Oncommand Performance Manager
Vendor:
First CVE: Apr 21, 2016 · Active for 10 years
73
Total CVEs
More Total CVEs than 99% of tracked products
24.3
Avg CVEs / Year
Higher CVE frequency than 99% of tracked products
7.2
Avg CVSS
Higher Avg CVSS than 43% of tracked products
2.7%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Oncommand Performance Manager over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 21, 2016
10 years ago
Most Recent CVE
Feb 6, 2018
3,090 days ago
CVE Severity & Scoring
Oncommand Performance Manager73 CVEs
41%
29%
26%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local4 (5.5%)
Network68 (93.2%)
Unknown0 (0.0%)
Physical1 (1.4%)
Adjacent Network0 (0.0%)
Attack Complexity
Low56 (76.7%)
High17 (23.3%)
Unknown0 (0.0%)
User Interaction
None49 (67.1%)
Unknown0 (0.0%)
Required24 (32.9%)
Privileges Required
Low10 (13.7%)
High4 (5.5%)
None59 (80.8%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (73 CVEs).
73 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-5195HIGH Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature | Nov 10, 2016 | 7.0 | 95 | YES | YES |
CVE-2016-3427CRITICAL Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and avai | Apr 21, 2016 | 9.8 | 95 | YES | NO |
CVE-2015-7871CRITICAL Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. | Aug 7, 2017 | 9.8 | 83 | NO | YES |
CVE-2017-7525CRITICAL A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by se | Feb 6, 2018 | 9.8 | 50 | NO | NO |
CVE-2015-7855MEDIUM The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 pa | Aug 7, 2017 | 6.5 | 43 | NO | YES |
CVE-2015-7705CRITICAL The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests. | Aug 7, 2017 | 9.8 | 36 | NO | NO |
CVE-2016-9841CRITICAL inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. | May 23, 2017 | 9.8 | 35 | NO | NO |
CVE-2017-15095CRITICAL A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending th | Feb 6, 2018 | 9.8 | 32 | NO | NO |
CVE-2017-10309HIGH Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u144 and 9. Easily exploitable vulnerability | Oct 19, 2017 | 7.1 | 31 | NO | YES |
CVE-2017-10089CRITICAL Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulne | Aug 8, 2017 | 9.6 | 31 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (73 CVEs).
CISA KEV
2 CVEs
2.7% of CVEs· 96th percentile
Metasploit
1 CVE
1.4% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
4 CVEs
5.5% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (73 CVEs).
Media Mentions
Signals from CVEs in this product scope (73 CVEs).
Top CNAs Publishing CVEs For Oncommand Performance Manager
Top CWEs
Versions
No cataloged versions.