[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg6MVeE0EjFF2C--9tXhaxsptMN7aF97mxVqrPlVv4Xs":3,"g5a-ex:oracle\u002Fapplication_testing_suite@*":141,"g5a-family:oracle\u002Fapplication_testing_suite":147},{"success":4,"data":5},true,{"product":6,"versions":43,"topVulnerabilitiesByEpss":54,"kevVulnerabilities":113,"seoMetadata":119,"meta":138},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":42},"oracle","application_testing_suite",10,71,1,"2021-07-21",[14,18,21,23,26,29,31,33,36,39],{"version":15,"cve_count":11,"kev_count":16,"has_kev":17},"10.1",0,false,{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},"12.4.0.2",14,{"version":22,"cve_count":11,"kev_count":16,"has_kev":17},"12.5.0.1",{"version":24,"cve_count":25,"kev_count":16,"has_kev":17},"12.5.0.2",15,{"version":27,"cve_count":28,"kev_count":16,"has_kev":17},"12.5.0.3",16,{"version":30,"cve_count":20,"kev_count":16,"has_kev":17},"13.1.0.1",{"version":32,"cve_count":11,"kev_count":16,"has_kev":17},"13.2",{"version":34,"cve_count":35,"kev_count":16,"has_kev":17},"13.2.0.1",17,{"version":37,"cve_count":38,"kev_count":16,"has_kev":17},"13.3",2,{"version":40,"cve_count":41,"kev_count":11,"has_kev":4},"13.3.0.1",55,"Application Testing Suite by Oracle is a technology product with 10 tracked versions and 71 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[44,45,46,47,48,49,50,51,52,53],{"version":15,"cve_count":11,"kev_count":16,"has_kev":17},{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},{"version":22,"cve_count":11,"kev_count":16,"has_kev":17},{"version":24,"cve_count":25,"kev_count":16,"has_kev":17},{"version":27,"cve_count":28,"kev_count":16,"has_kev":17},{"version":30,"cve_count":20,"kev_count":16,"has_kev":17},{"version":32,"cve_count":11,"kev_count":16,"has_kev":17},{"version":34,"cve_count":35,"kev_count":16,"has_kev":17},{"version":37,"cve_count":38,"kev_count":16,"has_kev":17},{"version":40,"cve_count":41,"kev_count":11,"has_kev":4},[55,63,70,77,84,89,94,99,103,108],{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":60,"severity":61,"isKev":17,"epssScore":62},"CVE-2020-11022","In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.1,"v3.1","Medium",0.99215,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"cvssVersion":68,"severity":61,"isKev":17,"epssScore":69},"CVE-2016-0492","Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0488.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function, which allows remote attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication, as demonstrated by olt\u002FLogin.do\u002F..\u002F..\u002Folt\u002FUploadFileUpload.do.","2016-01-21",6.4,"v2",0.92145,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":60,"severity":75,"isKev":17,"epssScore":76},"CVE-2019-0227","A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","2019-05-01",7.5,"High",0.9194,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":81,"cvssVersion":60,"severity":82,"isKev":17,"epssScore":83},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",9.8,"Critical",0.89792,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":74,"cvssVersion":60,"severity":75,"isKev":17,"epssScore":88},"CVE-2020-5398","In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input.","2020-01-17",0.88768,{"cveId":90,"description":91,"publishedDate":92,"cvssScore":59,"cvssVersion":60,"severity":61,"isKev":17,"epssScore":93},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",0.8682,{"cveId":95,"description":96,"publishedDate":58,"cvssScore":97,"cvssVersion":60,"severity":61,"isKev":4,"epssScore":98},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",6.9,0.84887,{"cveId":100,"description":101,"publishedDate":66,"cvssScore":67,"cvssVersion":68,"severity":61,"isKev":17,"epssScore":102},"CVE-2016-0491","Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.",0.79948,{"cveId":104,"description":105,"publishedDate":106,"cvssScore":81,"cvssVersion":60,"severity":82,"isKev":17,"epssScore":107},"CVE-2018-1270","Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.","2018-04-06",0.77476,{"cveId":109,"description":110,"publishedDate":111,"cvssScore":81,"cvssVersion":60,"severity":82,"isKev":17,"epssScore":112},"CVE-2019-17571","Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.","2019-12-20",0.6998,[114],{"cveId":95,"description":96,"publishedDate":58,"cvssScore":97,"severity":61,"isKev":4,"epssScore":98,"cisaVulnName":115,"cisaDateAdded":116,"cisaShortDescription":117,"cisaRequiredAction":118},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"title":120,"metaDescription":121,"keywords":122,"structuredData":123},"Application Testing Suite by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Application Testing Suite by Oracle covering 10 versions with 71 tracked vulnerabilities and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Application Testing Suite vulnerabilities, Application Testing Suite security, Application Testing Suite CVE, Oracle Application Testing Suite, Application Testing Suite threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Application Testing Suite KEV, Application Testing Suite exploited vulnerabilities",{"@context":124,"@type":125,"name":126,"description":121,"url":127,"manufacturer":128,"applicationCategory":132,"softwareVersion":133,"mainEntity":134},"https:\u002F\u002Fschema.org","SoftwareApplication","Application Testing Suite","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fapplication_testing_suite",{"@type":129,"name":130,"url":131},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","10 versions tracked",{"@type":135,"name":136,"description":137,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Application Testing Suite Security Vulnerabilities","Security vulnerabilities affecting Application Testing Suite by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":139,"apiVersion":140},"2026-10-17T14:43:13.993Z","3.0",{"rows":142,"total":11,"capped":17,"failed":16},[143],{"cveId":95,"name":115,"severity":61,"cvss":97,"added":116,"epss":98,"published":144,"ranges":145,"checked":4,"hits":146,"covers":17},"2020-04-29T21:15:11.743",[40],[],[]]