WaratekVRT Sign in

Oracle Critical Patch Update July 2022

Released July 2022 · Oracle's advisory ↗ · ← Critical Patch Update, April 2022 · Critical Patch Update, October 2022 →

188 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidate, exploitedMitigation candidate, exploitedMitigation candidateMitigation candidateMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update July 2022, one square per CVE: 105 Java CVEs, 27 protected by Waratek, 12 exploited, 83 other CVEs in this release.

Download the image

By status

27Protected by Waratek6Mitigation candidate72No exploit published49Outside Waratek scope34Not applicable 12Exploited, marked by the ring

No exploit published. For 47 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Overview 105 matches · 27 protected · 9 exploited · 4 CISA KEV · 14 public PoC · 13 EPSS ≥ 0.5
105matches 27protected25.7% 9exploited8.6% 4CISA KEV3.8% 14public PoC13.3% 13EPSS ≥ 0.512.4%
Protected by Waratek 27 25.7% Rule in development 0 0.0% Mitigation candidate 6 5.7% No exploit published 72 68.6%
Critical 18 17.1% High 38 36.2% Medium 49 46.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 27 25.7% partly blocked 0 0.0% not blocked 78 74.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 9 8.6% Working exploit published 3 2.9% Proof of concept only 7 6.7% Forecast only 1 1.0% No public exploit 85 81.0%
split by peak 45 / quarter
No exploit published: 72Mitigation candidate: 6Protected by Waratek: 27 Medium: 49High: 38Critical: 18 not blocked: 78blocked by ARMR today: 27 No public exploit: 85Forecast only: 1Proof of concept only: 7Working exploit published: 3Exploited: 9
Q2 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 191 No exploit published1 Critical1 not blocked1 No public exploit1 Q1 201 No exploit published1 Critical1 not blocked1 No public exploit1 Q2 202 Protected by Waratek2 Critical1 Medium1 blocked by ARMR today2 Working exploit published1 No public exploit1 Q3 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 203 Protected by Waratek2 No exploit published1 High2 Medium1 blocked by ARMR today2 not blocked1 No public exploit3 Q1 214 Protected by Waratek1 No exploit published3 Critical1 High3 blocked by ARMR today1 not blocked3 No public exploit4 Q2 217 Protected by Waratek3 Mitigation candidate1 No exploit published3 High5 Medium2 blocked by ARMR today3 not blocked4 Working exploit published1 No public exploit6 Q3 2110 Protected by Waratek1 Mitigation candidate1 No exploit published8 Critical1 High5 Medium4 blocked by ARMR today1 not blocked9 Exploited2 Forecast only1 No public exploit7 Q4 213 Protected by Waratek3 Critical1 High1 Medium1 blocked by ARMR today3 Exploited1 No public exploit2 Q1 229 Protected by Waratek3 Mitigation candidate1 No exploit published5 Critical3 High4 Medium2 blocked by ARMR today3 not blocked6 Exploited1 Proof of concept only2 No public exploit6 Q2 2217 Protected by Waratek8 Mitigation candidate3 No exploit published6 Critical6 High5 Medium6 blocked by ARMR today8 not blocked9 Exploited4 Working exploit published1 Proof of concept only4 No public exploit8 Q3 2245 Protected by Waratek1 No exploit published44 Critical2 High11 Medium32 blocked by ARMR today1 not blocked44 Proof of concept only1 No public exploit44
Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22
105 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2020-10683 Critical 2020-05-01 Protected by Waratek No public exploit dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
CVE-2019-0219 Critical 2020-01-14 No exploit published No public exploit A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.
CVE-2019-17495 Critical 2019-10-10 No exploit published No public exploit A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
CVE-2019-10086 High 2019-08-20 Protected by Waratek No public exploit In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2018-1273 Critical 2018-04-11 Protected by Waratek Exploited Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
‹ prev page 2 of 2 next ›