Instantis Enterprisetrack Oracle Instantis Enterprisetrack

stack.watch can notify you when security vulnerabilities are reported in Oracle Instantis Enterprisetrack. You can add multiple products that you use with Instantis Enterprisetrack to create your own personal software stack watcher.

By the Year

In 2020 there have been 0 vulnerabilities in Oracle Instantis Enterprisetrack . Last year Instantis Enterprisetrack had 0 security vulnerabilities published.

Year Vulnerabilities Average Score
2020 0 0.00
2019 0 0.00
2018 3 6.67

It may take a day or so for new Instantis Enterprisetrack vulnerabilities to show up. Additionally vulnerabilities may be tagged under a different product or component name.

Latest Oracle Instantis Enterprisetrack Security Vulnerabilities

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11

CVE-2018-11784 4.3 - Medium - October 04, 2018

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

CVE-2018-11784 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Open Redirect

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client

CVE-2018-11763 5.9 - Medium - September 25, 2018

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

CVE-2018-11763 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is consided to have a high level of attack complexity. It has an exploitability score of 2.2 out of four. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Improper Input Validation

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string

CVE-2018-8013 9.8 - Critical - May 24, 2018

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

CVE-2018-8013 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

Marshaling, Unmarshaling