[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fohWN2y80JW9-qv1sGMBAMyt5NVzGIykP53Qw6EfQGA4":3,"g5a-family:oracle\u002Ftransportation_management":186,"g5a-ex:oracle\u002Ftransportation_management@*":187},{"success":4,"data":5},true,{"product":6,"versions":68,"topVulnerabilitiesByEpss":91,"kevVulnerabilities":151,"seoMetadata":164,"meta":183},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":67},"oracle","transportation_management",22,27,3,"2022-10-18",[14,19,21,24,26,28,31,33,35,37,39,41,43,45,47,50,52,54,56,59,61,64],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"1.4.3",1,0,false,{"version":20,"cve_count":16,"kev_count":17,"has_kev":18},"6.1",{"version":22,"cve_count":23,"kev_count":17,"has_kev":18},"6.2",2,{"version":25,"cve_count":23,"kev_count":17,"has_kev":18},"6.2.11",{"version":27,"cve_count":11,"kev_count":16,"has_kev":4},"6.3.0",{"version":29,"cve_count":30,"kev_count":23,"has_kev":4},"6.3.1",6,{"version":32,"cve_count":30,"kev_count":23,"has_kev":4},"6.3.2",{"version":34,"cve_count":30,"kev_count":23,"has_kev":4},"6.3.3",{"version":36,"cve_count":30,"kev_count":23,"has_kev":4},"6.3.4",{"version":38,"cve_count":16,"kev_count":17,"has_kev":18},"6.3.4.1",{"version":40,"cve_count":30,"kev_count":23,"has_kev":4},"6.3.5",{"version":42,"cve_count":16,"kev_count":17,"has_kev":18},"6.3.5.1",{"version":44,"cve_count":30,"kev_count":23,"has_kev":4},"6.3.6",{"version":46,"cve_count":16,"kev_count":17,"has_kev":18},"6.3.6.1",{"version":48,"cve_count":49,"kev_count":11,"has_kev":4},"6.3.7",14,{"version":51,"cve_count":16,"kev_count":17,"has_kev":18},"6.3.7.1",{"version":53,"cve_count":17,"kev_count":17,"has_kev":18},"6.4",{"version":55,"cve_count":11,"kev_count":17,"has_kev":18},"6.4.0",{"version":57,"cve_count":58,"kev_count":17,"has_kev":18},"6.4.1",7,{"version":60,"cve_count":30,"kev_count":17,"has_kev":18},"6.4.2",{"version":62,"cve_count":63,"kev_count":17,"has_kev":18},"6.4.3",13,{"version":65,"cve_count":66,"kev_count":17,"has_kev":18},"6.5.1",5,"Transportation Management by Oracle is a technology product with 22 tracked versions and 27 known security vulnerabilities including 3 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":16,"kev_count":17,"has_kev":18},{"version":22,"cve_count":23,"kev_count":17,"has_kev":18},{"version":25,"cve_count":23,"kev_count":17,"has_kev":18},{"version":27,"cve_count":11,"kev_count":16,"has_kev":4},{"version":29,"cve_count":30,"kev_count":23,"has_kev":4},{"version":32,"cve_count":30,"kev_count":23,"has_kev":4},{"version":34,"cve_count":30,"kev_count":23,"has_kev":4},{"version":36,"cve_count":30,"kev_count":23,"has_kev":4},{"version":38,"cve_count":16,"kev_count":17,"has_kev":18},{"version":40,"cve_count":30,"kev_count":23,"has_kev":4},{"version":42,"cve_count":16,"kev_count":17,"has_kev":18},{"version":44,"cve_count":30,"kev_count":23,"has_kev":4},{"version":46,"cve_count":16,"kev_count":17,"has_kev":18},{"version":48,"cve_count":49,"kev_count":11,"has_kev":4},{"version":51,"cve_count":16,"kev_count":17,"has_kev":18},{"version":53,"cve_count":17,"kev_count":17,"has_kev":18},{"version":55,"cve_count":11,"kev_count":17,"has_kev":18},{"version":57,"cve_count":58,"kev_count":17,"has_kev":18},{"version":60,"cve_count":30,"kev_count":17,"has_kev":18},{"version":62,"cve_count":63,"kev_count":17,"has_kev":18},{"version":65,"cve_count":66,"kev_count":17,"has_kev":18},[92,100,107,112,119,124,130,136,142,147],{"cveId":93,"description":94,"publishedDate":95,"cvssScore":96,"cvssVersion":97,"severity":98,"isKev":4,"epssScore":99},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"v3.1","High",0.99968,{"cveId":101,"description":102,"publishedDate":103,"cvssScore":104,"cvssVersion":97,"severity":105,"isKev":4,"epssScore":106},"CVE-2020-1938","When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","2020-02-24",9.8,"Critical",0.9927,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":104,"cvssVersion":97,"severity":105,"isKev":4,"epssScore":111},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",0.90338,{"cveId":113,"description":114,"publishedDate":115,"cvssScore":116,"cvssVersion":97,"severity":117,"isKev":18,"epssScore":118},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",6.1,"Medium",0.8682,{"cveId":120,"description":121,"publishedDate":122,"cvssScore":58,"cvssVersion":97,"severity":98,"isKev":18,"epssScore":123},"CVE-2020-9484","When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","2020-05-20",0.5552,{"cveId":125,"description":126,"publishedDate":127,"cvssScore":128,"cvssVersion":97,"severity":117,"isKev":18,"epssScore":129},"CVE-2015-3195","The ASN1_TFLG_COMBINE implementation in crypto\u002Fasn1\u002Ftasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.","2015-12-06",5.3,0.38709,{"cveId":131,"description":132,"publishedDate":133,"cvssScore":134,"cvssVersion":97,"severity":117,"isKev":18,"epssScore":135},"CVE-2021-35616","Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). The supported version that is affected is 6.4.