[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDqLnI2r4ynzjBJ4ATWvW2HlaY3y2N-RppHnh8iAZOBg":3,"g5a-family:oracle\u002Fsiebel_ui_framework":193,"g5a-ex:oracle\u002Fsiebel_ui_framework@*":194},{"success":4,"data":5},true,{"product":6,"versions":77,"topVulnerabilitiesByEpss":106,"kevVulnerabilities":165,"seoMetadata":171,"meta":190},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":76},"oracle","siebel_ui_framework",28,53,1,"2021-12-28",[14,19,22,24,26,28,30,33,35,37,39,41,43,45,47,49,51,53,55,57,59,61,63,65,67,69,71,74],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"16.0",5,0,false,{"version":20,"cve_count":21,"kev_count":17,"has_kev":18},"16.1",3,{"version":23,"cve_count":16,"kev_count":17,"has_kev":18},"17.0",{"version":25,"cve_count":11,"kev_count":17,"has_kev":18},"18.0",{"version":27,"cve_count":11,"kev_count":17,"has_kev":18},"18.10",{"version":29,"cve_count":11,"kev_count":17,"has_kev":18},"18.11",{"version":31,"cve_count":32,"kev_count":17,"has_kev":18},"18.7",2,{"version":34,"cve_count":32,"kev_count":17,"has_kev":18},"18.8",{"version":36,"cve_count":32,"kev_count":17,"has_kev":18},"18.9",{"version":38,"cve_count":17,"kev_count":17,"has_kev":18},"19.0",{"version":40,"cve_count":17,"kev_count":17,"has_kev":18},"19.10",{"version":42,"cve_count":17,"kev_count":17,"has_kev":18},"19.7",{"version":44,"cve_count":17,"kev_count":17,"has_kev":18},"19.8",{"version":46,"cve_count":17,"kev_count":17,"has_kev":18},"20.1",{"version":48,"cve_count":17,"kev_count":17,"has_kev":18},"20.12",{"version":50,"cve_count":16,"kev_count":17,"has_kev":18},"2014",{"version":52,"cve_count":16,"kev_count":17,"has_kev":18},"2015",{"version":54,"cve_count":16,"kev_count":17,"has_kev":18},"2016",{"version":56,"cve_count":17,"kev_count":17,"has_kev":18},"20.2",{"version":58,"cve_count":17,"kev_count":17,"has_kev":18},"20.5",{"version":60,"cve_count":11,"kev_count":17,"has_kev":18},"20.6",{"version":62,"cve_count":32,"kev_count":17,"has_kev":18},"20.8",{"version":64,"cve_count":17,"kev_count":17,"has_kev":18},"21.0",{"version":66,"cve_count":11,"kev_count":17,"has_kev":18},"21.12",{"version":68,"cve_count":17,"kev_count":17,"has_kev":18},"21.2",{"version":70,"cve_count":11,"kev_count":17,"has_kev":18},"21.9",{"version":72,"cve_count":73,"kev_count":17,"has_kev":18},"8.1.1",6,{"version":75,"cve_count":73,"kev_count":17,"has_kev":18},"8.2.2","Siebel Ui Framework by Oracle is a technology product with 28 tracked versions and 53 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":21,"kev_count":17,"has_kev":18},{"version":23,"cve_count":16,"kev_count":17,"has_kev":18},{"version":25,"cve_count":11,"kev_count":17,"has_kev":18},{"version":27,"cve_count":11,"kev_count":17,"has_kev":18},{"version":29,"cve_count":11,"kev_count":17,"has_kev":18},{"version":31,"cve_count":32,"kev_count":17,"has_kev":18},{"version":34,"cve_count":32,"kev_count":17,"has_kev":18},{"version":36,"cve_count":32,"kev_count":17,"has_kev":18},{"version":38,"cve_count":17,"kev_count":17,"has_kev":18},{"version":40,"cve_count":17,"kev_count":17,"has_kev":18},{"version":42,"cve_count":17,"kev_count":17,"has_kev":18},{"version":44,"cve_count":17,"kev_count":17,"has_kev":18},{"version":46,"cve_count":17,"kev_count":17,"has_kev":18},{"version":48,"cve_count":17,"kev_count":17,"has_kev":18},{"version":50,"cve_count":16,"kev_count":17,"has_kev":18},{"version":52,"cve_count":16,"kev_count":17,"has_kev":18},{"version":54,"cve_count":16,"kev_count":17,"has_kev":18},{"version":56,"cve_count":17,"kev_count":17,"has_kev":18},{"version":58,"cve_count":17,"kev_count":17,"has_kev":18},{"version":60,"cve_count":11,"kev_count":17,"has_kev":18},{"version":62,"cve_count":32,"kev_count":17,"has_kev":18},{"version":64,"cve_count":17,"kev_count":17,"has_kev":18},{"version":66,"cve_count":11,"kev_count":17,"has_kev":18},{"version":68,"cve_count":17,"kev_count":17,"has_kev":18},{"version":70,"cve_count":11,"kev_count":17,"has_kev":18},{"version":72,"cve_count":73,"kev_count":17,"has_kev":18},{"version":75,"cve_count":73,"kev_count":17,"has_kev":18},[107,115,122,128,133,140,145,150,155,159