Oracle Service Bus vulnerabilities
7 known vulnerabilities affecting oracle/service_bus.
Total CVEs
7
CISA KEV
0
Public exploits
1
Exploited in wild
1
Severity breakdown
HIGH4MEDIUM3
Vulnerabilities
Page 1 of 1
CVE-2024-21246HIGHCVSS 7.5v12.2.1.4.02024-10-15
CVE-2024-21246 [HIGH] CWE-862 CVE-2024-21246: Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Fun
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in una
nvd
CVE-2019-10086HIGHCVSS 7.3v11.1.1.9.0v12.2.1.3.0+1 more2019-08-20
CVE-2019-10086 [HIGH] CWE-502 CVE-2019-10086: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressi
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
nvd
CVE-2019-2576MEDIUMCVSS 5.3v11.1.1.9.0v12.1.3.0.0+1 more2019-04-23
CVE-2019-2576 [MEDIUM] CVE-2019-2576: Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Con
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can
nvd
CVE-2019-11358MEDIUMCVSS 6.1ExploitedPoCv11.1.1.9.0v12.1.3.0.0+1 more2019-04-20
CVE-2019-11358 [MEDIUM] CWE-1321 CVE-2019-11358: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(t
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
nvd
CVE-2015-9251MEDIUMCVSS 6.1v12.1.3.0.0v12.2.1.3.02018-01-18
CVE-2015-9251 [MEDIUM] CWE-79 CVE-2015-9251: jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax req
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
nvd
CVE-2017-10119HIGHCVSS 7.6v11.1.1.9.02017-08-08
CVE-2017-10119 [HIGH] CVE-2017-10119: Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: OSB Web
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: OSB Web Console Design, Admin). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks require human interaction from a per
nvd
CVE-2017-3507HIGHCVSS 7.3v12.1.3.0.0v12.2.1.0.0+2 more2017-04-24
CVE-2017-3507 [HIGH] CVE-2017-3507: Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Con
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Console Design). Supported versions that are affected are 12.1.3.0.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this
nvd