0.0%
Critical 18 8.7% High 71 34.3% Medium 99 47.8% Low 19 9.2% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 25 12.1% partly blocked 0 0.0% not blocked 181 87.4% not established 1 0.5% unrecorded 0 0.0%
Exploited 11 5.3% Working exploit published 4 1.9% Proof of concept only 1 0.5% Forecast only 2 1.0% No public exploit 189 91.3%
split by peak 157 / quarter
Not applicable: 61Outside Waratek scope: 55No exploit published: 64Mitigation candidate: 2Protected by Waratek: 25 Low: 19Medium: 99High: 71Critical: 18 not established: 1not blocked: 181blocked by ARMR today: 25 No public exploit: 189Forecast only: 2Proof of concept only: 1Working exploit published: 4Exploited: 11
Q2 141 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q3 140 Q4 140 Q1 150 Q2 150 Q3 150 Q4 150 Q1 160 Q2 160 Q3 161 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 161 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q1 171 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 Q2 172 Protected by Waratek1 Outside Waratek scope1 Critical1 High1 blocked by ARMR today1 not blocked1 Working exploit published1 No public exploit1 Q3 171 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q4 172 Protected by Waratek1 Not applicable1 High1 Medium1 blocked by ARMR today1 not blocked1 No public exploit2 Q1 186 Protected by Waratek1 Outside Waratek scope5 Critical3 Medium3 blocked by ARMR today1 not blocked5 Exploited1 Working exploit published1 Proof of concept only1 No public exploit3 Q2 185 Protected by Waratek2 No exploit published2 Not applicable1 Critical2 High3 blocked by ARMR today2 not blocked3 Forecast only1 No public exploit4 Q3 184 No exploit published2 Outside Waratek scope1 Not applicable1 Critical1 High2 Medium1 not blocked4 No public exploit4 Q4 187 Protected by Waratek1 No exploit published1 Outside Waratek scope4 Not applicable1 Critical1 High1 Medium5 blocked by ARMR today1 not blocked6 Working exploit published1 No public exploit6 Q1 1910 Protected by Waratek4 No exploit published1 Outside Waratek scope2 Not applicable3 Critical3 High5 Medium2 blocked by ARMR today4 not blocked6 Exploited2 No public exploit8 Q2 199 Protected by Waratek4 No exploit published1 Outside Waratek scope2 Not applicable2 Critical3 High5 Medium1 blocked by ARMR today4 not blocked5 Exploited5 Forecast only1 No public exploit3 Q3 19157 Protected by Waratek7 Mitigation candidate2 No exploit published57 Outside Waratek scope39 Not applicable52 Critical3 High51 Medium84 Low19 blocked by ARMR today7 not blocked149 not established1 Exploited2 Working exploit published1 No public exploit154
Q3 14Q1 15Q3 15Q1 16Q3 16Q1 17Q3 17Q1 18Q3 18Q1 19Q3 19
207 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2017-14735 Medium 2017-09-25 Protected by Waratek No public exploit OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
CVE-2017-5664 High 2017-06-06 Outside Waratek scope No public exploit The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2016-7103 Medium 2017-03-15 Outside Waratek scope No public exploit Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
CVE-2016-1000031 Critical 2016-10-25 Protected by Waratek No public exploit Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
CVE-2016-1181 High 2016-07-04 Protected by Waratek No public exploit ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
CVE-2014-0114 High 2014-04-30 Protected by Waratek Exploited Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
‹ prev page 3 of 3 next ›