Internet Directory
Vendor:
First CVE: Dec 19, 2000 · Active for 25 years
8
Total CVEs
More Total CVEs than 85% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 27% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Internet Directory over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 19, 2000
25 years ago
Most Recent CVE
May 1, 2019
2,643 days ago
CVE Severity & Scoring
Internet Directory8 CVEs
13%
25%
63%
All CVEs352,719 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network2 (25.0%)
Unknown5 (62.5%)
Physical0 (0.0%)
Adjacent Network1 (12.5%)
Attack Complexity
Low1 (12.5%)
High2 (25.0%)
Unknown5 (62.5%)
User Interaction
None2 (25.0%)
Unknown5 (62.5%)
Required1 (12.5%)
Privileges Required
Low0 (0.0%)
High1 (12.5%)
None2 (25.0%)
Unknown5 (62.5%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-0227HIGH A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projec | May 1, 2019 | 7.5 | 84 | NO | YES |
CVE-2018-8032MEDIUM Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. | Aug 2, 2018 | 6.1 | 26 | NO | NO |
CVE-2018-2601HIGH Vulnerability in the Oracle Internet Directory component of Oracle Fusion Middleware (subcomponent: Oracle Directory Services Manager). Supported versions that are affected are 11. | Jan 18, 2018 | 8.0 | 24 | NO | NO |
CVE-2001-0975HIGH Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 | Jul 16, 2001 | 7.5 | 22 | NO | NO |
CVE-2001-0974HIGH Format string vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 te | Jul 17, 2001 | 7.5 | 21 | NO | NO |
CVE-2001-1321HIGH Oracle Internet Directory Server 2.1.1.x and 3.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings of BER OBJ | Jul 16, 2001 | 7.5 | 21 | NO | NO |
CVE-2000-0987MEDIUM Buffer overflow in oidldapd in Oracle 8.1.6 allow local users to gain privileges via a long "connect" command line parameter. | Dec 19, 2000 | 4.6 | 21 | NO | YES |
oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory (ldaplog) that has world-writable permissions, which may allow local users to delete logs and/or overwrite other f | Jun 2, 2001 | 2.1 | 11 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
25.0% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Internet Directory
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.0.1 | 3 | 7.5 | 7.0% | 0 | 0 |
| 2.1.1.1 | 1 | 2.1 | 0.6% | 0 | 0 |
| 2.1.1 | 3 | 7.5 | 7.0% | 0 | 0 |
| 2.0.6 | 1 | 4.6 | 1.4% | 0 | 1 |
| 12.2.1.4.0 | 2 | 6.8 | 51.2% | 0 | 1 |
| 12.2.1.3.0 | 3 | 7.2 | 34.7% | 0 | 1 |
| 11.1.1.9.0 | 1 | 8.0 | 1.7% | 0 | 0 |
| 11.1.1.7.0 | 1 | 8.0 | 1.7% | 0 | 0 |