Oracle WebLogic Server (April 2024 CPU)

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Samples handlebars. Supported...

CVE-2024-21007

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...

CVE-2024-21006

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...

CVE-2024-21007

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...

CVE-2024-21007

CVE-2024-21007 affects Oracle WebLogic Server (Core) in Oracle Fusion Middleware, impacting versions 12.2.1.4.0 and 14.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via T3 or IIOP to compromise the server, potentially leading to unauthorized access to critical ...

CVE-2024-21006

CVE-2024-21006 affects Oracle WebLogic Server (Core) in 12.2.1.4.0 and 14.1.1.0.0. The connected PoC demonstrates unauthenticated remote code execution via IIOP/JNDI (T3/IIOP access) leading to arbitrary code execution and data compromise. Oracle’s April 2024 CPU provides fixes (update to version...

Oracle Fusion Middleware 的 Oracle WebLogic Server 安全漏洞

Oracle Fusion Middleware and Oracle WebLogic Server are both products of Oracle Corporation.Oracle Fusion Middleware is a business innovation platform for enterprise and cloud environments. The platform provides middleware, software collections, and more.Oracle WebLogic Server is an application...

Oracle Fusion Middleware 的 Oracle WebLogic Server 安全漏洞

Oracle Fusion Middleware and Oracle WebLogic Server are both products of Oracle Corporation.Oracle Fusion Middleware is a business innovation platform for enterprise and cloud environments. The platform provides middleware, software collections, and more.Oracle WebLogic Server is an application...

Mars: CVE-2022-21371: Oracle WebLogic Server Local File Inclusion

A vulnerability was identified in Oracle WebLogic Server's Web Container component. Affected versions included ██████████, ██████████, ██████████, and ██████████. The vulnerability could be exploited by an unauthenticated attacker over HTTP, potentially leading to unauthorized access to critical...

CVE-2024-20986

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2024-20931

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...

CVE-2024-20927

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2024-20931

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...

CVE-2024-20927

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server...

Code injection

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...

CVE-2024-20986

CVE-2024-20986 affects Oracle WebLogic Server (Oracle Fusion Middleware) Core component in versions 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access over HTTP can compromise WebLogic Server. The vulnerability requires user interaction from someone other than the attacker...

CVE-2024-20931

CVE-2024-20931 affects Oracle WebLogic Server (Core) in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.1.0.0. The flaw, described across NVD/Red Hat/NCSC/CNNVD sources, enables an unauthenticated attacker with network access via T3 or IIOP to compromise the WebLogic server, p...

CVE-2024-20927

CVE-2024-20927 affects Oracle WebLogic Server (Core) in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.1.0.0. The issue allows an unauthenticated attacker with network access via HTTP to compromise WebLogic Server, potentially leading to unauthorized creation, deletion or mod...

Exploit for Improper Access Control in Oracle Weblogic_Server

CVE-2024-20931 CVE-2024-20931, this is the bypass of the patch...

Oracle WebLogic Server vulnerable to HTTP header injection

Overview Oracle WebLogic Server provided by Oracle contains an HTTP header injection vulnerability CWE-113. Professional Service Department of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warnin...