Usu develops optimization tooling for Oracle environments, with its vulnerability footprint concentrated around the Oracle Optimization product. The observed weakness classes center on deserialization of untrusted data, OS command injection, and authentication bypass patterns, reflecting the risks inherent to integration software that processes external input and interacts with database administration functions. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Usu over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-29937HIGH USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (for example) an OS com | Apr 29, 2022 | 8.8 | 27 | NO | NO |
CVE-2022-29934HIGH USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation prod | Apr 29, 2022 | 7.8 | 25 | NO | NO |
CVE-2022-29935HIGH USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is not an Oracle Corporation product. | Apr 29, 2022 | 7.5 | 24 | NO | NO |
CVE-2022-29936HIGH USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: | Apr 29, 2022 | 8.8 | 22 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Usu.
Media articles that mention a CVE ID that affects a product developed by Usu — matched by CVE ID, not by vendor name.