Oracle HTTP Server (Apr 2023 CPU)

The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the Apr 2023 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: SSL Module zlib . The supported version that is affected is...

Oracle MySQL Enterprise Monitor (Apr 2023 CPU)

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory. - Vulnerability in the MySQL Workbench product of Oracle MySQL component: Workbench OpenSSL. Supported versions that are affected are 8.0.32...

Oracle Patch Tuesday April 2023 Security Update Review

Oracle has released the second quarterly edition of Critical Patch Update, which contains a group of patches for 433 security vulnerabilities. Some of the vulnerabilities addressed this month impact various products. These patches address vulnerabilities in Oracle code and third-party components...

Vulnerabilities fixed in Oracle Fusion Middleware

Oracle has fixed vulnerabilities in several Oracle Fusion Middleware products. The vulnerabilities allow a malicious potentially able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Administrator/Root rights...

Oracle WebLogic Server (Apr 2023 CPU)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2023 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...

Oracle Access Manager Multiple Vulnerabilities (Apr 2023 CPU)

The version of Oracle Access Manager installed on the remote host is missing a security patch from the April 2023 CPU Advisory. It is, therefore, affected by multiple vulnerabilities: - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Third Party Jython. T...

CVE-2023-21996

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Services. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2023-21979

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

CVE-2023-21964

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

CVE-2023-21956

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic...

CVE-2023-21931

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

Code injection

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Services. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

Code injection

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2023-21996

CVE-2023-21996 affects Oracle WebLogic Server (Web Services component) with affected versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability allows an unauthenticated attacker, over HTTP, to cause a hang or frequent crash (DOS). The F5 advisory consolidates this vulnerability under CVE...

CVE-2023-21979

Oracle WebLogic Server (Core) vulnerability CVE-2023-21979 affects Oracle Fusion Middleware WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker can exploit over T3 to access or exfiltrate data, per multiple sources in the connected documents. The issue is a...

CVE-2023-21964

CVE-2023-21964 affects Oracle WebLogic Server Core, with vulnerable versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. The issue allows unauthenticated network access via T3 to trigger a hang or full crash (DoS). Several connected sources (Oracle APR 2023 CPU advisory, Nessus plugin, PT-2023-2481) c...

CVE-2023-21956

CVE-2023-21956 affects Oracle WebLogic Server (Fusion Middleware) Web Container. Affected: WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can compromise the server; attack requires user interaction and may lead to unauthorized update/i...

CVE-2023-21960

CVE-2023-21960 affects Oracle WebLogic Server (Core) with affected versions 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise WebLogic Server, enabling unauthorized update/insert/delete of data, unauthorized read access, and...

CVE-2023-21931

CVE-2023-21931 is a pre-auth, unauthenticated remote code execution/vulnerability in Oracle WebLogic Server (Fusion Middleware) affecting Core, with affected versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The public sources describe network access via T3 (and IIOP in related discussions) enabli...