Hospitality Guest Access (Oracle) - vulnerabilities (CVEs)

34 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2020-05-20. Vendor: Oracle.

CVEs of Hospitality Guest Access

• CVE-2020-9484 - CVSS 7 (high), 2020-05-20: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the…
• CVE-2020-1938 - CVSS 9.8 (critical), 2020-02-24: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…
• CVE-2020-1935 - CVSS 4.8 (medium), 2020-02-24: In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed…
• CVE-2019-17569 - CVSS 4.8 (medium), 2020-02-24: The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was…
• CVE-2019-17359 - CVSS 7.5 (high), 2019-10-08: The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted…
• CVE-2019-0227 - CVSS 7.5 (high), 2019-05-01: A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits…
• CVE-2019-10247 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will…
• CVE-2019-10246 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory…
• CVE-2019-11358 - CVSS 6.1 (medium), 2019-04-20: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
• CVE-2019-0190 - CVSS 7.5 (high), 2019-01-30: A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a…
• CVE-2018-17189 - CVSS 5.3 (medium), 2019-01-30: In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request…
• CVE-2018-11784 - CVSS 4.3 (medium), 2018-10-04: When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.…
• CVE-2018-11763 - CVSS 5.9 (medium), 2018-09-25: In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any…
• CVE-2018-8032 - CVSS 6.1 (medium), 2018-08-02: Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
• CVE-2018-11039 - CVSS 5.9 (medium), 2018-06-25: Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP…
• CVE-2018-11040 - CVSS 7.5 (high), 2018-06-25: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain…
• CVE-2018-1258 - CVSS 8.8 (high), 2018-05-11: Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An…
• CVE-2018-1257 - CVSS 6.5 (medium), 2018-05-11: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over…
• CVE-2018-2852 - CVSS 6.4 (medium), 2018-04-19: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected…
• CVE-2018-1304 - CVSS 5.9 (medium), 2018-02-28: The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27,…
• CVE-2015-9251 - CVSS 6.1 (medium), 2018-01-18: jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing…
• CVE-2018-2607 - CVSS 4.9 (medium), 2018-01-18: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). The supported version that is affected…
• CVE-2018-2606 - CVSS 6.2 (medium), 2018-01-18: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected…
• CVE-2018-2604 - CVSS 7.5 (high), 2018-01-18: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). The supported version that is affected…
• CVE-2017-10375 - CVSS 4.6 (medium), 2017-10-19: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected…
• CVE-2017-10383 - CVSS 5.3 (medium), 2017-10-19: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Interface). Supported versions that are…
• CVE-2017-10372 - CVSS 8.7 (high), 2017-10-19: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected…
• CVE-2017-10370 - CVSS 6.9 (medium), 2017-10-19: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected…
• CVE-2017-12617 - CVSS 8.1 (high), 2017-10-04: When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the…
• CVE-2017-10217 - CVSS 4.3 (medium), 2017-08-08: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected…
• CVE-2017-10219 - CVSS 5.5 (medium), 2017-08-08: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected…
• CVE-2017-10218 - CVSS 4.3 (medium), 2017-08-08: Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected…
• CVE-2017-9735 - CVSS 7.5 (high), 2017-06-16: Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing…
• CVE-2016-8735 - CVSS 9.8 (critical), 2017-04-06: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…