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Transportation Management accessible data as well as unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N).","2021-10-20",5.4,0.27974,{"cveId":137,"description":138,"publishedDate":139,"cvssScore":140,"cvssVersion":97,"severity":98,"isKev":18,"epssScore":141},"CVE-2019-17563","When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.","2019-12-23",7.5,0.10687,{"cveId":143,"description":144,"publishedDate":103,"cvssScore":145,"cvssVersion":97,"severity":117,"isKev":18,"epssScore":146},"CVE-2020-1935","In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.",4.8,0.09386,{"cveId":148,"description":149,"publishedDate":103,"cvssScore":145,"cvssVersion":97,"severity":117,"isKev":18,"epssScore":150},"CVE-2019-17569","The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.",0.08872,[152,157,160],{"cveId":108,"description":109,"publishedDate":110,"cvssScore":104,"severity":105,"isKev":4,"epssScore":111,"cisaVulnName":153,"cisaDateAdded":154,"cisaShortDescription":155,"cisaRequiredAction":156},"Apache Tomcat Remote Code Execution Vulnerability","2023-05-12","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","Apply updates per vendor instructions.",{"cveId":93,"description":94,"publishedDate":95,"cvssScore":96,"severity":98,"isKev":4,"epssScore":99,"cisaVulnName":153,"cisaDateAdded":158,"cisaShortDescription":159,"cisaRequiredAction":156},"2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":101,"description":102,"publishedDate":103,"cvssScore":104,"severity":105,"isKev":4,"epssScore":106,"cisaVulnName":161,"cisaDateAdded":162,"cisaShortDescription":163,"cisaRequiredAction":156},"Apache Tomcat Improper Privilege Management Vulnerability","2022-03-03","Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.",{"title":165,"metaDescription":166,"keywords":167,"structuredData":168},"Transportation Management by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Transportation Management by Oracle covering 22 versions with 27 tracked vulnerabilities including 2 critical and 1 high-severity issues and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Transportation Management vulnerabilities, Transportation Management security, Transportation Management CVE, Oracle Transportation Management, Transportation Management threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Transportation Management KEV, Transportation Management exploited vulnerabilities",{"@context":169,"@type":170,"name":171,"description":166,"url":172,"manufacturer":173,"applicationCategory":177,"softwareVersion":178,"mainEntity":179},"https:\u002F\u002Fschema.org","SoftwareApplication","Transportation Management","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Ftransportation_management",{"@type":174,"name":175,"url":176},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","22 versions tracked",{"@type":180,"name":181,"description":182,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Transportation Management Security Vulnerabilities","Security vulnerabilities affecting Transportation Management by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":184,"apiVersion":185},"2026-10-17T00:12:00.785Z","3.0",[],{"rows":188,"total":11,"capped":18,"failed":17},[189,193,197],{"cveId":108,"name":153,"severity":105,"cvss":104,"added":154,"epss":111,"published":190,"ranges":191,"checked":4,"hits":192,"covers":18},"2017-04-06T21:59:00.243",[27,29,32,34,36,40,44,48],[],{"cveId":93,"name":153,"severity":98,"cvss":96,"added":158,"epss":99,"published":194,"ranges":195,"checked":4,"hits":196,"covers":18},"2017-10-04T01:29:02.12",[29,32,34,36,40,44,48],[],{"cveId":101,"name":161,"severity":105,"cvss":104,"added":162,"epss":106,"published":198,"ranges":199,"checked":4,"hits":200,"covers":18},"2020-02-24T22:15:12.057",[48],[]]