Oncommand Balance
Vendor:
First CVE: Aug 5, 2010 · Active for 15 years
83
Total CVEs
More Total CVEs than 99% of tracked products
13.8
Avg CVEs / Year
Higher CVE frequency than 97% of tracked products
7.1
Avg CVSS
Higher Avg CVSS than 43% of tracked products
8.4%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Oncommand Balance over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 5, 2010
15 years ago
Most Recent CVE
Jan 16, 2019
2,746 days ago
CVE Severity & Scoring
Oncommand Balance83 CVEs
43%
30%
23%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local5 (6.0%)
Network75 (90.4%)
Unknown2 (2.4%)
Physical1 (1.2%)
Adjacent Network0 (0.0%)
Attack Complexity
Low56 (67.5%)
High25 (30.1%)
Unknown2 (2.4%)
User Interaction
None56 (67.5%)
Unknown2 (2.4%)
Required25 (30.1%)
Privileges Required
Low12 (14.5%)
High4 (4.8%)
None65 (78.3%)
Unknown2 (2.4%)
Top CVEs
Signals from CVEs in this product scope (83 CVEs).
83 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-12617HIGH When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation | Oct 4, 2017 | 8.1 | 99 | YES | YES |
CVE-2017-9805HIGH The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type f | Sep 15, 2017 | 8.1 | 99 | YES | YES |
CVE-2017-5638CRITICAL The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attem | Mar 11, 2017 | 9.8 | 99 | YES | YES |
CVE-2017-12615HIGH When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upl | Sep 19, 2017 | 8.1 | 98 | YES | YES |
CVE-2010-1871HIGH JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressio | Aug 5, 2010 | 8.8 | 97 | YES | YES |
CVE-2016-5195HIGH Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature | Nov 10, 2016 | 7.0 | 95 | YES | YES |
CVE-2016-3427CRITICAL Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and avai | Apr 21, 2016 | 9.8 | 95 | YES | NO |
CVE-2015-7871CRITICAL Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. | Aug 7, 2017 | 9.8 | 83 | NO | YES |
CVE-2017-7525CRITICAL A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by se | Feb 6, 2018 | 9.8 | 50 | NO | NO |
CVE-2015-7855MEDIUM The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 pa | Aug 7, 2017 | 6.5 | 43 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (83 CVEs).
CISA KEV
7 CVEs
8.4% of CVEs· 97th percentile
Metasploit
5 CVEs
6.0% of CVEs· 97th percentile
Nuclei
4 CVEs
4.8% of CVEs· 97th percentile
ExploitDB
9 CVEs
10.8% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (83 CVEs).
Media Mentions
Signals from CVEs in this product scope (83 CVEs).
Top CNAs Publishing CVEs For Oncommand Balance
Top CWEs
Versions
No cataloged versions.