Oracle Weblogic Server vulnerabilities
313 known vulnerabilities affecting oracle/weblogic_server.
Total CVEs
313
CISA KEV
16
actively exploited
Public exploits
38
Exploited in wild
34
Severity breakdown
CRITICAL81HIGH98MEDIUM130LOW4
Vulnerabilities
Page 7 of 16
CVE-2019-17267P3CRITICALCVSS 9.8v12.2.1.3.02019-10-07
CVE-2019-17267 [CRITICAL] CWE-502 CVE-2019-17267: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
nvd
CVE-2020-14588P3HIGHCVSS 8.2v10.3.6.0.0v12.1.3.0.0+3 more2020-07-15
CVE-2020-14588 [HIGH] CVE-2020-14588: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Cont
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attack
nvd
CVE-2018-3246P3HIGHCVSS 7.5v12.1.3.0.0v12.2.1.3+1 more2018-10-17
CVE-2018-3246 [HIGH] CVE-2018-3246: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can resu
nvd
CVE-2019-2647P3HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+1 more2019-04-23
CVE-2019-2647 [HIGH] CVE-2019-2647: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulner
nvd
CVE-2019-2648P3HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+1 more2019-04-23
CVE-2019-2648 [HIGH] CVE-2019-2648: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulner
nvd
CVE-2022-21292P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02022-01-19
CVE-2022-21292 [HIGH] CVE-2022-21292: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unau
nvd
CVE-2023-21842P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2023-01-18
CVE-2023-21842 [HIGH] CWE-306 CVE-2023-21842: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Cont
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulner
nvd
CVE-2026-34305P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.0+2 more2026-04-21
CVE-2026-34305 [HIGH] CWE-200 CVE-2026-34305: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of
nvd
CVE-2018-3213P3HIGHCVSS 7.5fixed in 12.2.1.3.02018-10-17
CVE-2018-3213 [HIGH] CVE-2018-3213: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Doc
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Docker Images). The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability ca
nvd
CVE-2018-15756P3HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+2 more2018-10-18
CVE-2018-15756 [HIGH] CVE-2018-15756: Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and o
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious u
nvd
CVE-2020-2867P3HIGHCVSS 8.2v12.1.3.0.0v12.2.1.3.0+1 more2020-04-15
CVE-2020-2867 [HIGH] CVE-2020-2867: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Cont
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability ca
nvd
CVE-2020-2967P3HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+3 more2020-07-15
CVE-2020-2967 [HIGH] CVE-2020-2967: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attac
nvd
CVE-2021-41184P3MEDIUMCVSS 6.1v12.2.1.3.0v12.2.1.4.0+1 more2021-10-26
CVE-2021-41184 [MEDIUM] CWE-79 CVE-2021-41184: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the valu
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the val
nvd
CVE-2023-21837P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2023-01-18
CVE-2023-21837 [HIGH] CWE-306 CVE-2023-21837: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can
nvd
CVE-2023-21841P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2023-01-18
CVE-2023-21841 [HIGH] CWE-287 CVE-2023-21841: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability
nvd
CVE-2024-21234P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02024-10-15
CVE-2024-21234 [HIGH] CWE-862 CVE-2024-21234: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result
nvd
CVE-2024-21007P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02024-04-16
CVE-2024-21007 [HIGH] CWE-306 CVE-2024-21007: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result
nvd
CVE-2023-21979P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2023-04-18
CVE-2023-21979 [HIGH] CWE-306 CVE-2023-21979: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can r
nvd
CVE-2024-21183P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02024-07-16
CVE-2024-21183 [HIGH] CWE-306 CVE-2024-21183: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result
nvd
CVE-2026-60153P3HIGHCVSS 7.2v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60153 [HIGH] CWE-306 CVE-2026-60153: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle WebLogic Server. Successful attacks of this
nvd