FM
App Server
Fusion Middleware
On CISA KEVExploited in the wildRansomware-linked
315
CVEs
6
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 6Medium 12Low 0
Watch
Add Fusion Middleware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-61757 In wildKEV | 9.8 | Oct 21 | Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability Affected: All versions, or not specified |
| CVE-2021-35587 In wildKEV | 9.8 | Jan 19 | Oracle Fusion Middleware Unspecified Vulnerability Affected: All versions, or not specified |
| CVE-2020-2551 In wildKEV | 9.8 | Jan 15 | Oracle Fusion Middleware Unspecified Vulnerability Affected: All versions, or not specified |
| CVE-2012-1710 RansomwareIn wildKEV | 9.8 | May 3 | Oracle Fusion Middleware Unspecified Vulnerability Affected: 10.1.3.5 |
| CVE-2012-3152 In wildKEV | 9.1 | Oct 16 | Oracle Fusion Middleware Unspecified Vulnerability Affected: 11.1.1.4.0; 11.1.1.6.0; 11.1.2.0 |
| CVE-2012-0518 In wildKEV | 4.7 | Oct 16 | Oracle Fusion Middleware Unspecified Vulnerability Affected: 10.1.4.3 |
| CVE-2020-10683 | 9.8 | May 1 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks Affected: 12.2.1.4.0 |
| CVE-2021-2351 | 8.3 | Jul 21 | Vulnerability in the Advanced Networking Option component of Oracle Database Server Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2024-21191 | 7.6 | Oct 15 | Vulnerability in the Oracle Enterprise Manager Fusion Middleware Control product of Oracle Fusion Middleware (component: FMW Control Plugin) Affected: 12.2.1.4.0 |
| CVE-2024-21215 | 7.5 | Oct 15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core) Affected: 12.2.1.4.0; 14.1.1.0.0 |
| CVE-2024-21190 | 7.5 | Oct 15 | Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning) Affected: 12.2.1.4.0 |
| CVE-2014-3576 | 7.5 | Aug 14 | The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a… Affected: 8.1; 9.0; 11.1.1.7.4; 12.1.3.0.0 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 11.1.1.9; 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2012-1695 | 6.8 | May 3 | Unspecified vulnerability in the Oracle JRockit component in Oracle Fusion Middleware 28.2.2 and earlier, and JDK/JRE 5 and 6 27.7.1 and earlier, allows remote attackers to affect… Affected: through 28.2.2; 7.5.2; 8.3.2.0; 8.3.5.0; 9.2.4; 10.0.2; +17 more |
| CVE-2024-21205 | 6.5 | Oct 15 | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality) Affected: 12.2.1.4.0 |
| CVE-2023-21994 | 6.5 | Jul 18 | Vulnerability in the Oracle Mobile Security Suite product of Oracle Fusion Middleware (component: Android Mobile Authenticator App) Affected: before 11.1.2.3.1 |
| CVE-2020-5421 | 6.5 | Sep 19 | RFD Protection Bypass via jsessionid Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2018-3109 | 6.5 | Aug 2 | Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder) Affected: 12.2.1.2; 12.2.1.3 |
| CVE-2018-3108 | 6.5 | Aug 2 | Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Notification Service) Affected: 12.2.1.2; 12.2.1.3 |
| CVE-2018-1305 | 6.5 | Feb 23 | Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a… Affected: 12.2.1.3.0 |
| CVE-2026-35252 | 6.4 | Apr 21 | Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: C Oracle SSL API) Affected: 12.1.3.0.0; 12.2.1.4.0 |
| CVE-2018-1304 | 5.9 | Feb 28 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49… Affected: 12.2.1.3.0 |
| CVE-2026-35232 | 5.4 | Apr 21 | Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service) Affected: 12.2.1.4.0; 14.1.2.0.0 |
| CVE-2024-21192 | 4.4 | Oct 15 | Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Fusion Middleware (component: WebLogic Mgmt) Affected: 12.2.1.4.0 |
| CVE-2016-0470 | – | Jan 21 | Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect… Affected: 11.1.1.7.0; 11.1.1.9; 12.2.1 |
