Instantis Enterprisetrack vulnerabilities

6 known vulnerabilities in Instantis Enterprisetrack from Oracle. 6 are rated high or critical, and 6 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Apache HTTP Server Path Traversal Exploited

  CVE-2021-42013Oct 7, 2021ApacheEPSS 100%

  It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories ar

• 9.8 Critical severity

  Apache HTTP Server Path Traversal Exploited

  CVE-2021-41773Oct 5, 2021ApacheEPSS 100%

  A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not

• 9.0 Critical severity

  Apache HTTP Server-Side Request Forgery (SSRF) Exploited

  CVE-2021-40438Sep 16, 2021ApacheEPSS 100%

  A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

• 9.8 Critical severity

  Apache Tomcat Improper Privilege Management Exploited

  CVE-2020-1938Feb 24, 2020ApacheEPSS 99.3%

  When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attac

• 7.8 High severity

  Apache HTTP Server Privilege Escalation Exploited

  CVE-2019-0211Apr 8, 2019ApacheEPSS 65%

  In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privi

• 8.1 High severity

  Apache Tomcat Remote Code Execution Exploited

  CVE-2017-12617Oct 4, 2017ApacheEPSS 100%

  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file