[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZaKl6yiPBbZhmkNN0V_ncavDsNGs4Wq7T15uc7qvOnU":3,"g5a-family:oracle\u002Fwebcenter_sites":154,"g5a-ex:oracle\u002Fwebcenter_sites@*":157},{"success":4,"data":5},true,{"product":6,"versions":45,"topVulnerabilitiesByEpss":57,"kevVulnerabilities":121,"seoMetadata":132,"meta":151},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":44},"oracle","webcenter_sites",11,53,2,"2024-01-16",[14,19,21,24,26,28,31,33,36,39,42],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"11.1.1.6.1",1,0,false,{"version":20,"cve_count":11,"kev_count":17,"has_kev":18},"11.1.1.8",{"version":22,"cve_count":23,"kev_count":16,"has_kev":4},"11.1.1.8.0",24,{"version":25,"cve_count":16,"kev_count":17,"has_kev":18},"12.2.1",{"version":27,"cve_count":11,"kev_count":17,"has_kev":18},"12.2.1.0",{"version":29,"cve_count":30,"kev_count":17,"has_kev":18},"12.2.1.0.0",16,{"version":32,"cve_count":30,"kev_count":17,"has_kev":18},"12.2.1.1.0",{"version":34,"cve_count":35,"kev_count":17,"has_kev":18},"12.2.1.2.0",18,{"version":37,"cve_count":38,"kev_count":16,"has_kev":4},"12.2.1.3.0",26,{"version":40,"cve_count":41,"kev_count":16,"has_kev":4},"12.2.1.4.0",19,{"version":43,"cve_count":16,"kev_count":17,"has_kev":18},"7.6.2","Webcenter Sites by Oracle is a technology product with 11 tracked versions and 53 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[46,47,48,49,50,51,52,53,54,55,56],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":11,"kev_count":17,"has_kev":18},{"version":22,"cve_count":23,"kev_count":16,"has_kev":4},{"version":25,"cve_count":16,"kev_count":17,"has_kev":18},{"version":27,"cve_count":11,"kev_count":17,"has_kev":18},{"version":29,"cve_count":30,"kev_count":17,"has_kev":18},{"version":32,"cve_count":30,"kev_count":17,"has_kev":18},{"version":34,"cve_count":35,"kev_count":17,"has_kev":18},{"version":37,"cve_count":38,"kev_count":16,"has_kev":4},{"version":40,"cve_count":41,"kev_count":16,"has_kev":4},{"version":43,"cve_count":16,"kev_count":17,"has_kev":18},[58,66,73,79,85,91,98,105,111,116],{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":63,"severity":64,"isKev":18,"epssScore":65},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"cvssVersion":63,"severity":71,"isKev":4,"epssScore":72},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"High",0.99968,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"cvssVersion":63,"severity":64,"isKev":18,"epssScore":78},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",6.1,0.8682,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":63,"severity":64,"isKev":4,"epssScore":84},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.9,0.84887,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"cvssVersion":63,"severity":71,"isKev":18,"epssScore":90},"CVE-2021-29505","XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.","2021-05-28",7.5,0.77232,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":95,"cvssVersion":96,"severity":71,"isKev":18,"epssScore":97},"CVE-2019-2578","Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N).","2019-04-23",8.6,"v3.0",0.72402,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":102,"cvssVersion":96,"severity":103,"isKev":18,"epssScore":104},"CVE-2015-3253","The MethodClosure class in runtime\u002FMethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","2015-08-13",9.8,"Critical",0.41032,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":96,"severity":71,"isKev":18,"epssScore":110},"CVE-2018-2791","Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:L\u002FA:N).","2018-04-19",8.2,0.38222,{"cveId":112,"description":113,"publishedDate":114,"cvssScore":77,"cvssVersion":96,"severity":64,"isKev":18,"epssScore":115},"CVE-2015-9251","jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text\u002Fjavascript responses to be executed.","2018-01-18",0.29726,{"cveId":117,"description":118,"publishedDate":119,"cvssScore":102,"cvssVersion":63,"severity":103,"isKev":18,"epssScore":120},"CVE-2019-13990","initDocumentParser in xml\u002FXMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.","2019-07-26",0.16628,[122,127],{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"severity":64,"isKev":4,"epssScore":84,"cisaVulnName":123,"cisaDateAdded":124,"cisaShortDescription":125,"cisaRequiredAction":126},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"severity":71,"isKev":4,"epssScore":72,"cisaVulnName":128,"cisaDateAdded":129,"cisaShortDescription":130,"cisaRequiredAction":131},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","Apply updates per vendor instructions.",{"title":133,"metaDescription":134,"keywords":135,"structuredData":136},"Webcenter Sites by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Webcenter Sites by Oracle covering 11 versions with 53 tracked vulnerabilities including 0 critical and 1 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Webcenter Sites vulnerabilities, Webcenter Sites security, Webcenter Sites CVE, Oracle Webcenter Sites, Webcenter Sites threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Webcenter Sites KEV, Webcenter Sites exploited vulnerabilities",{"@context":137,"@type":138,"name":139,"description":134,"url":140,"manufacturer":141,"applicationCategory":145,"softwareVersion":146,"mainEntity":147},"https:\u002F\u002Fschema.org","SoftwareApplication","Webcenter Sites","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fwebcenter_sites",{"@type":142,"name":143,"url":144},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","11 versions tracked",{"@type":148,"name":149,"description":150,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Webcenter Sites Security Vulnerabilities","Security vulnerabilities affecting Webcenter Sites by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":152,"apiVersion":153},"2026-10-17T14:58:35.795Z","3.0",[155],{"product":156,"cves":16},"webcenter_sites_support_tools",{"rows":158,"total":11,"capped":18,"failed":17},[159,163],{"cveId":80,"name":123,"severity":64,"cvss":83,"added":124,"epss":84,"published":160,"ranges":161,"checked":4,"hits":162,"covers":18},"2020-04-29T21:15:11.743",[37,40],[],{"cveId":67,"name":128,"severity":71,"cvss":70,"added":129,"epss":72,"published":164,"ranges":165,"checked":4,"hits":166,"covers":18},"2017-10-04T01:29:02.12",[22],[]]