Filtered by vendor Oracle Subscriptions
Total 10176 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-2790 6 Canonical, Debian, Hp and 3 more 17 Ubuntu Linux, Debian Linux, Xp7 Command View and 14 more 2025-05-06 3.1 Low
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
CVE-2018-2627 3 Netapp, Oracle, Redhat 22 Active Iq Unified Manager, Cloud Backup, E-series Santricity Management Plug-ins and 19 more 2025-05-06 7.5 High
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer). Supported versions that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to the Windows installer only. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
CVE-2017-5715 8 Arm, Canonical, Debian and 5 more 230 Cortex-a, Ubuntu Linux, Debian Linux and 227 more 2025-05-06 5.6 Medium
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
CVE-2022-25315 6 Debian, Fedoraproject, Libexpat Project and 3 more 12 Debian Linux, Fedora, Libexpat and 9 more 2025-05-05 9.8 Critical
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
CVE-2022-25314 6 Debian, Fedoraproject, Libexpat Project and 3 more 8 Debian Linux, Fedora, Libexpat and 5 more 2025-05-05 7.5 High
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
CVE-2022-25236 5 Debian, Libexpat Project, Oracle and 2 more 11 Debian Linux, Libexpat, Http Server and 8 more 2025-05-05 9.8 Critical
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVE-2022-25235 6 Debian, Fedoraproject, Libexpat Project and 3 more 12 Debian Linux, Fedora, Libexpat and 9 more 2025-05-05 9.8 Critical
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
CVE-2022-23990 7 Debian, Fedoraproject, Libexpat Project and 4 more 8 Debian Linux, Fedora, Libexpat and 5 more 2025-05-05 7.5 High
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
CVE-2022-23852 7 Debian, Libexpat Project, Netapp and 4 more 10 Debian Linux, Libexpat, Clustered Data Ontap and 7 more 2025-05-05 9.8 Critical
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
CVE-2022-23308 7 Apple, Debian, Fedoraproject and 4 more 46 Ipados, Iphone Os, Mac Os X and 43 more 2025-05-05 7.5 High
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVE-2022-23221 4 Debian, H2database, Oracle and 1 more 6 Debian Linux, H2, Communications Cloud Native Core Console and 3 more 2025-05-05 9.8 Critical
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
CVE-2022-23219 4 Debian, Gnu, Oracle and 1 more 9 Debian Linux, Glibc, Communications Cloud Native Core Binding Support Function and 6 more 2025-05-05 9.8 Critical
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
CVE-2022-23218 4 Debian, Gnu, Oracle and 1 more 5 Debian Linux, Glibc, Communications Cloud Native Core Unified Data Repository and 2 more 2025-05-05 9.8 Critical
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
CVE-2022-0002 3 Intel, Oracle, Redhat 505 Atom C3308, Atom C3336, Atom C3338 and 502 more 2025-05-05 6.5 Medium
Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVE-2022-0001 3 Intel, Oracle, Redhat 459 Atom P5921b, Atom P5931b, Atom P5942b and 456 more 2025-05-05 6.5 Medium
Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVE-2020-35460 2 Mpxj, Oracle 2 Mpxj, Primavera Unifier 2025-05-05 5.3 Medium
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.
CVE-2020-25020 2 Mpxj, Oracle 2 Mpxj, Primavera Unifier 2025-05-05 9.8 Critical
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.
CVE-2022-38712 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, I and 5 more 2025-05-02 5.9 Medium
"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."
CVE-2004-0230 7 Juniper, Mcafee, Microsoft and 4 more 12 Junos, Network Data Loss Prevention, Windows 2000 and 9 more 2025-05-02 N/A
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP.
CVE-2020-11993 8 Apache, Canonical, Debian and 5 more 16 Http Server, Ubuntu Linux, Debian Linux and 13 more 2025-05-01 7.5 High
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.