Login Request a demo
PP
Product
Primavera P6 Enterprise Project Portfolio Management
by Oracle · last CVE Jul 15, 2025
60
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities60In the news0Timeline
Severity mix
Critical 9High 8Medium 41Low 0
Severity
All severities60Critical9High8Medium41Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Primavera P6 Enterprise Project Portfolio Management to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2017-3324
10.0
2%
Jan 27
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access)
Affected: 8.2; 8.3; 8.4; 15.1; 15.2; 16.1; +1 more
CVE-2017-3503
9.9
2%
Apr 24
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access (Apache Commons BeanUtils))
Affected: 8.3; 8.4; 15.1; 15.2; 16.1; 16.2
CVE-2020-10683
9.8
7%
May 1
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
Affected: 16.1.0.0 through 16.2.20.1; 17.1.0.0 through 17.12.17.1; 18.1.0.0 through 18.8.19.0; 19.12.0.0 through 19.12.6.0
CVE-2018-14718
9.8
13%
Jan 2
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic…
Affected: 17.7 through 17.12; 15.1; 15.2; 16.1; 16.2; 18.8
CVE-2018-19362
9.8
11%
Jan 2
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic…
Affected: 17.7 through 17.12; 15.1; 15.2; 16.1; 16.2; 18.8
CVE-2018-19361
9.8
11%
Jan 2
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization
Affected: 17.7 through 17.12; 15.1; 15.2; 16.1; 16.2; 18.8
CVE-2018-19360
9.8
11%
Jan 2
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic…
Affected: 17.7 through 17.12; 15.1; 15.2; 16.1; 16.2; 18.8
CVE-2018-14719
9.8
10%
Jan 2
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from…
Affected: 17.7 through 17.12; 15.1; 15.2; 16.1; 16.2; 18.8
CVE-2019-3020
9.3
2%
Oct 16
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 15.1.0 through 15.2.18; 16.1.0 through 16.2.18; 17.1.0 through 17.12.14; 18.1.0 through 18.8.11
CVE-2016-0635
8.8
5%
Jul 21
Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences…
Affected: 8.2; 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2024-21095
8.2
1%
Apr 16
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 19.12.0 through 19.12.22; 20.12.0 through 20.12.21; 21.12.0.0 through 21.12.18; 22.12.0 through 22.12.12; 23.12.0 through 23.12.2
CVE-2017-3583
8.1
2%
Apr 24
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access)
Affected: 8.3; 8.4; 15.1; 15.2; 16.1; 16.2
CVE-2017-3263
8.1
1%
Jan 27
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Team Member)
Affected: 8.2; 8.3; 8.4; 15.1; 15.2; 16.1; +1 more
CVE-2018-2849
7.7
1%
Apr 19
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access)
Affected: 17.1 through 17.12; 16.2
CVE-2020-36518
7.5
5%
Mar 11
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects
Affected: 17.12.0.0 through 17.12.20.4; 18.8.0.0 through 18.8.25.4; 19.12.0 through 19.12.19.0; 20.12.0.0 through 21.12.4.0
CVE-2018-1000632
7.5
7%
Aug 20
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element
Affected: 16.1.0.0 through 16.2.20.1; 17.1.0.0 through 17.12.17.1; 18.1.0.0 through 18.8.19.0; 19.12.0.0 through 19.12.6.0
CVE-2020-2556
7.3
0%
Jan 15
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Core)
Affected: 16.2.0.0 through 16.2.19.0; 17.12.0.0 through 17.12.16.0; 18.8.0.0 through 18.8.16.0; 19.12.0.0; 20.1.0.0
CVE-2019-2976
6.8
1%
Oct 16
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 17.1.0 through 17.12.12
CVE-2021-44832
6.6
98%
Dec 28
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses…
Affected: 19.12.0 through 19.12.18.0; 20.12.0.0 through 20.12.12.0; 21.12.0.0; 19.12.0.0 through 19.12.18.0; 20.12.0.0 through 20.12.12.0; 21.12.0.0
CVE-2020-5421
6.5
12%
Sep 19
RFD Protection Bypass via jsessionid
Affected: 16.1.0 through 16.2.20; 17.1.0 through 17.12.19; 18.1.0 through 18.8.21; 19.12.0 through 19.12.10
CVE-2020-2594
6.5
1%
Apr 15
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Project Manager)
Affected: 16.2.0.0 through 16.2.19.3; 17.12.0.0 through 17.12.17.0; 18.8.0.0 through 18.8.18.0; 19.12.1.0 through 19.12.3.0; 20.1.0.0 through 20.2.0.0
CVE-2017-10131
6.5
1%
Aug 8
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access)
Affected: 8.3; 8.4; 15.1; 15.2; 16.1; 16.2
CVE-2017-10038
6.5
2%
Aug 8
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access)
Affected: 15.1; 15.2; 16.1; 16.2
CVE-2021-2366
6.4
1%
Jul 21
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 17.12.0 through 17.12.20; 18.8.0 through 18.8.23; 19.12.0 through 19.12.14; 20.12.0 through 20.12.3
