CVE-2021-35587 - Oracle Fusion Middleware Unspecified Vulnerability

Oracle | Fusion Middleware

• Date Added:
• 2022-11-28

• Due Date:
• 2022-12-19

Vulnerability Name

Oracle Fusion Middleware Unspecified Vulnerability

Description

Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply updates per vendor instructions.

Additional Notes

https://www.oracle.com/security-alerts/cpujan2022.html; https://nvd.nist.gov/vuln/detail/CVE-2021-35587

Latest Security News

Credential Theft Becomes Cybercriminals' Favorite Target

Ferret Malware Added to 'Contagious Interview' Campaign

Zyxel won’t patch newly exploited flaws in end-of-life routers

Google Play, Apple App Store apps caught stealing crypto wallets

Cybercriminals Court Traitorous Insiders via Ransom Notes

Chinese 'Infrastructure Laundering' Abuses AWS, Microsoft Cloud

Cyber agencies share security guidance for network edge devices

Chinese cyberspies use new SSH backdoor in network device hacks

Common Alerts

LowCSP: X-WebKit-CSP

InformationalGET for POST

HighServer Side Code Injection - PHP Code Injection

LowInformation Disclosure - Debug Error Messages

MediumCSP: style-src unsafe-inline

MediumExponential Entity Expansion (Billion Laughs Attack)

HighSession Fixation

HighSOAP XML Injection

HighServer Side Template Injection (Blind)

InformationalInformation Disclosure - Sensitive Information in HTTP Referrer Header

Top CVE List

CVE-2024-49138 Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

CVE-2025-24085 Apple Multiple Products Use-After-Free Vulnerability

CVE-2024-44308 Apple Multiple Products Code Execution Vulnerability

CVE-2015-6175 Microsoft Windows Kernel Privilege Escalation Vulnerability

CVE-2024-28986 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

CVE-2024-38217 Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability

CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CVE-2025-21335 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerability

CVE-2012-5076 Oracle Java SE Sandbox Bypass Vulnerability

Common CWEs

CWE-1311 Improper Translation of Security Attributes by Fabric Bridge

HighCWE-681 Incorrect Conversion between Numeric Types

CWE-1384 Improper Handling of Physical or Environmental Conditions

CWE-151 Improper Neutralization of Comment Delimiters

MediumCWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-683 Function Call With Incorrect Order of Arguments

CWE-81 Improper Neutralization of Script in an Error Message Web Page

CWE-430 Deployment of Wrong Handler

LowCWE-479 Signal Handler Use of a Non-reentrant Function

CWE-588 Attempt to Access Child of a Non-structure Pointer