[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWpkpi7TimsnqW9aPwbVGIavipBfzd4VpXZJYtta9cFk":3,"g5a-family:oracle\u002Futilities_testing_accelerator":107,"g5a-ex:oracle\u002Futilities_testing_accelerator@*":108},{"success":4,"data":5},true,{"product":6,"versions":24,"topVulnerabilitiesByEpss":28,"kevVulnerabilities":79,"seoMetadata":85,"meta":104},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":23},"oracle","utilities_testing_accelerator",3,27,1,"2021-12-14",[14,16,21],{"version":15,"cve_count":10,"kev_count":11,"has_kev":4},"6.0.0.1.1",{"version":17,"cve_count":18,"kev_count":19,"has_kev":20},"6.0.0.2.2",11,0,false,{"version":22,"cve_count":18,"kev_count":19,"has_kev":20},"6.0.0.3.1","Utilities Testing Accelerator by Oracle is a technology product with 3 tracked versions and 27 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[25,26,27],{"version":15,"cve_count":10,"kev_count":11,"has_kev":4},{"version":17,"cve_count":18,"kev_count":19,"has_kev":20},{"version":22,"cve_count":18,"kev_count":19,"has_kev":20},[29,37,42,49,55,59,62,67,71,75],{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":4,"epssScore":36},"CVE-2021-39144","XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","2021-08-23",8.5,"v3.1","High",0.98124,{"cveId":38,"description":39,"publishedDate":12,"cvssScore":40,"cvssVersion":34,"severity":35,"isKev":20,"epssScore":41},"CVE-2021-4104","JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",7.5,0.80599,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":34,"severity":47,"isKev":20,"epssScore":48},"CVE-2021-33037","Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP\u002F1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","2021-07-12",5.3,"Medium",0.74667,{"cveId":50,"description":51,"publishedDate":52,"cvssScore":53,"cvssVersion":34,"severity":35,"isKev":20,"epssScore":54},"CVE-2020-13936","An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload\u002Fmodify velocity templates running Apache Velocity Engine versions up to 2.2.","2021-03-10",8.8,0.22709,{"cveId":56,"description":57,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":20,"epssScore":58},"CVE-2021-39141","XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",0.16118,{"cveId":60,"description":57,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":20,"epssScore":61},"CVE-2021-39146",0.143,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":40,"cvssVersion":34,"severity":35,"isKev":20,"epssScore":66},"CVE-2021-36090","When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.","2021-07-13",0.12945,{"cveId":68,"description":69,"publishedDate":65,"cvssScore":40,"cvssVersion":34,"severity":35,"isKev":20,"epssScore":70},"CVE-2021-35516","When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.",0.12365,{"cveId":72,"description":73,"publishedDate":65,"cvssScore":40,"cvssVersion":34,"severity":35,"isKev":20,"epssScore":74},"CVE-2021-35515","When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.",0.11567,{"cveId":76,"description":77,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":20,"epssScore":78},"CVE-2021-39152","XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https:\u002F\u002Fx-stream.github.io\u002Fsecurity.html#framework), you will have to use at least version 1.4.18.",0.11377,[80],{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"severity":35,"isKev":4,"epssScore":36,"cisaVulnName":81,"cisaDateAdded":82,"cisaShortDescription":83,"cisaRequiredAction":84},"XStream Remote Code Execution Vulnerability","2023-03-10","XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.","Apply updates per vendor instructions.",{"title":86,"metaDescription":87,"keywords":88,"structuredData":89},"Utilities Testing Accelerator by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Utilities Testing Accelerator by Oracle covering 3 versions with 27 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Utilities Testing Accelerator vulnerabilities, Utilities Testing Accelerator security, Utilities Testing Accelerator CVE, Oracle Utilities Testing Accelerator, Utilities Testing Accelerator threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Utilities Testing Accelerator KEV, Utilities Testing Accelerator exploited vulnerabilities",{"@context":90,"@type":91,"name":92,"description":87,"url":93,"manufacturer":94,"applicationCategory":98,"softwareVersion":99,"mainEntity":100},"https:\u002F\u002Fschema.org","SoftwareApplication","Utilities Testing Accelerator","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Futilities_testing_accelerator",{"@type":95,"name":96,"url":97},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","3 versions tracked",{"@type":101,"name":102,"description":103,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Utilities Testing Accelerator Security Vulnerabilities","Security vulnerabilities affecting Utilities Testing Accelerator by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":105,"apiVersion":106},"2026-10-17T14:25:23.787Z","3.0",[],{"rows":109,"total":11,"capped":20,"failed":19},[110],{"cveId":30,"name":81,"severity":35,"cvss":33,"added":82,"epss":36,"published":111,"ranges":112,"checked":4,"hits":113,"covers":20},"2021-08-23T18:15:12.087",[15],[]]