| CVE-2016-0464 | – | Jan 21 | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors… Affected: 10.3.6; 12.1.2.0; 12.1.3.0 |
| CVE-2016-0453 | – | Jan 21 | Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.1.2 allows remote attackers to affect integrity via unknown vectors related to… Affected: 3.1.2 |
| CVE-2016-0441 | – | Jan 21 | Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.1.2 allows remote authenticated users to affect confidentiality, integrity, and… Affected: 3.1.2 |
| CVE-2016-0439 | – | Jan 21 | Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to… Affected: 11.1.1.7.0; 11.1.1.9 |
| CVE-2016-0433 | – | Jan 21 | Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support Affected: 11.1.1.9 |
| CVE-2016-0432 | – | Jan 21 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown… Affected: 8.5.0; 8.5.1; 8.5.2 |
| CVE-2016-0430 | – | Jan 21 | Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to… Affected: 11.1.1.7.0; 11.1.1.9 |
| CVE-2016-0429 | – | Jan 21 | Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect integrity via unknown… Affected: 11.1.1.7.0; 11.1.1.9 |
| CVE-2016-0413 | – | Jan 21 | Unspecified vulnerability in the Oracle Identity Federation component in Oracle Fusion Middleware 11.1.1.7 allows remote authenticated users to affect integrity via vectors… Affected: 11.1.1.7 |
| CVE-2016-0404 | – | Jan 21 | Unspecified vulnerability in the Oracle Identity Federation component in Oracle Fusion Middleware 11.1.2.2 allows remote attackers to affect integrity via vectors related to Admin Affected: 11.1.2.2 |
| CVE-2016-0401 | – | Jan 21 | Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect integrity via unknown… Affected: 11.1.1.7.0; 11.1.1.9 |
| CVE-2015-4808 | – | Jan 21 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors… Affected: 8.5.0; 8.5.1; 8.5.2 |
| CVE-2015-4914 | – | Oct 22 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote authenticated users to… Affected: 10.1.3.5; 11.1.1.7; 11.1.1.9; 12.1.2.0; 12.1.3.0 |
| CVE-2015-4912 | – | Oct 22 | Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via vectors… Affected: 11.1.2.2; 11.1.2.3 |
| CVE-2015-4909 | – | Oct 22 | Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote attackers to affect integrity via… Affected: 11.1.2.4.0; 12.1.2.0.0; 12.1.3.0.0 |
| CVE-2015-4899 | – | Oct 21 | Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality via unknown… Affected: 3.0.1; 3.1.2 |
| CVE-2015-4880 | – | Oct 21 | Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related… Affected: 10.1.3.5.1 |
| CVE-2015-4878 | – | Oct 21 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown… Affected: 8.5.0; 8.5.1; 8.5.2 |
| CVE-2015-4877 | – | Oct 21 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown… Affected: 8.5.0; 8.5.1; 8.5.2 |
| CVE-2015-4867 | – | Oct 21 | Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related… Affected: 10.1.3.5.1 |
| CVE-2015-4838 | – | Oct 21 | Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote authenticated users to affect… Affected: 11.1.2.4.0; 12.1.2.0.0; 12.1.3.0.0 |
| CVE-2015-4832 | – | Oct 21 | Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.7, 11.1.2.2, and 11.1.2.3 allows remote attackers to affect integrity via… Affected: 11.1.1.7; 11.1.2.2; 11.1.2.3 |
| CVE-2015-4812 | – | Oct 21 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 allows remote attackers to affect confidentiality via vectors related to OSSL… Affected: 11.1.1.9 |
| CVE-2015-4811 | – | Oct 21 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors… Affected: 8.5.0; 8.5.1; 8.5.2 |
| CVE-2015-4809 | – | Oct 21 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors… Affected: 8.5.0; 8.5.1; 8.5.2 |