CVE-2016-0492

CVE-2016-0492 affects Oracle Application Testing Suite (ATS) within Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2. The vulnerability enables remote attackers to bypass authentication and potentially access or modify data through a directory traversal scenario involving the isAllowe...

CVE-2016-0484

CVE-2016-0484 affects Oracle Application Testing Suite (in Oracle Enterprise Manager Grid Control) with a DownloadServlet scriptPath directory traversal in 12.4.0.2/12.5.0.2. Exploitation described in ZDI-16-034 and CPAI-2016-0342 indicates remote, unauthenticated file exfiltration via scriptPath...

CVE-2019-2727

Oracle Application Testing Suite (subcomponent: Load Testing for Web Apps) in Oracle Enterprise Manager Products Suite, version 13.3, is affected by CVE-2019-2727. The vulnerability allows unauthenticated, network-based access via HTTP to compromise data: unauthorized update/insert/delete and rea...

CVE-2016-0488

CVE-2016-0488 affects the Oracle Application Testing Suite component within Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2. The description describes an unspecified vulnerability impacting confidentiality and integrity via load testing for web apps; specific attack vectors are not p...

CVE-2019-2557

CVE-2019-2557 affects the Oracle Application Testing Suite (OATS) Load Testing for Web Apps, specifically version 13.3.0.1. The Red Hat/Oracle records describe a post-auth vulnerability in the DownloadServlet used to serve templates (mapped at /download). An authenticated (post-auth) attacker can...

CVE-2018-3304

CVE-2018-3304 affects the Oracle Application Testing Suite Load Testing for Web Apps in Oracle Enterprise Manager Products Suite (affected versions include 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1). The vulnerability allows an unauthenticated attacker, over HTTP, to perform unauthorized updates/ins...

CVE-2016-0486

CVE-2016-0486 affects Oracle Application Testing Suite (ATS) on Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2. The vulnerability is a directory traversal in the DownloadServlet, exploited via the exportFileName parameter, allowing a remote unauthenticated attacker to read arbitrary...

CVE-2016-0490

CVE-2016-0490 concerns Oracle Application Testing Suite within Oracle Enterprise Manager Grid Control (versions 12.4.0.2 and 12.5.0.2). Public sources describe a directory traversal flaw in the UploadServlet servlet, triggered via crafted filename headers, enabling remote attackers to upload and ...

CVE-2018-15769

CVE-2018-15769 affects RSA BSAFE Micro Edition Suite: versions before 4.0.11 (4.0.x) and before 4.1.6.2 (4.1.x). The issue is a key management flaw that can allow a TLS server using Ephemeral/Anonymous Diffie-Hellman (DHE/ADH) ciphers to cause a Denial-of-Service on TLS clients during the handsha...

CVE-2018-11055

RSA BSAFE Micro Edition Suite (MES) contains an Improper Clearing of Heap Memory Before Release vulnerability in MES versions 4.0.x before 4.0.11 and 4.1.x before 4.1.6.1. Decoded PKCS#12 data in heap memory is not zeroized before memory release, enabling a local attacker to access previously dec...

CVE-2016-0489

Summary: CVE-2016-0489 affects Oracle Application Testing Suite (Test Manager for Web Apps) in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2. The connected sources describe a directory traversal vulnerability in the ReportImage action via the tempfilename parameter in ActionServlet...

CVE-2018-11056

The CVE describes a DoS risk in Dell EMC RSA BSAFE Micro Edition Suite (MES) before 4.1.6.1 (4.1.x line) and RSA BSAFE Crypto-C Micro Edition before 4.0.5.3 (4.0.x line). The vulnerability is an Uncontrolled Resource Consumption (Resource Exhaustion) when parsing ASN.1 data, allowing a remote att...

CVE-2018-3305

CVE-2018-3305 | A vulnerability in Oracle Application Testing Suite Load Testing for Web Apps (Oracle Enterprise Manager Products Suite) is documented. The issue affects versions 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1 and is tied to the Load Testing for Web Apps subcomponent. The connected SRC...

CVE-2018-11054

CVE-2018-11054 affects RSA BSAFE Micro Edition Suite (MES) 4.1.6. An integer overflow vulnerability exists in the MES ASN.1 processing, allowing a remote attacker to trigger a Denial of Service by sending maliciously constructed ASN.1 data. The provided documents confirm the vulnerability details...

CVE-2016-0480

Oracle Application Testing Suite (ATS) versions 12.4.0.2 and 12.5.0.2 expose a directory-traversal vulnerability in the DownloadServlet when processing the TMAPReportImage parameter (CVE-2016-0480). Exploitation allows remote unauthenticated attackers to read arbitrary files from the server. The ...

CVE-2016-0487

CVE-2016-0487 affects Oracle Application Testing Suite within Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2. The issue is an authentication bypass in the ActionServlet component (via directory traversal sequences following an unspecified URI), potentially allowing remote attackers ...

