FEDRAMP CATALOG › Taleo Cloud - U.S. Government Cloud
Taleo Cloud - U.S. Government Cloud
Oracle · package F1603227880
Current status
Authorized · Moderate impact · since 2026-07-07
Service modelSaaS
MarketplaceRev5 · source: marketplace
Security posture
78 critical
34 high
46 on KEV
· 119 correlated CVEs
CMMC DOMAINS ADDRESSED
STATUS TIMELINE · SCD2
| STATUS | FROM | TO |
|---|---|---|
| Authorized | 2026-07-07 | current |
AUTHORIZATIONS
| AGENCY | TYPE | DATE |
|---|---|---|
| Department of Justice | Agency | 2020-06-26 |
EXPOSED CVEs · CORRELATED TO THIS PRODUCT
all exposures
| SEVERITY | CVE | TITLE |
|---|---|---|
| HIGH | CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability |
| CRITICAL | CVE-2026-60977 | CVE-2026-60977: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware |
| CRITICAL | CVE-2026-60990 | CVE-2026-60990: Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion |
| CRITICAL | CVE-2026-61001 | CVE-2026-61001: Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middle |
| CRITICAL | CVE-2026-61003 | CVE-2026-61003: Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middl |
| CRITICAL | CVE-2026-61066 | CVE-2026-61066: Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware |
| CRITICAL | CVE-2026-61241 | CVE-2026-61241: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa |
| CRITICAL | CVE-2026-61248 | CVE-2026-61248: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa |
| CRITICAL | CVE-2026-61258 | CVE-2026-61258: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa |
| CRITICAL | CVE-2026-70905 | CVE-2026-70905: Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( |
| HIGH | CVE-2026-46817 | Oracle E-Business Suite Improper Privilege Management Vulnerability |
| CRITICAL | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
| HIGH | CVE-2024-21182 | Oracle WebLogic Server Unspecified Vulnerability |
| HIGH | CVE-2025-61757 | Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability |
| CRITICAL | CVE-2025-61884 | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability |
| CRITICAL | CVE-2025-61882 | Oracle E-Business Suite Unspecified Vulnerability |
| HIGH | CVE-2024-20953 | Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability |
| HIGH | CVE-2020-2883 | Oracle WebLogic Server Unspecified Vulnerability |
| HIGH | CVE-2024-21287 | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability |
| HIGH | CVE-2020-14644 | Oracle WebLogic Server Remote Code Execution Vulnerability |
| HIGH | CVE-2022-21445 | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability |
| HIGH | CVE-2017-3506 | Oracle WebLogic Server OS Command Injection Vulnerability |
| HIGH | CVE-2020-2551 | Oracle Fusion Middleware Unspecified Vulnerability |
| HIGH | CVE-2016-3427 | Oracle Java SE and JRockit Unspecified Vulnerability |
| HIGH | CVE-2023-21839 | Oracle WebLogic Server Unspecified Vulnerability |
| CRITICAL | CVE-2022-21587 | Oracle E-Business Suite Unspecified Vulnerability |
| HIGH | CVE-2021-35587 | Oracle Fusion Middleware Unspecified Vulnerability |
| HIGH | CVE-2018-2628 | Oracle WebLogic Server Unspecified Vulnerability |
| HIGH | CVE-2010-0840 | Oracle JRE Unspecified Vulnerability |
| CRITICAL | CVE-2012-1710 | Oracle Fusion Middleware Unspecified Vulnerability |
| CRITICAL | CVE-2013-0422 | Oracle JRE Remote Code Execution Vulnerability |
| CRITICAL | CVE-2013-0431 | Oracle JRE Sandbox Bypass Vulnerability |
| HIGH | CVE-2013-2423 | Oracle JRE Unspecified Vulnerability |
| HIGH | CVE-2019-3010 | Oracle Solaris Privilege Escalation Vulnerability |
| HIGH | CVE-2012-0518 | Oracle Fusion Middleware Unspecified Vulnerability |
| HIGH | CVE-2012-5076 | Oracle Java SE Sandbox Bypass Vulnerability |
| CRITICAL | CVE-2013-2465 | Oracle Java SE Unspecified Vulnerability |
| HIGH | CVE-2019-2616 | Oracle BI Publisher Unauthorized Access Vulnerability |
| HIGH | CVE-2008-3431 | Oracle VirtualBox Insufficient Input Validation Vulnerability |
| HIGH | CVE-2011-3544 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability |
| CRITICAL | CVE-2012-0507 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability |
| CRITICAL | CVE-2012-1723 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability |
| CRITICAL | CVE-2012-4681 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability |
| HIGH | CVE-2015-2590 | Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability |
| HIGH | CVE-2015-4902 | Oracle Java SE Integrity Check Vulnerability |
| CRITICAL | CVE-2022-25315 | CVE-2022-25315: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNa |
| CRITICAL | CVE-2022-25235 | CVE-2022-25235: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of e |
| CRITICAL | CVE-2022-25236 | CVE-2022-25236: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert names |
| CRITICAL | CVE-2017-10271 | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability |
| CRITICAL | CVE-2022-23852 | CVE-2022-23852: Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer |
| HIGH | CVE-2020-14864 | Oracle Business Intelligence Enterprise Edition Path Transversal |
| CRITICAL | CVE-2022-23218 | CVE-2022-23218: The deprecated compatibility function svcunix_create in the sunrpc module of the |
