WaratekVRT Sign in

Oracle Critical Patch Update October 2023

Released October 2023 · Oracle's advisory ↗ · ← Critical Patch Update, July 2023 · Critical Patch Update, January 2024 →

245 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidate, exploitedMitigation candidateMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicable, exploitedNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicable
Share this chart Oracle Critical Patch Update October 2023, one square per CVE: 105 Java CVEs, 15 protected by Waratek, 8 exploited, 140 other CVEs in this release.

Download the image

By status

15Protected by Waratek3Mitigation candidate87No exploit published44Outside Waratek scope96Not applicable 8Exploited, marked by the ring

No exploit published. For 35 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Overview 105 matches · 15 protected · 2 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
105matches 15protected14.3% 2exploited1.9% 0CISA KEV0.0% 4public PoC3.8% 2EPSS ≥ 0.51.9%
Protected by Waratek 15 14.3% Rule in development 0 0.0% Mitigation candidate 3 2.9% No exploit published 87 82.9%
Critical 15 14.3% High 42 40.0% Medium 46 43.8% Low 2 1.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 15 14.3% partly blocked 0 0.0% not blocked 89 84.8% not established 1 1.0% unrecorded 0 0.0%
Exploited 2 1.9% Working exploit published 0 0.0% Proof of concept only 14 13.3% Forecast only 1 1.0% No public exploit 88 83.8%
split by peak 32 / quarter
No exploit published: 87Mitigation candidate: 3Protected by Waratek: 15 Low: 2Medium: 46High: 42Critical: 15 not established: 1not blocked: 89blocked by ARMR today: 15 No public exploit: 88Forecast only: 1Proof of concept only: 14Exploited: 2
Q3 191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 190 Q1 201 No exploit published1 Critical1 not blocked1 No public exploit1 Q2 200 Q3 200 Q4 201 No exploit published1 High1 not blocked1 No public exploit1 Q1 213 No exploit published3 High2 Medium1 not blocked3 No public exploit3 Q2 211 No exploit published1 High1 not blocked1 Forecast only1 Q3 214 No exploit published4 High2 Medium2 not blocked4 No public exploit4 Q4 211 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q1 222 No exploit published2 High1 Medium1 not blocked2 No public exploit2 Q2 228 Protected by Waratek5 No exploit published3 Critical3 High4 Medium1 blocked by ARMR today5 not blocked3 No public exploit8 Q3 225 Protected by Waratek2 Mitigation candidate1 No exploit published2 Critical2 High2 Medium1 blocked by ARMR today2 not blocked3 Proof of concept only5 Q4 2212 Protected by Waratek3 No exploit published9 Critical2 High7 Medium2 Low1 blocked by ARMR today3 not blocked9 Exploited1 Proof of concept only5 No public exploit6 Q1 237 No exploit published7 High5 Medium2 not blocked7 Proof of concept only2 No public exploit5 Q2 2315 Protected by Waratek1 No exploit published14 Critical2 High6 Medium7 blocked by ARMR today1 not blocked14 No public exploit15 Q3 2312 Protected by Waratek1 Mitigation candidate1 No exploit published10 Critical2 High3 Medium6 Low1 blocked by ARMR today1 not blocked11 Proof of concept only2 No public exploit10 Q4 2332 Protected by Waratek1 Mitigation candidate1 No exploit published30 Critical3 High6 Medium23 blocked by ARMR today1 not blocked30 not established1 Exploited1 No public exploit31
Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23
105 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2020-29582 Medium 2021-02-03 No exploit published No public exploit In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
CVE-2020-9492 High 2021-01-26 No exploit published No public exploit In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
CVE-2020-7760 High 2020-10-30 No exploit published No public exploit This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
CVE-2020-1953 Critical 2020-03-13 No exploit published No public exploit Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
CVE-2019-10086 High 2019-08-20 Protected by Waratek No public exploit In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
‹ prev page 2 of 2 next ›