CVE-2015-9251

The jQuery library, in versions before 3.0.0 , is vulnerable to Cross-site Scripting (XSS) attacks. The flaw occurs when a cross-domain Ajax request is performed without specifying the dataType option, which can cause the browser to execute text/javascript responses. This vulnerability has been i...

CVE-2019-11358

CVE-2019-11358 is a prototype pollution vulnerability in jQuery (before 3.4.0) where mishandling of extend(true, {}, ...) can extend Object.prototype if an unsanitized source object has an enumerable proto property. The Core issue is triggered when a polluted prototype is introduced via nested ob...

CVE-2019-10086

CVE-2019-10086 affects Apache Commons BeanUtils 1.9.2, where a BeanIntrospector addition could suppress access to the classloader via the class property on Java objects. The issue stems from not applying the suppression by default in PropertyUtilsBean, enabling potential risk across affected depl...

CVE-2017-10119

CVE-2017-10119 affects Oracle Fusion Middleware Oracle Service Bus (OSB) Web Console Design, Admin subcomponent, specifically version 11.1.1.9.0. The vulnerability allows a low-privilege, network-accessing attacker (via HTTP) to compromise OSB; successful exploitation requires user interaction. I...

CVE-2024-21246

CVE-2024-21246 affects Oracle Fusion Middleware’s Oracle Service Bus (OSB Core Functionality) in version 12.2.1.4.0. The vulnerability allows an unauthenticated attacker over HTTP with network access to compromise OSB and gain unauthorized access to sensitive data. Root cause described in connect...

CVE-2017-3507

CVE-2017-3507 affects Oracle Fusion Middleware’s Oracle Service Bus (Web Console Design) up to version 12.2.1.2.0. The vulnerability allows an unauthenticated, network-accessing attacker over HTTP to compromise Oracle Service Bus by performing unauthorized updates/inserts/deletes and reads, poten...

CVE-2019-2576

The CVE-2019-2576 vulnerability affects Oracle Fusion Middleware’s Oracle Service Bus, Web Container subcomponent, with confirmed impact on versions 11.1.1.9.0, 12.1.3.0.0, and 12.2.1.3.0. The issue allows an unauthenticated attacker who can reach the service over HTTP to compromise Oracle Servic...