CVE-2020-1938

CVE-2020-1938 (Tomcat AJP vulnerability) : The issue affects Apache Tomcat where the AJP Connector, enabled by default in several legacy releases, could be reached through untrusted networks. An attacker could exploit the configured AJP path to read arbitrary files in the web application and pote...

CVE-2019-11358

CVE-2019-11358 is a prototype pollution vulnerability in jQuery (before 3.4.0) where mishandling of extend(true, {}, ...) can extend Object.prototype if an unsanitized source object has an enumerable proto property. The Core issue is triggered when a polluted prototype is introduced via nested ob...

CVE-2017-12617

CVE-2017-12617 concerns Apache Tomcat JSP upload via HTTP PUT when readonly=false and PUTs are allowed. Affected: Tomcat 7.x/8.x/9.x (various 7.0.0–7.0.81, 8.0.0.RC1–8.0.46, 8.5.0–8.5.22, 9.0.0.M1–9.0.0) with PUT enabled. Root cause: PUT request handling allowed uploading a JSP, enabling remote c...

CVE-2020-9484

CVE-2020-9484 is a deserialization flaw in Apache Tomcat that, under a specific FileStore PersistenceManager configuration and a crafted request, can trigger remote code execution. Affected are Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, and 7.0.0 to 7.0.107 when the...

CVE-2020-1935

CVE-2020-1935 affects Apache Tomcat across multiple branches: 9.0.0.M1–9.0.30, 8.5.0–8.5.50, and 7.0.0–7.0.99. It stems from HTTP header parsing that can mishandle end-of-line and Transfer-Encoding, enabling HTTP Request Smuggling when Tomcat sits behind certain reverse proxies. Impact is informa...

CVE-2019-17563

Tomcat CVE-2019-17563: A race-condition in FORM authentication allowed a session-fixation window in Tomcat 9.0.0.M1–9.0.29, 8.5.0–8.5.49, and 7.0.0–7.0.98. The issue is acknowledged as a vulnerability with practical exploitation not detailed in the provided docs. Affected products: Apache Tomcat....

CVE-2016-8735

CVE-2016-8735 is a remote code execution vulnerability in Apache Tomcat via JmxRemoteLifecycleListener. Affected are Tomcat releases before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JMX ports are reachable. Root cause: JmxRemoteLifecycleListe...

CVE-2019-17569

CVE-2019-17569: In Apache Tomcat, a regression from refactoring in 9.0.28–9.0.30, 8.5.48–8.5.50, and 7.0.98–7.0.99 caused invalid Transfer-Encoding header handling, enabling HTTP Request Smuggling behind a misconfigured reverse proxy. Connected advisories show mitigations: Amazon Linux 2 ALAS2TOM...

CVE-2015-3195

CVE-2015-3195 affects OpenSSL’s ASN.1/TASN_DEC implementation mishandling errors from malformed X509_ATTRIBUTE data, enabling remote attackers to read memory of a CMS/PKCS#7 process. Public records show impact across multiple OpenSSL lines prior to updates: 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 bef...

CVE-2022-21480

Oracle Transportation Management (OTM) within Oracle Supply Chain is affected by CVE-2022-21480 in the User Interface on affected 6.4.3 and 6.5.1 deployments. The issue is exploitable via HTTP by an unauthenticated network-attacker, with the attack requiring user interaction, and may lead to unau...

CVE-2021-35616

CVE-2021-35616 affects Oracle Transportation Management (OTM), UI Infrastructure, version 6.4.3. A low-privilege, network-based attacker can exploit via HTTP to achieve unauthorized read, update, insert or delete of data, as described in the CVE. The base impact includes Confidentiality and Integ...

CVE-2022-39411

CVE-2022-39411 affects Oracle Transportation Management (Oracle Supply Chain) 6.4.3 and 6.5.1. A high-privilege attacker with network access over HTTP can compromise OTM, potentially exposing all or critical data. CVSS v3.1 base score 4.9 (Confidentiality impact). The information is supported by ...

CVE-2022-39420

CVE-2022-39420 affects Oracle Transportation Management (Oracle Supply Chain) with affected versions 6.4.3 and 6.5.1. The issue arises in the Data/Functional Security component and allows a low-privileged attacker with network access over HTTP to perform unauthorized updates/inserts/deletes and r...

CVE-2022-39409

Oracle Transportation Management (Oracle Supply Chain, Business Process Automation) is affected in versions 6.4.3 and 6.5.1. The vulnerability enables a high-privilege attacker with network access over HTTP to disrupt availability (partial DoS) of Oracle Transportation Management. The CVE is desc...

CVE-2022-21591

Oracle Transportation Management (OTM) UI Infrastructure is affected in versions 6.4.3 and 6.5.1. The CVE describes a low-privilege, network-accessible attacker (via HTTP) able to update/insert/delete data and cause a partial Denial of Service. The vulnerability details do not include the exact r...

