Oncommand System Manager

Vendor:

First CVE: Sep 1, 2016 · Active for 9 years

27
Total CVEs
More Total CVEs than 96% of tracked products
4.5
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 40% of tracked products
7.4%
KEV Rate
Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Oncommand System Manager over time

Volume of CVEsAvg CVSS Base Score
First CVE
Sep 1, 2016
9 years ago
Most Recent CVE
Feb 8, 2021
1,992 days ago

CVE Severity & Scoring

Oncommand System Manager27 CVEs
All CVEs352,294 CVEs
MediumHighCritical
Attack Vector
Local2 (7.4%)
Network25 (92.6%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low20 (74.1%)
High7 (25.9%)
Unknown0 (0.0%)
User Interaction
None21 (77.8%)
Unknown0 (0.0%)
Required6 (22.2%)
Privileges Required
Low7 (25.9%)
High1 (3.7%)
None19 (70.4%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (27 CVEs).

27 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2020-1938CRITICAL
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for e
Feb 24, 20209.899YESYES
CVE-2020-11023MEDIUM
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's
Apr 29, 20206.195YESYES
CVE-2020-11022MEDIUM
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append
Apr 29, 20206.183NOYES
CVE-2019-11358MEDIUM
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob
Apr 20, 20196.178NOYES
CVE-2020-13935HIGH
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payl
Jul 14, 20207.577NOYES
CVE-2019-17571CRITICAL
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a
Dec 20, 20199.872NONO
CVE-2020-13934HIGH
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a su
Jul 14, 20207.560NONO
CVE-2017-7658CRITICAL
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers
Jun 26, 20189.841NONO
CVE-2017-7657CRITICAL
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled
Jun 26, 20189.839NONO
CVE-2020-7656MEDIUM
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace characte
May 19, 20206.134NOYES
View all 27 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (27 CVEs).

CISA KEV
2 CVEs
7.4% of CVEs· 97th percentile
Metasploit
1 CVE
3.7% of CVEs· 96th percentile
Nuclei
2 CVEs
7.4% of CVEs· 97th percentile
ExploitDB
6 CVEs
22.2% of CVEs· 90th percentile

Social Chatter

Signals from CVEs in this product scope (27 CVEs).

Media Mentions

Signals from CVEs in this product scope (27 CVEs).

Top CNAs Publishing CVEs For Oncommand System Manager

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
9.425.50.5%00
9.325.50.5%00
8.3.227.32.0%00
8.3.127.32.0%00
8.327.32.0%00
3.x19.816.2%00
3.1.317.526.7%00
3.017.526.7%00