CVE-2020-2673

CVE-2020-2673 affects Oracle Application Testing Suite (Oracle Flow Builder) with affected versions 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1. The vulnerability allows an unauthenticated attacker over HTTP to access critical data or take full control of the Oracle ATS exposed data, per CVSSv3.0 b...

CVE-2016-0478

CVE-2016-0478 corresponds to a directory traversal vulnerability in Oracle Application Testing Suite’s DownloadServlet. Affected products/versions cited: Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2, involving the DownloadServlet scriptName parameter; exploitation could allow read...

CVE-2017-3311

The CVE-2017-3311 entry affects Oracle Enterprise Manager Grid Control, specifically the Application Testing Suite component (Test Manager for Web Apps). Affected versions are 12.5.0.3, 12.5.0.2, and 12.4.0.2. The vulnerability allows an unauthenticated attacker with network access via HTTP to co...

CVE-2018-11057

CVE-2018-11057 affects Dell EMC RSA BSAFE Micro Edition Suite (MES) versions before 4.0.11 (in 4.0.x) and before 4.1.6.1 (in 4.1.x). The vulnerability is a covert timing channel during RSA decryption, i.e., Bleichenbacher-style timing leakage, enabling a remote attacker to recover an RSA key. The...

CVE-2016-0485

The CVE-2016-0485 issue affects Oracle Application Testing Suite (ATS) in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2. It is described as a directory traversal vulnerability in the DownloadServlet that can be triggered via the /otm/download endpoint using the reportName parameter...

CVE-2026-46924

CVE-2026-46924 affects Oracle Application Testing Suite (ATS) 13.3.0.1. The vulnerability allows an unauthenticated attacker with network access via TCP to compromise ATS, enabling takeover with high impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8 (CRITICAL)...

CVE-2026-35287

Affected product: Oracle Application Testing Suite 13.3.0.1. Description shows an unauthenticated, network-accessible vulnerability via TCP that can lead to unauthorized data access. CVSS v3.1 base score 7.5 (ConfidentialityImpact H). No concrete root cause, vulnerable component, or remediation d...

CVE-2026-46876

CVE-2026-46876 affects Oracle Application Testing Suite, specifically version 13.3.0.1. The vulnerability is described as easily exploitable with unauthenticated network access via Oracle Net, allowing takeover of Oracle Application Testing Suite and carrying a CVSS v3.1 base score of 9.8 (C/H/I/...

CVE-2026-35290

CVE-2026-35290 affects Oracle Application Testing Suite, version 13.3.0.1. The vulnerability allows an unauthenticated attacker with network access via TCP to compromise the suite, with potential takeover and a CVSS v3.1 base score of 9.8 (C­: H, I: H, A: H). Connected sources confirm the same af...

CVE-2026-70863

Oracle Application Testing Suite version 13.3.0.1 is affected by a vulnerability allowing a low-privileged attacker with the Load Testing for Web Apps privilege to achieve complete system takeover via network access over HTTPS . The attack requires no user interaction and has low complexity, resu...

CVE-2026-70865

A network-accessible vulnerability in Oracle Application Testing Suite 13.3.0.1 allows a low-privileged attacker (with "Load Testing for Web Apps" privilege) over HTTPS to achieve full system takeover, with HIGH impacts across confidentiality, integrity, and availability (CVSS 7.5). Oracle has re...

CVE-2026-70868

Oracle Application Testing Suite 13.3.0.1 has a HIGH-severity (CVSS 8.1) network-reachable flaw exploitable by unauthenticated attackers via HTTP, potentially allowing full system takeover. Oracle published patch guidance in its August 2026 security advisory (cspuaug2026.html). No exploitation de...

CVE-2026-70862

CVE-2026-70862 is a critical vulnerability in Oracle Application Testing Suite version 13.3.0.1 . An unauthenticated attacker with network access via HTTP can exploit this with low complexity to achieve unauthorized creation, deletion, or modification of critical data, as well as complete access ...

CVE-2026-70866

Oracle Application Testing Suite version 13.3.0.1 is affected by a local privilege escalation vulnerability exploitable by a low-privileged attacker with the "Load Testing for Web Apps" privilege. The flaw carries a CVSS 3.1 Base Score of 7.8 (HIGH) with full confidentiality, integrity, and avail...

CVE-2026-70867

Oracle Application Testing Suite 13.3.0.1 has an easily exploitable flaw allowing unauthenticated attackers on the adjacent physical network segment to compromise the system, achieving high confidentiality impact and low integrity impact. Patch details are not provided; refer to Oracle's August 2...

CVE-2026-70864

Oracle Application Testing Suite 13.3.0.1 contains a vulnerability in the Load Testing for Web Apps component. A low-privileged attacker with network access via HTTP can exploit this with low complexity, though user interaction is required. The scope change means successful exploitation can impac...