CVE-2021-1995
published 2021-01-20CVE-2021-1995: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
1.48%
71.2th percentile
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vendor_oracle6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libsolv: heap-overflows in resolve_dependencies function
vendor_redhat·2022-02-21·CVSS 6.5
CVE-2021-44568 [MEDIUM] CWE-125 libsolv: heap-overflows in resolve_dependencies function
libsolv: heap-overflows in resolve_dependencies function
Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service.
A buffer over-read flaw was found in the test case reader in libsolv that created multiple out-of-bounds read symptoms. Depending on how client applications use libsolv, this flaw leads to a denial of service of the application if an attacker can supply crafted input to the test case reader.
Statement: This flaw has been marked as Low impact because it is in the test case reader and is an out-of-bounds read.
This issue is related to already fixed issue (https://github.com/openSUSE/libsolv/commi
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Web Services — CVE-2021-1995
vendor_oracle·2021-01-15·CVSS 6.5
CVE-2021-1995 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Web Services — CVE-2021-1995
Oracle Oracle Fusion Middleware Risk Matrix: Web Services vulnerability
CVE: CVE-2021-1995
CVSS: 6.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
GHSA
Incorrect Authorization in Jenkins requests-plugin
ghsa·2022-07-01
CVE-2022-34782 [MEDIUM] CWE-863 Incorrect Authorization in Jenkins requests-plugin
Incorrect Authorization in Jenkins requests-plugin
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests.
This is basically the same vulnerability as [SECURITY-1995](https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-1995), whose fix was ineffective.
requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests.
GHSA
GHSA-3mq7-67j8-qhqj: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
ghsa_unreviewed·2022-05-24
CVE-2021-1995 [MEDIUM] GHSA-3mq7-67j8-qhqj: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
No detection rules found.
No writeups or analysis indexed.
2021-01-20
Published