CVE-2019-2487

CVE-2019-2487 affects Oracle Transportation Management inside Oracle Supply Chain Products Suite, subcomponent UI Infrastructure. The vulnerability is applicable to supported versions 6.3.7, 6.4.1, 6.4.2 and 6.4.3. It enables a low-privilege, network-accessible attacker (via HTTP) to compromise O...

CVE-2021-2476

CVE-2021-2476 affects Oracle Transportation Management (Oracle Supply Chain) with vulnerability in the Authentication component for version 6.4.3. The issue allows an unauthenticated attacker who can reach the system over HTTP to read a subset of data, as described by the CVSS 3.1 vector CVSS:3.1...

CVE-2017-3530

CVE-2017-3530 affects Oracle Transportation Manager (Oracle Supply Chain Products Suite) across multiple 6.2, 6.3.x, 6.4.x versions. The vulnerability is in the Security subcomponent and is described as allowing a high-privileged attacker with network access via HTTP to compromise the system, wit...

CVE-2018-2662

CVE-2018-2662 affects Oracle Transportation Management (OTM) within Oracle Supply Chain Products Suite. Affected versions: 6.2.11, 6.3.1–6.3.7, and 6.4.1. The vulnerability exists in the Security subcomponent and allows a low-privileged attacker with network access over HTTP to perform unauthoriz...

CVE-2019-2709

CVE-2019-2709 affects Oracle Transportation Management within Oracle Supply Chain Products Suite. Affects versions 6.3.7, 6.4.2 and 6.4.3. The vulnerability enables an unauthenticated attacker with network access over HTTP to potentially compromise data, with possible unauthorized updates, insert...

CVE-2017-10032

CVE-2017-10032 affects Oracle Transportation Management (OTM) within Oracle Supply Chain Products Suite, specifically the Access Control List subcomponent. Affected versions include 6.3.4.1, 6.3.5.1, 6.3.6.1, 6.3.7.1, 6.4.0, 6.4.1, and 6.4.2. The vulnerability can be exploited by a low-privileged...

CVE-2020-2744

CVE-2020-2744 affects Oracle Transportation Management (Oracle Supply Chain) Security component in versions 6.3.7, 6.4.2 and 6.4.3. The vulnerability enables an attacker with network access over HTTP and low privileges to compromise data, including unauthorized read and (potentially) update/inser...

CVE-2018-2823

CVE-2018-2823 affects Oracle Transportation Management (Oracle Supply Chain Products Suite), subcomponent Database, with a vulnerable version 6.4.3. The flaw allows a low-privilege, network-adjacent attacker to exploit via HTTP to cause unauthorized creation, deletion, or modification of data wit...

CVE-2016-3490

CVE-2016-3490 affects Oracle Supply Chain Products Suite’s Oracle Transportation Management (OTM) component, covering versions 6.3.0–6.4.1. The vulnerability is described as an unspecified issue that allows remote authenticated users to exfiltrate data or affect confidentiality via database-relat...

CVE-2018-2631

Oracle Transportation Management (OTM) within Oracle Supply Chain Products Suite is affected by CVE-2018-2631. Affected versions: 6.2.11, 6.3.1–6.3.7, 6.4.1–6.4.3. The vulnerability is described as a security issue in the Security subcomponent that, with network access via HTTP and low privileges...

CVE-2020-14544

CVE-2020-14544 affects Oracle Transportation Management (Oracle Supply Chain) with the affected version 6.4.3. The vulnerability allows a low-privilege, network-exposed attacker (via HTTP) to read a subset of data from Oracle Transportation Management. Root cause details are described in multiple...

CVE-2016-3470

CVE-2016-3470 affects Oracle Transportation Management (OTM) within Oracle Supply Chain Products Suite 6.4.1. The Install subcomponent is the vulnerability vector, enabling a remote authenticated user to impact confidentiality and integrity. Public documentation describes the issue as an unspecif...

CVE-2026-60583

CVE-2026-60583 affects Oracle Transportation Management (Oracle Supply Chain), specifically the Install component in version 6.5.3. The vulnerability is exploitable over a network via HTTP by a low-privilege attacker, with sufficient impact to lead to takeover of Oracle Transportation Management ...

CVE-2026-60584

Summary: CVE-2026-60584 affects Oracle Transportation Management (OTM) 6.5.3, specifically the CSV Management component. The vulnerability is exploitable over HTTP with network access by a low-privileged attacker, potentially leading to unauthorized data access, unauthorized updates/deletes, and ...

CVE-2026-60433

Oracle Transportation Management (OTM) in Oracle Supply Chain, component Integration, is affected in version 6.5.3. The vulnerability can be exploited by a high-privileged attacker with network access via HTTP to compromise OTM, potentially allowing unauthorized creation, deletion or modification...

CVE-2026-60434

CVE-2026-60434 affects Oracle Transportation Management (Oracle Supply Chain) with vulnerable component Authentication in version 6.5.3. The issue is exploitable over HTTP by a low-privilege, network-accessible attacker, leading to unauthorized read access to a subset of Oracle Transportation Man...