CVSS: 7.5EPSS: 2%CPEs: 4EXPL: 0CVE-2016-0577
https://notcve.org/view.php?id=CVE-2016-0577
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-0574. Vulnerabilidad no especificada en el componente Oracle WebLogic Server en Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3 y 12.2.1 permite a atacantes remotos afectar a la confidencialidad, la integridad y la disponibilidad a través de vectores relacionados con WLS Core Components, una vulnerabilidad diferente a CVE-2016-0574. • http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.securityfocus.com/bid/81116 http://www.securitytracker.com/id/1034716 •
CVSS: 9.8EPSS: 96%CPEs: 6EXPL: 6CVE-2015-4852 – Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
https://notcve.org/view.php?id=CVE-2015-4852
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product. El componente WLS Security en Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0 y 12.2.1.0 permite a atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado en el tráfico del protocolo T3 al puerto 7001 TCP, relacionado con oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTA: el alcance de esta CVE se limita al producto WebLogic Server. Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution. • https://www.exploit-db.com/exploits/42806 https://www.exploit-db.com/exploits/46628 https://www.exploit-db.com/exploits/44552 https://github.com/nex1less/CVE-2015-4852 http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html http://www.openwall.com/lists/oss-security/2015/11/17/19 http://www.oracle. • CWE-502: Deserialization of Untrusted Data •