Oracle Weblogic Server vulnerabilities
313 known vulnerabilities affecting oracle/weblogic_server.
Total CVEs
313
CISA KEV
16
actively exploited
Public exploits
38
Exploited in wild
34
Severity breakdown
CRITICAL81HIGH98MEDIUM130LOW4
Vulnerabilities
Page 10 of 16
CVE-2020-5421P3MEDIUMCVSS 6.5v10.3.6.0.0v12.1.3.0.0+3 more2020-09-19
CVE-2020-5421 [MEDIUM] CVE-2020-5421: In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and olde
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
nvd
CVE-2020-2549P3HIGHCVSS 7.2v10.3.6.0.02020-01-15
CVE-2020-2549 [HIGH] CVE-2020-2549: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover
nvd
CVE-2020-11111P3HIGHCVSS 8.8v12.2.1.3.0v12.2.1.4.02020-03-31
CVE-2020-11111 [HIGH] CWE-502 CVE-2020-11111: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadg
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
nvd
CVE-2020-2963P3HIGHCVSS 7.2v10.3.6.0.0v12.1.3.0.0+2 more2020-04-15
CVE-2020-2963 [HIGH] CVE-2020-2963: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this v
nvd
CVE-2026-46848P3HIGHCVSS 7.9v14.1.2.0.0v15.1.1.0.02026-06-17
CVE-2026-46848 [HIGH] CWE-284 CVE-2026-46848: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supp
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where WebLogic Server executes to compromise WebLogic Server. Successful attacks require human
nvd
CVE-2016-7103P3MEDIUMCVSS 6.1v10.3.6.0.0v12.1.3.0.0+1 more2017-03-15
CVE-2016-7103 [MEDIUM] CWE-79 CVE-2016-7103: Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
nvd
CVE-2020-36518P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2022-03-11
CVE-2020-36518 [HIGH] CWE-787 CVE-2020-36518: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a lar
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
nvd
CVE-2020-7226P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02020-01-24
CVE-2020-7226 [HIGH] CWE-770 CVE-2020-7226: CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attacke
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
nvd
CVE-2022-21350P3MEDIUMCVSS 6.5v12.1.3.0.0v12.2.1.3.0+2 more2022-01-19
CVE-2022-21350 [MEDIUM] CVE-2022-21350: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerabili
nvd
CVE-2020-14757P3MEDIUMCVSS 6.8v12.2.1.3.02020-10-21
CVE-2020-14757 [MEDIUM] CVE-2020-14757: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). The supported version that is affected is 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other
nvd
CVE-2020-13956P3MEDIUMCVSS 5.3v12.2.1.4.0v14.1.1.0.02020-12-02
CVE-2020-13956 [MEDIUM] CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority co
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
nvd
CVE-2020-28491P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2021-02-18
CVE-2020-28491 [HIGH] CWE-770 CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
nvd
CVE-2022-24839P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2022-04-11
CVE-2022-24839 [HIGH] CWE-400 CVE-2022-24839: org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokog
org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of
nvd
CVE-2017-10152P3MEDIUMCVSS 6.5v10.3.6.0.0v12.1.3.0.02017-10-19
CVE-2017-10152 [MEDIUM] CWE-200 CVE-2017-10152: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerabilit
nvd
CVE-2021-1995P3MEDIUMCVSS 6.5v10.3.6.0.0v12.1.3.0.02021-01-20
CVE-2021-1995 [MEDIUM] CVE-2021-1995: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in
nvd
CVE-2020-14652P3MEDIUMCVSS 6.5v10.3.6.0.0v12.1.3.0.0+3 more2020-07-15
CVE-2020-14652 [MEDIUM] CVE-2020-14652: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-34315P3MEDIUMCVSS 6.5v12.2.1.4.0v14.1.1.0.0+2 more2026-04-21
CVE-2026-34315 [MEDIUM] CWE-285 CVE-2026-34315: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks r
nvd
CVE-2020-14557P3MEDIUMCVSS 6.8v12.1.3.0.0v12.2.1.3.0+2 more2020-07-15
CVE-2020-14557 [MEDIUM] CVE-2020-14557: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Cont
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks requir
nvd
CVE-2018-3249P3MEDIUMCVSS 6.5v10.3.6.0.02018-10-17
CVE-2018-3249 [MEDIUM] CVE-2018-3249: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unaut
nvd
CVE-2022-21252P3MEDIUMCVSS 6.5v12.2.1.4.0v14.1.1.0.02022-01-19
CVE-2022-21252 [MEDIUM] CVE-2022-21252: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in un
nvd