[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd-rPofUTKLOrbodCffe4m9jmNftBSwljNGG5kdnI2lg":3,"g5a-ex:oracle\u002Frest_data_services@*":144,"g5a-family:oracle\u002Frest_data_services":149},{"success":4,"data":5},true,{"product":6,"versions":44,"topVulnerabilitiesByEpss":57,"kevVulnerabilities":116,"seoMetadata":122,"meta":141},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":43},"oracle","rest_data_services",12,23,1,"2021-10-26",[14,17,19,21,23,26,30,32,34,36,38,41],{"version":15,"cve_count":16,"kev_count":11,"has_kev":4},"11.2.0.4",9,{"version":18,"cve_count":16,"kev_count":11,"has_kev":4},"12.1.0.2",{"version":20,"cve_count":16,"kev_count":11,"has_kev":4},"12.2.0.1",{"version":22,"cve_count":16,"kev_count":11,"has_kev":4},"18c",{"version":24,"cve_count":25,"kev_count":11,"has_kev":4},"19c",4,{"version":27,"cve_count":28,"kev_count":28,"has_kev":29},"20.2.1",0,false,{"version":31,"cve_count":28,"kev_count":28,"has_kev":29},"20.4.3.050.1904",{"version":33,"cve_count":28,"kev_count":28,"has_kev":29},"21.2",{"version":35,"cve_count":11,"kev_count":28,"has_kev":29},"21.2.4",{"version":37,"cve_count":11,"kev_count":28,"has_kev":29},"21.3",{"version":39,"cve_count":40,"kev_count":28,"has_kev":29},"22.1.1",3,{"version":42,"cve_count":28,"kev_count":28,"has_kev":29},"24.2.0","Rest Data Services by Oracle is a technology product with 12 tracked versions and 23 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[45,46,47,48,49,50,51,52,53,54,55,56],{"version":15,"cve_count":16,"kev_count":11,"has_kev":4},{"version":18,"cve_count":16,"kev_count":11,"has_kev":4},{"version":20,"cve_count":16,"kev_count":11,"has_kev":4},{"version":22,"cve_count":16,"kev_count":11,"has_kev":4},{"version":24,"cve_count":25,"kev_count":11,"has_kev":4},{"version":27,"cve_count":28,"kev_count":28,"has_kev":29},{"version":31,"cve_count":28,"kev_count":28,"has_kev":29},{"version":33,"cve_count":28,"kev_count":28,"has_kev":29},{"version":35,"cve_count":11,"kev_count":28,"has_kev":29},{"version":37,"cve_count":11,"kev_count":28,"has_kev":29},{"version":39,"cve_count":40,"kev_count":28,"has_kev":29},{"version":42,"cve_count":28,"kev_count":28,"has_kev":29},[58,66,72,78,83,89,96,101,105,112],{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":63,"severity":64,"isKev":29,"epssScore":65},"CVE-2021-34429","For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and\u002For bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164\u002FGHSA-v7ff-8wcx-gmc5.","2021-07-15",5.3,"v3.1","Medium",0.99298,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"cvssVersion":63,"severity":64,"isKev":29,"epssScore":71},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",6.1,0.8682,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"cvssVersion":63,"severity":64,"isKev":4,"epssScore":77},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.9,0.84887,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":62,"cvssVersion":63,"severity":64,"isKev":29,"epssScore":82},"CVE-2021-28169","For Eclipse Jetty versions \u003C= 9.4.40, \u003C= 10.0.2, \u003C= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `\u002Fconcat?\u002F%2557EB-INF\u002Fweb.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","2021-06-09",0.7848,{"cveId":84,"description":85,"publishedDate":86,"cvssScore":87,"cvssVersion":63,"severity":64,"isKev":29,"epssScore":88},"CVE-2020-27223","In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.","2021-02-26",5.2,0.78031,{"cveId":90,"description":91,"publishedDate":92,"cvssScore":93,"cvssVersion":63,"severity":94,"isKev":29,"epssScore":95},"CVE-2021-28165","In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.","2021-04-01",7.5,"High",0.53861,{"cveId":97,"description":98,"publishedDate":12,"cvssScore":99,"cvssVersion":63,"severity":64,"isKev":29,"epssScore":100},"CVE-2021-41184","jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.",6.5,0.40768,{"cveId":102,"description":103,"publishedDate":12,"cvssScore":70,"cvssVersion":63,"severity":64,"isKev":29,"epssScore":104},"CVE-2021-41182","jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.",0.39361,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":63,"severity":110,"isKev":29,"epssScore":111},"CVE-2017-7658","In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP\u002F1.x configurations), and 9.4.x (all HTTP\u002F1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.","2018-06-26",9.8,"Critical",0.19362,{"cveId":113,"description":114,"publishedDate":108,"cvssScore":109,"cvssVersion":63,"severity":110,"isKev":29,"epssScore":115},"CVE-2017-7657","In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.",0.14879,[117],{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"severity":64,"isKev":4,"epssScore":77,"cisaVulnName":118,"cisaDateAdded":119,"cisaShortDescription":120,"cisaRequiredAction":121},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"title":123,"metaDescription":124,"keywords":125,"structuredData":126},"Rest Data Services by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Rest Data Services by Oracle covering 12 versions with 23 tracked vulnerabilities and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Rest Data Services vulnerabilities, Rest Data Services security, Rest Data Services CVE, Oracle Rest Data Services, Rest Data Services threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Rest Data Services KEV, Rest Data Services exploited vulnerabilities",{"@context":127,"@type":128,"name":129,"description":124,"url":130,"manufacturer":131,"applicationCategory":135,"softwareVersion":136,"mainEntity":137},"https:\u002F\u002Fschema.org","SoftwareApplication","Rest Data Services","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Frest_data_services",{"@type":132,"name":133,"url":134},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","12 versions tracked",{"@type":138,"name":139,"description":140,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Rest Data Services Security Vulnerabilities","Security vulnerabilities affecting Rest Data Services by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":142,"apiVersion":143},"2026-10-17T12:38:04.548Z","3.0",{"rows":145,"total":11,"capped":29,"failed":11},[146],{"cveId":73,"name":118,"severity":64,"cvss":76,"added":119,"epss":77,"published":75,"ranges":147,"hits":148,"checked":29,"covers":29},[],[],[]]