WaratekVRT Sign in

Oracle Critical Patch Update January 2021

Released January 2021 · Oracle's advisory ↗ · ← Critical Patch Update, October 2020 · Critical Patch Update, April 2021 →

202 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidateMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update January 2021, one square per CVE: 106 Java CVEs, 25 protected by Waratek, 7 exploited, 96 other CVEs in this release.

Download the image

By status

25Protected by Waratek3Mitigation candidate78No exploit published59Outside Waratek scope37Not applicable 7Exploited, marked by the ring

No exploit published. For 66 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters (1)
Columns
Published from 2017-11-01✕
Overview 103 matches · 23 protected · 4 exploited · 1 CISA KEV · 8 public PoC · 8 EPSS ≥ 0.5
103matches 23protected22.3% 4exploited3.9% 1CISA KEV1.0% 8public PoC7.8% 8EPSS ≥ 0.57.8%
Protected by Waratek 23 22.3% Rule in development 0 0.0% Mitigation candidate 3 2.9% No exploit published 77 74.8%
Critical 18 17.5% High 58 56.3% Medium 26 25.2% Low 1 1.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 23 22.3% partly blocked 0 0.0% not blocked 80 77.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 3.9% Working exploit published 3 2.9% Proof of concept only 1 1.0% Forecast only 2 1.9% No public exploit 93 90.3%
split by peak 68 / quarter
No exploit published: 77Mitigation candidate: 3Protected by Waratek: 23 Low: 1Medium: 26High: 58Critical: 18 not blocked: 80blocked by ARMR today: 23 No public exploit: 93Forecast only: 2Proof of concept only: 1Working exploit published: 3Exploited: 4
Q4 171 No exploit published1 High1 not blocked1 No public exploit1 Q1 181 No exploit published1 High1 not blocked1 No public exploit1 Q2 182 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 Q3 180 Q4 180 Q1 191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 192 Mitigation candidate1 No exploit published1 Medium2 not blocked2 Working exploit published1 No public exploit1 Q3 193 Protected by Waratek2 No exploit published1 Critical1 High2 blocked by ARMR today2 not blocked1 Forecast only1 No public exploit2 Q4 194 Protected by Waratek3 No exploit published1 High2 Medium2 blocked by ARMR today3 not blocked1 No public exploit4 Q1 203 Protected by Waratek1 Mitigation candidate1 No exploit published1 Critical2 High1 blocked by ARMR today1 not blocked2 Exploited1 No public exploit2 Q2 205 Protected by Waratek4 No exploit published1 Critical2 High2 Medium1 blocked by ARMR today4 not blocked1 Working exploit published1 No public exploit4 Q3 207 Protected by Waratek4 Mitigation candidate1 No exploit published2 Critical3 High3 Medium1 blocked by ARMR today4 not blocked3 Exploited1 Working exploit published1 No public exploit5 Q4 206 Protected by Waratek3 No exploit published3 High3 Medium3 blocked by ARMR today3 not blocked3 No public exploit6 Q1 2168 Protected by Waratek3 No exploit published65 Critical9 High43 Medium15 Low1 blocked by ARMR today3 not blocked65 Exploited2 Proof of concept only1 Forecast only1 No public exploit64
Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21
103 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2018-2587 Medium 2018-04-19 Protected by Waratek No public exploit Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
CVE-2017-12626 High 2018-01-29 No exploit published No public exploit Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
CVE-2017-8028 High 2017-11-27 No exploit published No public exploit In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.
‹ prev page 2 of 2 next ›