CVE-2016-3572
6.4
1%
Jul 21
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.3, 8.4, 15.1, 15.2, and 16.1 allows remote…
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2019-17091
6.1
2%
Oct 2
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS…
Affected: 15.1.0.0 through 15.2.18.7; 16.1.0.0 through 16.2.19.0; 17.1.0.0 through 17.12.15.0; 18.1.0.0 through 18.8.15.0; 19.12.0.0
CVE-2018-3281
6.1
1%
Oct 17
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access)
Affected: 17.7 through 17.12; 8.4; 15.1; 15.2; 16.1; 16.2; +1 more
CVE-2018-3241
6.1
1%
Oct 17
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access)
Affected: 17.7 through 17.12; 8.4; 15.1; 15.2; 16.1; 16.2; +1 more
CVE-2018-2961
6.1
1%
Jul 18
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access)
Affected: 17.1 through 17.12; 8.4; 15.1; 15.2; 16.1; 16.2
CVE-2018-2960
6.1
1%
Jul 18
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access)
Affected: 17.1 through 17.12; 8.4; 15.1; 15.2; 16.1; 16.2
CVE-2017-3579
6.1
1%
Apr 24
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access)
Affected: 8.3; 8.4; 15.1; 15.2; 16.1; 16.2
CVE-2016-3573
6.1
2%
Jul 21
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.3, 8.4, 15.1, 15.2, and 16.1 allows remote…
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2016-3571
6.1
2%
Jul 21
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.3, 8.4, 15.1, 15.2, and 16.1 allows remote…
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2016-3570
6.1
2%
Jul 21
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.3, 8.4, 15.1, 15.2, and 16.1 allows remote…
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2016-3569
6.1
2%
Jul 21
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.3, 8.4, 15.1, 15.2, and 16.1 allows remote…
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2016-3568
6.1
2%
Jul 21
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.3, 8.4, 15.1, 15.2, and 16.1 allows remote…
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2016-3566
6.1
2%
Jul 21
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.3, 8.4, 15.1, 15.2, and 16.1 allows remote…
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2020-14706
5.9
1%
Jul 15
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 17.1.0.0 through 17.12.17.1; 18.1.0.0 through 18.8.19.0; 19.12.0.0 through 19.12.5.0
CVE-2018-0735
5.9
5%
Oct 29
Timing attack against ECDSA signature generation
Affected: 17.7 through 17.12; 8.4; 15.1; 15.2; 16.1; 16.2; +1 more
CVE-2018-11039
5.9
3%
Jun 25
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any…
Affected: 18.8
CVE-2025-50061
5.4
0%
Jul 15
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 20.12.0 through 20.12.21; 21.12.0.0 through 21.12.21.0; 22.12.0 through 22.12.19; 23.12.0 through 23.12.13; 24.12.0 through 24.12.4
CVE-2025-21558
5.4
0%
Jan 21
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 20.12.1.0 through 20.12.21.5; 21.12.1.0 through 21.12.20.0; 22.12.1.0
CVE-2025-21526
5.4
0%
Jan 21
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 20.12.1.0 through 20.12.21.5; 21.12.1.0 through 21.12.20.0; 22.12.1.0 through 22.12.16.0; 23.12.1.0 through 23.12.10.0
CVE-2020-14653
5.4
1%
Jul 15
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access)
Affected: 16.1.0.0 through 16.2.20.1; 17.1.0.0 through 17.12.17.1; 18.1.0.0 through 18.8.18.2
CVE-2020-2706
5.4
1%
Apr 15
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Project Manager)
Affected: 16.2.0.0 through 16.2.19.3; 17.12.0.0 through 17.12.17.0; 18.8.0.0 through 18.8.18.0; 19.12.1.0 through 19.12.3.0; 20.1.0.0 through 20.2.0.0
CVE-2020-2707
5.4
1%
Jan 15
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: WebAccess)
Affected: 15.1.0.0 through 15.2.18.7; 16.1.0.0 through 16.2.19.0; 17.1.0.0 through 17.2.16.0; 18.1.0.0 through 18.8.16.0; 19.12.0.0
CVE-2018-1288
5.4
5%
Jul 26
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually…
Affected: 19.12.0.0 through 19.12.6.0
CVE-2017-10046
5.4
4%
Aug 8
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access)
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
CVE-2016-5533
5.4
1%
Oct 25
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.4, 15.x, and 16.x allows remote authenticated…
Affected: 8.4; 15.0; 15.1; 15.2; 16.0; 16.1; +1 more
CVE-2016-3567
5.4
1%
Jul 21
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.3, 8.4, 15.1, 15.2, and 16.1 allows remote…
Affected: 8.3; 8.4; 15.1; 15.2; 16.1
Page 1 of 2 · 60 total
12