[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO0n0kU7ZHC2G0L5WVdlE1b_2lnxURDCPwgDqG5qTSn8":3,"g5a-family:oracle\u002Fcoherence":146,"g5a-ex:oracle\u002Fcoherence@*":147},{"success":4,"data":5},true,{"product":6,"versions":45,"topVulnerabilitiesByEpss":58,"kevVulnerabilities":118,"seoMetadata":124,"meta":143},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":44},"oracle","coherence",12,16,1,"2022-07-19",[14,18,21,23,25,27,30,33,36,38,40,42],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"12.1.2",0,false,{"version":19,"cve_count":20,"kev_count":11,"has_kev":4},"12.1.3.0.0",9,{"version":22,"cve_count":16,"kev_count":16,"has_kev":17},"12.2.1",{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},"12.2.1.1.0",{"version":26,"cve_count":16,"kev_count":16,"has_kev":17},"12.2.1.2.0",{"version":28,"cve_count":29,"kev_count":11,"has_kev":4},"12.2.1.3.0",11,{"version":31,"cve_count":32,"kev_count":11,"has_kev":4},"12.2.1.4.0",15,{"version":34,"cve_count":35,"kev_count":16,"has_kev":17},"14.1.1.0.0",13,{"version":37,"cve_count":16,"kev_count":16,"has_kev":17},"3.4.2",{"version":39,"cve_count":16,"kev_count":16,"has_kev":17},"3.5.3",{"version":41,"cve_count":16,"kev_count":16,"has_kev":17},"3.6.1",{"version":43,"cve_count":20,"kev_count":11,"has_kev":4},"3.7.1.0","Coherence by Oracle is a technology product with 12 tracked versions and 16 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[46,47,48,49,50,51,52,53,54,55,56,57],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":20,"kev_count":11,"has_kev":4},{"version":22,"cve_count":16,"kev_count":16,"has_kev":17},{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},{"version":26,"cve_count":16,"kev_count":16,"has_kev":17},{"version":28,"cve_count":29,"kev_count":11,"has_kev":4},{"version":31,"cve_count":32,"kev_count":11,"has_kev":4},{"version":34,"cve_count":35,"kev_count":16,"has_kev":17},{"version":37,"cve_count":16,"kev_count":16,"has_kev":17},{"version":39,"cve_count":16,"kev_count":16,"has_kev":17},{"version":41,"cve_count":16,"kev_count":16,"has_kev":17},{"version":43,"cve_count":20,"kev_count":11,"has_kev":4},[59,67,72,79,84,91,96,102,107,112],{"cveId":60,"description":61,"publishedDate":62,"cvssScore":63,"cvssVersion":64,"severity":65,"isKev":4,"epssScore":66},"CVE-2020-2555","Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2020-01-15",9.8,"v3.1","Critical",0.97116,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":63,"cvssVersion":64,"severity":65,"isKev":17,"epssScore":71},"CVE-2020-14756","Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2021-01-20",0.74753,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"cvssVersion":64,"severity":77,"isKev":17,"epssScore":78},"CVE-2020-25649","A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.","2020-12-03",7.5,"High",0.17714,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":76,"cvssVersion":64,"severity":77,"isKev":17,"epssScore":83},"CVE-2021-37136","The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack","2021-10-19",0.05908,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":88,"cvssVersion":64,"severity":89,"isKev":17,"epssScore":90},"CVE-2021-21409","Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP\u002F1.1. This is a followup of GHSA-wm47-8v5p-wjpj\u002FCVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.","2021-03-30",5.9,"Medium",0.04935,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":76,"cvssVersion":64,"severity":77,"isKev":17,"epssScore":95},"CVE-2020-36518","jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.","2022-03-11",0.0486,{"cveId":97,"description":98,"publishedDate":99,"cvssScore":100,"cvssVersion":64,"severity":89,"isKev":17,"epssScore":101},"CVE-2021-43797","Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning \u002F end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to \"sanitize\" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.","2021-12-09",6.5,0.02884,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":63,"cvssVersion":64,"severity":65,"isKev":17,"epssScore":106},"CVE-2020-2915","Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore, Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2020-04-15",0.01961,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":76,"cvssVersion":64,"severity":77,"isKev":17,"epssScore":111},"CVE-2020-14642","Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: CacheStore). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H).","2020-07-15",0.01577,{"cveId":113,"description":114,"publishedDate":115,"cvssScore":116,"cvssVersion":64,"severity":77,"isKev":17,"epssScore":117},"CVE-2021-2428","Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2021-07-21",8.1,0.01561,[119],{"cveId":60,"description":61,"publishedDate":62,"cvssScore":63,"severity":65,"isKev":4,"epssScore":66,"cisaVulnName":120,"cisaDateAdded":121,"cisaShortDescription":122,"cisaRequiredAction":123},"Oracle Multiple Products Remote Code Execution Vulnerability","2021-11-03","Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).","Apply updates per vendor instructions.",{"title":125,"metaDescription":126,"keywords":127,"structuredData":128},"Coherence by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Coherence by Oracle covering 12 versions with 16 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Coherence vulnerabilities, Coherence security, Coherence CVE, Oracle Coherence, Coherence threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Coherence KEV, Coherence exploited vulnerabilities",{"@context":129,"@type":130,"name":131,"description":126,"url":132,"manufacturer":133,"applicationCategory":137,"softwareVersion":138,"mainEntity":139},"https:\u002F\u002Fschema.org","SoftwareApplication","Coherence","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcoherence",{"@type":134,"name":135,"url":136},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","12 versions tracked",{"@type":140,"name":141,"description":142,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Coherence Security Vulnerabilities","Security vulnerabilities affecting Coherence by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":144,"apiVersion":145},"2026-10-17T12:49:16.694Z","3.0",[],{"rows":148,"total":11,"capped":17,"failed":16},[149],{"cveId":60,"name":120,"severity":65,"cvss":63,"added":121,"epss":66,"published":150,"ranges":151,"checked":4,"hits":152,"covers":17},"2020-01-15T17:15:17.347",[43,19,28,31],[]]