Oncommand Insight

Vendor:

First CVE: Aug 5, 2010 · Active for 15 years

971
Total CVEs
More Total CVEs than 100% of tracked products
88.3
Avg CVEs / Year
Higher CVE frequency than 100% of tracked products
5.5
Avg CVSS
Higher Avg CVSS than 15% of tracked products
0.9%
KEV Rate
Higher KEV Rate than 96% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Oncommand Insight over time

Volume of CVEsAvg CVSS Base Score
First CVE
Aug 5, 2010
15 years ago
Most Recent CVE
Feb 10, 2025
529 days ago

CVE Severity & Scoring

Oncommand Insight971 CVEs
All CVEs352,294 CVEs
LowMediumHighCritical
Attack Vector
Local37 (3.8%)
Network875 (90.1%)
Unknown0 (0.0%)
Physical1 (0.1%)
Adjacent Network58 (6.0%)
Attack Complexity
Low713 (73.4%)
High258 (26.6%)
Unknown0 (0.0%)
User Interaction
None814 (83.8%)
Unknown0 (0.0%)
Required157 (16.2%)
Privileges Required
Low161 (16.6%)
High501 (51.6%)
None309 (31.8%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (971 CVEs).

971 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2021-44228CRITICAL
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai
Dec 10, 202110.099YESYES
CVE-2018-11776HIGH
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention
Aug 22, 20188.199YESYES
CVE-2017-12617HIGH
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation
Oct 4, 20178.199YESYES
CVE-2023-44487HIGH
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through
Oct 10, 20237.597YESYES
CVE-2016-8735CRITICAL
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener
Apr 6, 20179.897YESYES
CVE-2010-1871HIGH
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressio
Aug 5, 20108.897YESYES
CVE-2020-11023MEDIUM
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's
Apr 29, 20206.195YESYES
CVE-2016-3427CRITICAL
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and avai
Apr 21, 20169.895YESNO
CVE-2017-5645CRITICAL
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payloa
Apr 17, 20179.886NOYES
CVE-2020-11022MEDIUM
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append
Apr 29, 20206.183NOYES
View all 971 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (971 CVEs).

CISA KEV
9 CVEs
0.9% of CVEs· 96th percentile
Metasploit
4 CVEs
0.4% of CVEs· 96th percentile
Nuclei
7 CVEs
0.7% of CVEs· 96th percentile
ExploitDB
9 CVEs
0.9% of CVEs· 87th percentile

Social Chatter

Signals from CVEs in this product scope (971 CVEs).

Media Mentions

Signals from CVEs in this product scope (971 CVEs).

Top CNAs Publishing CVEs For Oncommand Insight

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
7.3.016.51.0%00