Oncommand Shift
Vendor:
First CVE: Apr 21, 2016 · Active for 10 years
64
Total CVEs
More Total CVEs than 98% of tracked products
21.3
Avg CVEs / Year
Higher CVE frequency than 98% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 48% of tracked products
6.3%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Oncommand Shift over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 21, 2016
10 years ago
Most Recent CVE
Feb 6, 2018
3,090 days ago
CVE Severity & Scoring
Oncommand Shift64 CVEs
34%
33%
30%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local3 (4.7%)
Network60 (93.8%)
Unknown0 (0.0%)
Physical1 (1.6%)
Adjacent Network0 (0.0%)
Attack Complexity
Low44 (68.8%)
High20 (31.3%)
Unknown0 (0.0%)
User Interaction
None37 (57.8%)
Unknown0 (0.0%)
Required27 (42.2%)
Privileges Required
Low2 (3.1%)
High0 (0.0%)
None62 (96.9%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (64 CVEs).
64 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-12617HIGH When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation | Oct 4, 2017 | 8.1 | 99 | YES | YES |
CVE-2017-12615HIGH When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upl | Sep 19, 2017 | 8.1 | 98 | YES | YES |
CVE-2016-8735CRITICAL Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener | Apr 6, 2017 | 9.8 | 97 | YES | YES |
CVE-2016-3427CRITICAL Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and avai | Apr 21, 2016 | 9.8 | 95 | YES | NO |
CVE-2017-17485CRITICAL FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization fl | Jan 10, 2018 | 9.8 | 58 | NO | NO |
CVE-2017-7525CRITICAL A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by se | Feb 6, 2018 | 9.8 | 50 | NO | NO |
CVE-2016-5018CRITICAL In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured Security | Aug 10, 2017 | 9.1 | 35 | NO | NO |
CVE-2016-9841CRITICAL inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. | May 23, 2017 | 9.8 | 35 | NO | NO |
CVE-2017-15095CRITICAL A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending th | Feb 6, 2018 | 9.8 | 32 | NO | NO |
CVE-2017-10309HIGH Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u144 and 9. Easily exploitable vulnerability | Oct 19, 2017 | 7.1 | 31 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (64 CVEs).
CISA KEV
4 CVEs
6.2% of CVEs· 97th percentile
Metasploit
1 CVE
1.6% of CVEs· 96th percentile
Nuclei
3 CVEs
4.7% of CVEs· 97th percentile
ExploitDB
4 CVEs
6.2% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (64 CVEs).
Media Mentions
Signals from CVEs in this product scope (64 CVEs).
Top CNAs Publishing CVEs For Oncommand Shift
Top CWEs
Versions
No cataloged versions.