Oracle Weblogic Server vulnerabilities
324 known vulnerabilities affecting oracle/weblogic_server.
Total CVEs
324
CISA KEV
16
actively exploited
Public exploits
38
Exploited in wild
34
Severity breakdown
CRITICAL88HIGH102MEDIUM130LOW4
Vulnerabilities
Page 16 of 17
CVE-2020-9488P4LOWCVSS 3.7v10.3.6.0.02020-04-27
CVE-2020-9488 [LOW] CWE-295 CVE-2020-9488: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allo
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
nvd
CVE-2018-2902P4MEDIUMCVSS 4.3v10.3.6.0.0v12.1.3.0.02018-10-17
CVE-2018-2902 [MEDIUM] CVE-2018-2902: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Con
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Console). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unau
nvd
CVE-2025-50064P4MEDIUMCVSS 4.8v12.2.1.4.0v14.1.1.0.0+1 more2025-07-15
CVE-2025-50064 [MEDIUM] CWE-269 CVE-2025-50064: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interacti
nvd
CVE-2017-10123P4MEDIUMCVSS 4.3v12.1.3.0.02017-08-08
CVE-2017-10123 [MEDIUM] CVE-2017-10123: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). The supported version that is affected is 12.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthor
nvd
CVE-2019-2887P4MEDIUMCVSS 4.3v10.3.6.0.0v12.1.3.0.0+1 more2019-10-16
CVE-2019-2887 [MEDIUM] CVE-2019-2887: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability ca
nvd
CVE-2017-10334P4MEDIUMCVSS 4.3v10.3.6.0.0v12.1.3.0.0+2 more2017-10-19
CVE-2017-10334 [MEDIUM] CWE-200 CVE-2017-10334: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful atta
nvd
CVE-2020-2544P4MEDIUMCVSS 4.3v10.3.6.0.0v12.1.3.0.0+2 more2020-01-15
CVE-2020-2544 [MEDIUM] CVE-2020-2544: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human in
nvd
CVE-2019-2398P4MEDIUMCVSS 4.3v10.3.6.0v12.1.3.0+1 more2019-01-16
CVE-2019-2398 [MEDIUM] CVE-2019-2398: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Deployment). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability
nvd
CVE-2016-5601P4MEDIUMCVSS 6.3v12.1.3.0.0v12.2.1.0.0+1 more2016-10-25
CVE-2016-5601 [MEDIUM] CWE-284 CVE-2016-5601: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.3
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.3.0, 12.2.1.0, and 12.2.1.1 allows local users to affect confidentiality and integrity via vectors related to CIE Related Components.
nvd
CVE-2022-21616P4MEDIUMCVSS 5.2v12.2.1.3.0v12.2.1.4.0+1 more2022-10-18
CVE-2022-21616 [MEDIUM] CVE-2022-21616: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Cont
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Ser
nvd
CVE-2020-2547P4MEDIUMCVSS 4.8v10.3.6.0.0v12.1.3.0.0+2 more2020-01-15
CVE-2020-2547 [MEDIUM] CVE-2020-2547: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human in
nvd
CVE-2020-2519P4MEDIUMCVSS 4.3v10.3.6.0.0v12.1.3.0.0+2 more2020-01-15
CVE-2020-2519 [MEDIUM] CVE-2020-2519: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human in
nvd
CVE-2021-2214P4MEDIUMCVSS 4.4v10.3.6.0.0v12.1.3.0.0+3 more2021-04-22
CVE-2021-2214 [MEDIUM] CVE-2021-2214: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of
nvd
CVE-2020-2548P4MEDIUMCVSS 4.8v10.3.6.0.02020-01-15
CVE-2020-2548 [MEDIUM] CVE-2020-2548: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person ot
nvd
CVE-2020-2552P4MEDIUMCVSS 4.8v10.3.6.0.0v12.1.3.0.02020-01-15
CVE-2020-2552 [MEDIUM] CVE-2020-2552: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction fr
nvd
CVE-2010-4453P4MEDIUMCVSS 4.3v7.0.7v8.1.6+6 more2011-01-19
CVE-2010-4453 [MEDIUM] CVE-2010-4453: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 7.0.7,
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 7.0.7, 8.1.6, 9.0, 9.1, 9.2.4, 10.0.2, 10.3.2, and 10.3.3 allows remote attackers to affect integrity via unknown vectors related to Servlet Container.
nvd
CVE-2008-2577P4MEDIUMCVSS 4.6v9.22008-07-15
CVE-2008-2577 [MEDIUM] CVE-2008-2577: Unspecified vulnerability in the WebLogic Server component in Oracle BEA Product Suite 9.2 MP1 has u
Unspecified vulnerability in the WebLogic Server component in Oracle BEA Product Suite 9.2 MP1 has unknown impact and remote authenticated attack vectors.
nvd
CVE-2016-0688P4LOWCVSS 3.7v10.3.6.0.0v12.1.2.0.0+1 more2016-04-21
CVE-2016-0688 [LOW] CVE-2016-0688: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to Core Components.
nvd
CVE-2025-50072P4MEDIUMCVSS 4.0v12.2.1.4.0v14.1.1.0.0+1 more2025-07-15
CVE-2025-50072 [MEDIUM] CWE-284 CVE-2025-50072: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server.
nvd
CVE-2023-22031P4MEDIUMCVSS 4.4v12.2.1.4.0v14.1.1.0.02023-07-18
CVE-2023-22031 [MEDIUM] CVE-2023-22031: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows high privileged attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in u
nvd