Enterprise Manager Ops Center (Oracle) - vulnerabilities (CVEs)

107 CVEs, 0 in the last 30 days, 15 known versions, newest CVE from 2022-05-03. Vendor: Oracle.

CVEs of Enterprise Manager Ops Center

• CVE-2022-1292 - CVSS 9.8 (critical), 2022-05-03: The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a…
• CVE-2022-22721 - CVSS 9.1 (critical), 2022-03-14: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out…
• CVE-2022-22720 - CVSS 9.8 (critical), 2022-03-14: Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP…
• CVE-2021-4160 - CVSS 5.9 (medium), 2022-01-28: There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves.…
• CVE-2021-45105 - CVSS 5.9 (medium), 2021-12-18: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This…
• CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
• CVE-2021-2351 - CVSS 8.3 (high), 2021-07-21: Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c.…
• CVE-2021-33503 - CVSS 7.5 (high), 2021-06-29: An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular…
• CVE-2021-31618 - CVSS 7.5 (high), 2021-06-15: Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used…
• CVE-2020-35452 - CVSS 7.3 (high), 2021-06-10: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this…
• CVE-2021-30641 - CVSS 5.3 (medium), 2021-06-10: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
• CVE-2020-13950 - CVSS 7.5 (high), 2021-06-10: Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both…
• CVE-2021-26691 - CVSS 9.8 (critical), 2021-06-10: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
• CVE-2019-17567 - CVSS 5.3 (medium), 2021-06-10: Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the…
• CVE-2021-26690 - CVSS 7.5 (high), 2021-06-10: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading…
• CVE-2021-22222 - CVSS 7.5 (high), 2021-06-07: Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file
• CVE-2021-29505 - CVSS 8.8 (high), 2021-05-28: XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has…
• CVE-2021-3518 - CVSS 8.8 (high), 2021-05-18: There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2…
• CVE-2021-3537 - CVSS 5.9 (medium), 2021-05-14: A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference.…
• CVE-2021-23841 - CVSS 5.9 (medium), 2021-02-16: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained…
• CVE-2021-23840 - CVSS 7.5 (high), 2021-02-16: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to…
• CVE-2021-23839 - CVSS 3.7 (low), 2021-02-16: OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS…
• CVE-2021-23336 - CVSS 5.9 (medium), 2021-02-15: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to…
• CVE-2021-2015 - CVSS 8.2 (high), 2021-01-20: Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that are affected are 12.2.3-12.2.10. Easily…
• CVE-2021-1999 - CVSS 5 (medium), 2021-01-20: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: RAS subsystems). The supported version that is affected is 8.8.…
• CVE-2021-1993 - CVSS 4.8 (medium), 2021-01-20: Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to…
• CVE-2021-3177 - CVSS 9.8 (critical), 2021-01-19: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications…
• CVE-2020-1971 - CVSS 5.9 (medium), 2020-12-08: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a…
• CVE-2020-24977 - CVSS 6.5 (medium), 2020-09-04: GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in…
• CVE-2020-9490 - CVSS 7.5 (high), 2020-08-07: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the…
• CVE-2020-11993 - CVSS 7.5 (high), 2020-08-07: Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were…
• CVE-2020-11984 - CVSS 9.8 (critical), 2020-08-07: Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
• CVE-2020-15358 - CVSS 5.5 (medium), 2020-06-27: In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive…
• CVE-2020-14422 - CVSS 5.9 (medium), 2020-06-18: Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker…
• CVE-2020-13871 - CVSS 7.5 (high), 2020-06-06: SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
• CVE-2020-1945 - CVSS 6.3 (medium), 2020-05-14: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and…
• CVE-2020-11022 - CVSS 6.9 (medium), 2020-04-29: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods…
• CVE-2020-1967 - CVSS 7.5 (high), 2020-04-21: Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a…
• CVE-2020-11656 - CVSS 9.8 (critical), 2020-04-09: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT…
• CVE-2020-11655 - CVSS 7.5 (high), 2020-04-09: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's…
• CVE-2020-1927 - CVSS 6.1 (medium), 2020-04-02: In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…
• CVE-2020-1934 - CVSS 5.3 (medium), 2020-04-01: In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
• CVE-2020-9327 - CVSS 7.5 (high), 2020-02-21: In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column…
• CVE-2019-20388 - CVSS 7.5 (high), 2020-01-21: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
• CVE-2020-7595 - CVSS 7.5 (high), 2020-01-21: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
• CVE-2019-1551 - CVSS 5.3 (medium), 2019-12-06: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis…
• CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
• CVE-2019-10092 - CVSS 6.1 (medium), 2019-09-26: In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on…
• CVE-2019-10082 - CVSS 9.1 (critical), 2019-09-26: In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection…
• CVE-2019-10097 - CVSS 7.2 (high), 2019-09-26: In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially…
