Oracle Weblogic Server vulnerabilities
306 known vulnerabilities affecting oracle/weblogic_server.
Total CVEs
306
CISA KEV
15
actively exploited
Public exploits
31
Exploited in wild
22
Severity breakdown
CRITICAL81HIGH92MEDIUM129LOW4
Vulnerabilities
Page 5 of 16
CVE-2021-35617CRITICALCVSS 9.8v12.1.3.0.0v12.2.1.3.0+2 more2021-10-20
CVE-2021-35617 [CRITICAL] CVE-2021-35617: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherenc
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks
nvd
CVE-2021-35620HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+3 more2021-10-20
CVE-2021-35620 [HIGH] CVE-2021-35620: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this v
nvd
CVE-2021-35552MEDIUMCVSS 5.3v12.2.1.3.0v12.2.1.4.0+1 more2021-10-20
CVE-2021-35552 [MEDIUM] CVE-2021-35552: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Diagnost
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Diagnostics). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability
nvd
CVE-2021-40690HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02021-09-19
CVE-2021-40690 [HIGH] CWE-200 CVE-2021-40690: All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
nvd
CVE-2021-2397CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+3 more2021-07-21
CVE-2021-2397 [CRITICAL] CVE-2021-2397: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks o
nvd
CVE-2021-2382CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+3 more2021-07-21
CVE-2021-2382 [CRITICAL] CVE-2021-2382: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attac
nvd
CVE-2021-2394CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+3 more2021-07-21
CVE-2021-2394 [CRITICAL] CVE-2021-2394: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks o
nvd
CVE-2021-2351HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2021-07-21
CVE-2021-2351 [HIGH] CWE-327 CVE-2021-2351: Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versi
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a perso
nvd
CVE-2021-2378HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+3 more2021-07-21
CVE-2021-2378 [HIGH] CVE-2021-2378: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2021-2376HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+3 more2021-07-21
CVE-2021-2376 [HIGH] CVE-2021-2376: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attac
nvd
CVE-2021-2403MEDIUMCVSS 5.3v10.3.6.0.0v12.1.3.0.0+3 more2021-07-21
CVE-2021-2403 [MEDIUM] CVE-2021-2403: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this
nvd
CVE-2021-28170MEDIUMCVSS 5.3v14.1.1.0.02021-05-26
CVE-2021-28170 [MEDIUM] CWE-20 CVE-2021-28170: In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManag
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
nvd
CVE-2021-2136CRITICALCVSS 9.8v12.1.3.0.0v12.2.1.3.0+2 more2021-04-22
CVE-2021-2136 [CRITICAL] CVE-2021-2136: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerabi
nvd
CVE-2021-2135CRITICALCVSS 9.8PoCv12.2.1.3.0v12.2.1.4.0+1 more2021-04-22
CVE-2021-2135 [CRITICAL] CVE-2021-2135: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherenc
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vu
nvd
CVE-2021-2157HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+2 more2021-04-22
CVE-2021-2157 [HIGH] CVE-2021-2157: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this
nvd
CVE-2021-2204MEDIUMCVSS 5.3v10.3.6.0.0v12.1.3.0.0+3 more2021-04-22
CVE-2021-2204 [MEDIUM] CVE-2021-2204: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this
nvd
CVE-2021-2142MEDIUMCVSS 6.1v10.3.6.0.02021-04-22
CVE-2021-2142 [MEDIUM] CVE-2021-2142: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the
nvd
CVE-2021-2211MEDIUMCVSS 5.9v10.3.6.0.0v12.2.1.3.0+2 more2021-04-22
CVE-2021-2211 [MEDIUM] CVE-2021-2211: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2021-2214MEDIUMCVSS 4.4v10.3.6.0.0v12.1.3.0.0+3 more2021-04-22
CVE-2021-2214 [MEDIUM] CVE-2021-2214: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of
nvd
CVE-2021-2294MEDIUMCVSS 6.5v10.3.6.0.0v12.1.3.0.0+3 more2021-04-22
CVE-2021-2294 [MEDIUM] CVE-2021-2294: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of
nvd