WaratekVRT Sign in

Oracle Critical Patch Update October 2024

Released October 2024 · Oracle's advisory ↗ · ← Critical Patch Update, July 2024 · Critical Patch Update, January 2025 →

278 CVEs in this release, one square each

Protected by Waratek, exploitedProtected by Waratek, exploitedProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekProtected by WaratekMitigation candidate, exploitedMitigation candidate, exploitedMitigation candidateNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedNo exploit publishedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scope, exploitedOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeOutside Waratek scopeNot applicable, exploitedNot applicable, exploitedNot applicable, exploitedNot applicable, exploitedNot applicable, exploitedNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableNot applicableWithdrawn CVEWithdrawn CVE
Share this chart Oracle Critical Patch Update October 2024, one square per CVE: 106 Java CVEs, 15 protected by Waratek, 13 exploited, 172 other CVEs in this release.

Download the image

By status

15Protected by Waratek3Mitigation candidate88No exploit published26Outside Waratek scope144Not applicable2Withdrawn CVE 13Exploited, marked by the ring

No exploit published. For 51 of them, Oracle's security advisory is the source of public detail.

Protected by Waratek. Waratek RASP can block exploitation of these on systems that have not applied the patch yet.

Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 108 matches · 31 in Waratek scope · 2 protected · 4 exploited · 2 CISA KEV · 6 public PoC · 5 EPSS ≥ 0.5
108matches 31in Waratek scope28.7% 2protected1.9% 4exploited3.7% 2CISA KEV1.9% 6public PoC5.6% 5EPSS ≥ 0.54.6%
Protected by Waratek 2 1.9% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 29 26.9% Outside Waratek scope 14 13.0% Not applicable 63 58.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 108 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 1.9% partly blocked 0 0.0% not blocked 106 98.1% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 3.7% Working exploit published 0 0.0% Proof of concept only 12 11.1% Forecast only 2 1.9% No public exploit 90 83.3%
split by peak 36 / quarter
Not applicable: 63Outside Waratek scope: 14No exploit published: 29Protected by Waratek: 2 Medium: 108 not blocked: 106blocked by ARMR today: 2 No public exploit: 90Forecast only: 2Proof of concept only: 12Exploited: 4
Q2 203 Outside Waratek scope3 Medium3 not blocked3 Exploited2 No public exploit1 Q3 200 Q4 202 Protected by Waratek1 Outside Waratek scope1 Medium2 blocked by ARMR today1 not blocked1 No public exploit2 Q1 210 Q2 211 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 Q3 210 Q4 213 Outside Waratek scope3 Medium3 not blocked3 Proof of concept only1 No public exploit2 Q1 221 No exploit published1 Medium1 not blocked1 No public exploit1 Q2 220 Q3 221 Outside Waratek scope1 Medium1 not blocked1 Proof of concept only1 Q4 220 Q1 234 Not applicable4 Medium4 not blocked4 Proof of concept only1 No public exploit3 Q2 232 No exploit published2 Medium2 not blocked2 No public exploit2 Q3 234 No exploit published2 Not applicable2 Medium4 not blocked4 Proof of concept only1 No public exploit3 Q4 238 No exploit published2 Outside Waratek scope1 Not applicable5 Medium8 not blocked8 Exploited1 Proof of concept only1 No public exploit6 Q1 2416 No exploit published7 Not applicable9 Medium16 not blocked16 Proof of concept only4 No public exploit12 Q2 2416 Outside Waratek scope3 Not applicable13 Medium16 not blocked16 Exploited1 Proof of concept only2 Forecast only2 No public exploit11 Q3 2411 Protected by Waratek1 No exploit published3 Not applicable7 Medium11 blocked by ARMR today1 not blocked10 Proof of concept only1 No public exploit10 Q4 2436 No exploit published12 Outside Waratek scope1 Not applicable23 Medium36 not blocked36 No public exploit36
Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24
108 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2021-41183 Medium 2021-10-26 Outside Waratek scope No public exploit jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
CVE-2021-41182 Medium 2021-10-26 Outside Waratek scope No public exploit jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
CVE-2021-28170 Medium 2021-05-26 Outside Waratek scope No public exploit In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
CVE-2020-17521 Medium 2020-12-07 Protected by Waratek No public exploit Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
CVE-2020-13956 Medium 2020-12-02 Outside Waratek scope No public exploit Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVE-2020-14145 Medium 2020-06-29 Outside Waratek scope No public exploit The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
CVE-2020-11023 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11022 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
‹ prev page 2 of 2 next ›