[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgEKuIFRHMK0zxi74MG4brueKDApPovuv9NARl2GfUjs":3,"g5a-ex:oracle\u002Fmanaged_file_transfer@*":113,"g5a-family:oracle\u002Fmanaged_file_transfer":115},{"success":4,"data":5},true,{"product":6,"versions":27,"topVulnerabilitiesByEpss":32,"kevVulnerabilities":90,"seoMetadata":91,"meta":110},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":26},"oracle","managed_file_transfer",4,15,0,"2022-01-27",[14,18,20,23],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"12.1.3.0.0",3,false,{"version":19,"cve_count":10,"kev_count":11,"has_kev":17},"12.2.1.3.0",{"version":21,"cve_count":22,"kev_count":11,"has_kev":17},"12.2.1.4.0",11,{"version":24,"cve_count":25,"kev_count":11,"has_kev":17},"19.1.0.0.0",1,"Managed File Transfer by Oracle is a technology product with 4 tracked versions and 15 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[28,29,30,31],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":10,"kev_count":11,"has_kev":17},{"version":21,"cve_count":22,"kev_count":11,"has_kev":17},{"version":24,"cve_count":25,"kev_count":11,"has_kev":17},[33,41,48,54,58,64,69,76,81,85],{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":38,"severity":39,"isKev":17,"epssScore":40},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":42,"description":43,"publishedDate":44,"cvssScore":45,"cvssVersion":38,"severity":46,"isKev":17,"epssScore":47},"CVE-2020-13935","The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.","2020-07-14",7.5,"High",0.86608,{"cveId":49,"description":50,"publishedDate":51,"cvssScore":52,"cvssVersion":38,"severity":39,"isKev":17,"epssScore":53},"CVE-2021-33037","Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP\u002F1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","2021-07-12",5.3,0.74667,{"cveId":55,"description":56,"publishedDate":44,"cvssScore":45,"cvssVersion":38,"severity":46,"isKev":17,"epssScore":57},"CVE-2020-13934","An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP\u002F1.1 processor after the upgrade to HTTP\u002F2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.",0.64124,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":38,"severity":46,"isKev":17,"epssScore":63},"CVE-2020-9484","When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","2020-05-20",7,0.5552,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":45,"cvssVersion":38,"severity":46,"isKev":17,"epssScore":68},"CVE-2021-25122","When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.","2021-03-01",0.18114,{"cveId":70,"description":71,"publishedDate":72,"cvssScore":73,"cvssVersion":74,"severity":39,"isKev":17,"epssScore":75},"CVE-2018-1305","Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.","2018-02-23",6.5,"v3.0",0.14472,{"cveId":77,"description":78,"publishedDate":79,"cvssScore":45,"cvssVersion":38,"severity":46,"isKev":17,"epssScore":80},"CVE-2021-42340","The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","2021-10-14",0.11796,{"cveId":82,"description":83,"publishedDate":67,"cvssScore":62,"cvssVersion":38,"severity":46,"isKev":17,"epssScore":84},"CVE-2021-25329","The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.",0.09491,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":45,"cvssVersion":38,"severity":46,"isKev":17,"epssScore":89},"CVE-2019-17359","The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.","2019-10-08",0.0912,[],{"title":92,"metaDescription":93,"keywords":94,"structuredData":95},"Managed File Transfer by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Managed File Transfer by Oracle covering 4 versions with 15 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Managed File Transfer vulnerabilities, Managed File Transfer security, Managed File Transfer CVE, Oracle Managed File Transfer, Managed File Transfer threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":96,"@type":97,"name":98,"description":93,"url":99,"manufacturer":100,"applicationCategory":104,"softwareVersion":105,"mainEntity":106},"https:\u002F\u002Fschema.org","SoftwareApplication","Managed File Transfer","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fmanaged_file_transfer",{"@type":101,"name":102,"url":103},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","4 versions tracked",{"@type":107,"name":108,"description":109,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Managed File Transfer Security Vulnerabilities","Security vulnerabilities affecting Managed File Transfer by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":111,"apiVersion":112},"2026-10-17T14:01:12.397Z","3.0",{"rows":114,"total":11,"capped":17,"failed":11},[],[]]