Vulnerabilidades do Oracle Storagetek Tape Analytics Sw Tool
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Oracle Storagetek Tape Analytics Sw Tool: 6 registro(s), com versões afetadas e correções.cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool
CVE-2020-5421
Média · 6.5
19/09/2020
RFD Protection Bypass via jsessionid
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-11023
Média · 6.1
KEV Alta · 67 Exploit público CWE-79 29/04/2020
JQuery Cross-Site Scripting (XSS) Vulnerability
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2019-3740
Média · 6.5
CWE-203 18/09/2019
Observable Discrepancy em Dell Bsafe Cert-j
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
CVE-2019-3739
Média · 6.5
CWE-310 18/09/2019
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure…
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVE-2019-2725
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-74 26/04/2019
Oracle WebLogic Server, Injection
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2015-4852
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-502 18/11/2015
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.