WaratekVRT Sign in

Oracle Critical Patch Update January 2021

Released January 2021 · Oracle's advisory ↗ · ← Critical Patch Update, October 2020 · Critical Patch Update, April 2021 →

202 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidateMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update January 2021, one square per CVE: 106 Java CVEs, 25 protected by Waratek, 7 exploited, 96 other CVEs in this release.

Download the image

By status

25Protected by Waratek3Mitigation candidate78No exploit published59Outside Waratek scope37Not applicable 7Exploited, marked by the ring

No exploit published. For 66 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Overview 106 matches · 25 protected · 4 exploited · 1 CISA KEV · 9 public PoC · 8 EPSS ≥ 0.5
106matches 25protected23.6% 4exploited3.8% 1CISA KEV0.9% 9public PoC8.5% 8EPSS ≥ 0.57.5%
Protected by Waratek 25 23.6% Rule in development 0 0.0% Mitigation candidate 3 2.8% No exploit published 78 73.6%
Critical 20 18.9% High 58 54.7% Medium 27 25.5% Low 1 0.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 25 23.6% partly blocked 0 0.0% not blocked 81 76.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 3.8% Working exploit published 4 3.8% Proof of concept only 1 0.9% Forecast only 2 1.9% No public exploit 95 89.6%
split by peak 68 / quarter
No exploit published: 78Mitigation candidate: 3Protected by Waratek: 25 Low: 1Medium: 27High: 58Critical: 20 not blocked: 81blocked by ARMR today: 25 No public exploit: 95Forecast only: 2Proof of concept only: 1Working exploit published: 4Exploited: 4
Q4 161 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q1 171 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Q2 171 No exploit published1 Critical1 not blocked1 No public exploit1 Q3 170 Q4 171 No exploit published1 High1 not blocked1 No public exploit1 Q1 181 No exploit published1 High1 not blocked1 No public exploit1 Q2 182 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 Q3 180 Q4 180 Q1 191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 192 Mitigation candidate1 No exploit published1 Medium2 not blocked2 Working exploit published1 No public exploit1 Q3 193 Protected by Waratek2 No exploit published1 Critical1 High2 blocked by ARMR today2 not blocked1 Forecast only1 No public exploit2 Q4 194 Protected by Waratek3 No exploit published1 High2 Medium2 blocked by ARMR today3 not blocked1 No public exploit4 Q1 203 Protected by Waratek1 Mitigation candidate1 No exploit published1 Critical2 High1 blocked by ARMR today1 not blocked2 Exploited1 No public exploit2 Q2 205 Protected by Waratek4 No exploit published1 Critical2 High2 Medium1 blocked by ARMR today4 not blocked1 Working exploit published1 No public exploit4 Q3 207 Protected by Waratek4 Mitigation candidate1 No exploit published2 Critical3 High3 Medium1 blocked by ARMR today4 not blocked3 Exploited1 Working exploit published1 No public exploit5 Q4 206 Protected by Waratek3 No exploit published3 High3 Medium3 blocked by ARMR today3 not blocked3 No public exploit6 Q1 2168 Protected by Waratek3 No exploit published65 Critical9 High43 Medium15 Low1 blocked by ARMR today3 not blocked65 Exploited2 Proof of concept only1 Forecast only1 No public exploit64
Q1 17Q3 17Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21
106 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2018-2587 Medium 2018-04-19 Protected by Waratek No public exploit Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
CVE-2017-12626 High 2018-01-29 No exploit published No public exploit Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
CVE-2017-8028 High 2017-11-27 No exploit published No public exploit In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.
CVE-2015-8965 Critical 2017-04-06 No exploit published No public exploit Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called.
CVE-2016-5725 Medium 2017-01-19 Protected by Waratek Working exploit published Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
CVE-2016-1000031 Critical 2016-10-25 Protected by Waratek No public exploit Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
‹ prev page 2 of 2 next ›