],{"cveId":108,"description":109,"publishedDate":110,"cvssScore":111,"cvssVersion":112,"severity":113,"isKev":18,"epssScore":114},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":116,"description":117,"publishedDate":118,"cvssScore":119,"cvssVersion":112,"severity":120,"isKev":4,"epssScore":121},"CVE-2020-1938","When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","2020-02-24",9.8,"Critical",0.9927,{"cveId":123,"description":124,"publishedDate":125,"cvssScore":126,"cvssVersion":112,"severity":113,"isKev":18,"epssScore":127},"CVE-2020-11022","In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.1,0.99215,{"cveId":129,"description":130,"publishedDate":12,"cvssScore":131,"cvssVersion":112,"severity":113,"isKev":18,"epssScore":132},"CVE-2021-44832","Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",6.6,0.97906,{"cveId":134,"description":135,"publishedDate":136,"cvssScore":137,"cvssVersion":112,"severity":138,"isKev":18,"epssScore":139},"CVE-2019-0227","A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","2019-05-01",7.5,"High",0.9194,{"cveId":141,"description":142,"publishedDate":143,"cvssScore":119,"cvssVersion":112,"severity":120,"isKev":18,"epssScore":144},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",0.89792,{"cveId":146,"description":147,"publishedDate":148,"cvssScore":126,"cvssVersion":112,"severity":113,"isKev":18,"epssScore":149},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",0.8682,{"cveId":151,"description":152,"publishedDate":153,"cvssScore":137,"cvssVersion":112,"severity":138,"isKev":18,"epssScore":154},"CVE-2020-13935","The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.","2020-07-14",0.86608,{"cveId":156,"description":157,"publishedDate":153,"cvssScore":137,"cvssVersion":112,"severity":138,"isKev":18,"epssScore":158},"CVE-2020-13934","An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP\u002F1.1 processor after the upgrade to HTTP\u002F2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.",0.64124,{"cveId":160,"description":161,"publishedDate":162,"cvssScore":163,"cvssVersion":112,"severity":138,"isKev":18,"epssScore":164},"CVE-2020-9484","When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","2020-05-20",7,0.5552,[166],{"cveId":116,"description":117,"publishedDate":118,"cvssScore":119,"severity":120,"isKev":4,"epssScore":121,"cisaVulnName":167,"cisaDateAdded":168,"cisaShortDescription":169,"cisaRequiredAction":170},"Apache Tomcat Improper Privilege Management Vulnerability","2022-03-03","Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.","Apply updates per vendor instructions.",{"title":172,"metaDescription":173,"keywords":174,"structuredData":175},"Siebel Ui Framework by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Siebel Ui Framework by Oracle covering 28 versions with 53 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Siebel Ui Framework vulnerabilities, Siebel Ui Framework security, Siebel Ui Framework CVE, Oracle Siebel Ui Framework, Siebel Ui Framework threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Siebel Ui Framework KEV, Siebel Ui Framework exploited vulnerabilities",{"@context":176,"@type":177,"name":178,"description":173,"url":179,"manufacturer":180,"applicationCategory":184,"softwareVersion":185,"mainEntity":186},"https:\u002F\u002Fschema.org","SoftwareApplication","Siebel Ui Framework","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fsiebel_ui_framework",{"@type":181,"name":182,"url":183},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","28 versions tracked",{"@type":187,"name":188,"description":189,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Siebel Ui Framework Security Vulnerabilities","Security vulnerabilities affecting Siebel Ui Framework by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":191,"apiVersion":192},"2026-10-18T20:37:57.294Z","3.0",[],{"rows":195,"total":11,"capped":18,"failed":17},[196],{"cveId":116,"name":167,"severity":120,"cvss":119,"added":168,"epss":121,"published":197,"ranges":198,"checked":4,"hits":200,"covers":18},"2020-02-24T22:15:12.057",[199],"up to 20.5",[]]