• CVE-2019-5481 - CVSS 9.8 (critical), 2019-09-16: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
• CVE-2019-5482 - CVSS 9.8 (critical), 2019-09-16: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
• CVE-2019-13990 - CVSS 9.8 (critical), 2019-07-26: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
• CVE-2019-2728 - CVSS 4.3 (medium), 2019-07-23: Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Networking). Supported versions that…
• CVE-2019-5443 - CVSS 7.8 (high), 2019-07-02: A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1…
• CVE-2019-0197 - CVSS 4.2 (medium), 2019-06-11: A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host,…
• CVE-2019-5436 - CVSS 7.8 (high), 2019-05-28: A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
• CVE-2019-2726 - CVSS 6.3 (medium), 2019-05-24: Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Services Integration). The supported…
• CVE-2019-5427 - CVSS 7.5 (high), 2019-04-22: c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity…
• CVE-2019-11358 - CVSS 6.1 (medium), 2019-04-20: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
• CVE-2019-0211 - CVSS 7.8 (high), 2019-04-08: In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads…
• CVE-2019-0217 - CVSS 7.5 (high), 2019-04-08: In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid…
• CVE-2019-1559 - CVSS 5.9 (medium), 2019-02-27: If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL…
• CVE-2019-3822 - CVSS 9.8 (critical), 2019-02-06: libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header…
• CVE-2019-0190 - CVSS 7.5 (high), 2019-01-30: A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a…
• CVE-2018-17199 - CVSS 7.5 (high), 2019-01-30: In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to…
• CVE-2018-17189 - CVSS 5.3 (medium), 2019-01-30: In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request…
• CVE-2018-15769 - CVSS 7.5 (high), 2018-11-16: RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue.…
• CVE-2018-5407 - CVSS 4.7 (medium), 2018-11-15: Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on…
• CVE-2018-0734 - CVSS 5.9 (medium), 2018-10-30: The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm…
• CVE-2018-0735 - CVSS 5.9 (medium), 2018-10-29: The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing…
• CVE-2018-15756 - CVSS 7.5 (high), 2018-10-18: Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide…
• CVE-2018-11763 - CVSS 5.9 (medium), 2018-09-25: In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any…
• CVE-2018-11058 - CVSS 9.8 (critical), 2018-09-14: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to…
• CVE-2018-11055 - CVSS 5.5 (medium), 2018-08-31: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before…
• CVE-2018-11054 - CVSS 7.5 (high), 2018-08-31: RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to…
• CVE-2018-11057 - CVSS 5.9 (medium), 2018-08-31: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA…
• CVE-2018-11056 - CVSS 6.5 (medium), 2018-08-31: RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled…
• CVE-2018-2976 - CVSS 8.2 (high), 2018-07-18: Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Networking). The supported version…
• CVE-2018-11039 - CVSS 5.9 (medium), 2018-06-25: Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP…
• CVE-2018-11040 - CVSS 7.5 (high), 2018-06-25: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain…
• CVE-2018-1000301 - CVSS 9.1 (critical), 2018-05-24: curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be…
• CVE-2018-1257 - CVSS 6.5 (medium), 2018-05-11: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over…
• CVE-2018-1258 - CVSS 8.8 (high), 2018-05-11: Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An…
• CVE-2018-2742 - CVSS 7.3 (high), 2018-04-19: Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Framework). Supported versions that…
• CVE-2018-1271 - CVSS 5.9 (medium), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to…
• CVE-2018-1270 - CVSS 9.8 (critical), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over…
• CVE-2018-1272 - CVSS 7.5 (high), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart…
• CVE-2018-1000121 - CVSS 7.5 (high), 2018-03-14: A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service
• CVE-2018-1000120 - CVSS 9.8 (critical), 2018-03-14: A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
• CVE-2018-1000122 - CVSS 9.1 (critical), 2018-03-14: A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or…
• CVE-2015-9251 - CVSS 6.1 (medium), 2018-01-18: jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing…
• CVE-2016-8610 - CVSS 7.5 (high), 2017-11-13: A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT…
• CVE-2016-3494 - CVSS 6.5 (medium), 2016-07-21: Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2 allows remote…
• CVE-2016-0635 - CVSS 8.8 (high), 2016-07-21: Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle…
• CVE-2016-5387 - CVSS 8.1 (high), 2016-07-19: The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data…
• CVE-2016-5385 - CVSS 8.1 (high), 2016-07-19: PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of…
• CVE-2015-7940 - CVSS 5 (medium), 2015-11-09: The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain…
• CVE-2015-3237 - CVSS 6.4 (medium), 2015-06-22: The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a…
• CVE-2015-3153 - CVSS 5 (medium), 2015-05-01: The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote…