Login Request a demo
HG
Product
Hospitality Guest Access
by Oracle · last CVE May 20, 2020
On CISA KEVExploited in the wild
33
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities33In the news0Timeline
Severity mix
Critical 2High 10Medium 21Low 0
Severity
All severities33Critical2High10Medium21Low0
Exploitation
On CISA KEV3Exploited in the wild3
Watch

Add Hospitality Guest Access to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-1938
In wildKEV
9.8
99%
Feb 24
Apache Tomcat Improper Privilege Management Vulnerability
Affected: 4.2.0; 4.2.1
CVE-2016-8735
In wildKEV
9.8
90%
Apr 6
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
Affected: 4.2.0; 4.2.1
CVE-2017-12617
In wildKEV
8.1
100%
Oct 3
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
Affected: 4.2.0; 4.2.1
CVE-2018-1258
8.8
2%
May 11
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security
Affected: 4.2.0; 4.2.1
CVE-2017-10372
8.7
1%
Oct 19
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.0; 4.2.1
CVE-2019-17359
7.5
9%
Oct 8
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data
Affected: 4.2.0
CVE-2019-0227
7.5
92%
May 1
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006
Affected: 4.2.0; 4.2.1
CVE-2019-0190
7.5
59%
Jan 30
A bug exists in the way mod_ssl handled client renegotiations
Affected: 4.2.0; 4.2.1
CVE-2018-11040
7.5
3%
Jun 25
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON…
Affected: 4.2.0; 4.2.1
CVE-2018-2604
7.5
2%
Jan 18
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.1
CVE-2017-9735
7.5
6%
Jun 16
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before…
Affected: 4.2.0; 4.2.1
CVE-2020-9484
7.0
56%
May 20
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a…
Affected: 4.2.0; 4.2.1
CVE-2017-10370
6.9
1%
Oct 19
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.0; 4.2.1
CVE-2018-1257
6.5
3%
May 11
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a…
Affected: 4.2.0; 4.2.1
CVE-2018-2852
6.4
1%
Apr 19
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.0; 4.2.1
CVE-2018-2606
6.2
0%
Jan 18
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.0; 4.2.1
CVE-2018-8032
6.1
11%
Aug 2
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services
Affected: 4.2.0; 4.2.1
CVE-2015-9251
6.1
30%
Jan 18
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript…
Affected: 4.2.0; 4.2.1
CVE-2018-11763
5.9
51%
Sep 25
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout…
Affected: 4.2.0; 4.2.1
CVE-2018-11039
5.9
3%
Jun 25
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any…
Affected: 4.2.0; 4.2.1
CVE-2018-1304
5.9
17%
Feb 28
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49…
Affected: 4.2.0; 4.2.1
CVE-2017-10219
5.5
0%
Aug 8
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.0.0; 4.2.1.0
CVE-2019-10247
5.3
6%
Apr 22
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured…
Affected: 4.2.0; 4.2.1
CVE-2019-10246
5.3
4%
Apr 22
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a…
Affected: 4.2.0; 4.2.1
CVE-2018-17189
5.3
20%
Jan 30
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server…
Affected: 4.2.0; 4.2.1
CVE-2017-10383
5.3
1%
Oct 19
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Interface)
Affected: 4.2.0; 4.2.1
CVE-2018-2607
4.9
1%
Jan 18
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.1
CVE-2019-17569
4.8
9%
Feb 24
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression
Affected: 4.2.0; 4.2.1
CVE-2020-1935
4.8
9%
Feb 24
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP…
Affected: 4.2.0; 4.2.1
CVE-2017-10375
4.6
1%
Oct 19
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.0; 4.2.1
CVE-2018-11784
4.3
98%
Oct 4
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g
Affected: 4.2.0; 4.2.1
CVE-2017-10218
4.3
1%
Aug 8
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.0.0; 4.2.1.0
CVE-2017-10217
4.3
1%
Aug 8
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base)
Affected: 4.2.0.0; 4.2.1.0
Showing 33