| CRITICAL | CVE-2022-23219 | CVE-2022-23219: The deprecated compatibility function clnt_create in the sunrpc module of the GN |
| CRITICAL | CVE-2019-2725 | Oracle WebLogic Server, Injection |
| HIGH | CVE-2021-23450 | CVE-2021-23450: All versions of package dojo are vulnerable to Prototype Pollution via the setOb |
| HIGH | CVE-2012-3152 | Oracle Fusion Middleware Unspecified Vulnerability |
| HIGH | CVE-2015-4852 | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability |
| HIGH | CVE-2020-14750 | Oracle WebLogic Server Remote Code Execution Vulnerability |
| HIGH | CVE-2020-14871 | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability |
| HIGH | CVE-2020-14882 | Oracle WebLogic Server Remote Code Execution Vulnerability |
| HIGH | CVE-2020-14883 | Oracle WebLogic Server Unspecified Vulnerability |
| HIGH | CVE-2020-2555 | Oracle Multiple Products Remote Code Execution Vulnerability |
| CRITICAL | CVE-2021-22945 | CVE-2021-22945: When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some |
| CRITICAL | CVE-2021-40438 | CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an orig |
| CRITICAL | CVE-2021-3711 | CVE-2021-3711: In order to decrypt SM2 encrypted data an application is expected to call the AP |
| CRITICAL | CVE-2021-3520 | CVE-2021-3520: There's a flaw in lz4. An attacker who submits a crafted file to an application |
| CRITICAL | CVE-2021-29921 | CVE-2021-29921: In Python before 3,9,5, the ipaddress library mishandles leading zero characters |
| MEDIUM | CVE-2021-21342 | CVE-2021-21342: XStream is a Java library to serialize objects to XML and back again. In XStream |
| MEDIUM | CVE-2021-21344 | CVE-2021-21344: XStream is a Java library to serialize objects to XML and back again. In XStream |
| MEDIUM | CVE-2021-21345 | CVE-2021-21345: XStream is a Java library to serialize objects to XML and back again. In XStream |
| MEDIUM | CVE-2021-21346 | CVE-2021-21346: XStream is a Java library to serialize objects to XML and back again. In XStream |
| MEDIUM | CVE-2021-21347 | CVE-2021-21347: XStream is a Java library to serialize objects to XML and back again. In XStream |
| MEDIUM | CVE-2021-21350 | CVE-2021-21350: XStream is a Java library to serialize objects to XML and back again. In XStream |
| MEDIUM | CVE-2021-21351 | CVE-2021-21351: XStream is a Java library to serialize objects to XML and back again. In XStream |
| CRITICAL | CVE-2021-3177 | CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callpro |
| CRITICAL | CVE-2020-27619 | CVE-2020-27619: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec test |
| CRITICAL | CVE-2020-10683 | CVE-2020-10683: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Enti |
| CRITICAL | CVE-2020-11656 | CVE-2020-11656: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, a |
| CRITICAL | CVE-2019-14893 | CVE-2019-14893: A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.1 |
| CRITICAL | CVE-2020-9546 | CVE-2020-9546: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee |
| CRITICAL | CVE-2020-9547 | CVE-2020-9547: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee |
| CRITICAL | CVE-2020-9548 | CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee |
| CRITICAL | CVE-2020-1938 | CVE-2020-1938: When using the Apache JServ Protocol (AJP), care must be taken when trusting inc |
| CRITICAL | CVE-2020-8840 | CVE-2020-8840: FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JN |
| CRITICAL | CVE-2019-20330 | CVE-2019-20330: FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache bloc |
| CRITICAL | CVE-2019-19646 | CVE-2019-19646: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAG |
| CRITICAL | CVE-2019-19317 | CVE-2019-19317: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in |
| CRITICAL | CVE-2019-17531 | CVE-2019-17531: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th |
| CRITICAL | CVE-2019-17267 | CVE-2019-17267: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2 |
| CRITICAL | CVE-2019-16942 | CVE-2019-16942: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th |
| CRITICAL | CVE-2019-16943 | CVE-2019-16943: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th |
| CRITICAL | CVE-2019-5481 | CVE-2019-5481: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. |
| CRITICAL | CVE-2019-5482 | CVE-2019-5482: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. |
| CRITICAL | CVE-2019-14540 | CVE-2019-14540: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2 |
| CRITICAL | CVE-2019-16335 | CVE-2019-16335: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2 |
| CRITICAL | CVE-2019-14379 | CVE-2019-14379: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles de |
| CRITICAL | CVE-2018-11307 | CVE-2018-11307: An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use o |
| CRITICAL | CVE-2013-7285 | CVE-2013-7285: Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework h |
| CRITICAL | CVE-2019-2725 | CVE-2019-2725: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middlewar |
| CRITICAL | CVE-2019-9636 | CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handl |
| CRITICAL | CVE-2019-3773 | CVE-2019-3773: Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of al |
| CRITICAL | CVE-2018-14718 | CVE-2018-14718: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec |
| CRITICAL | CVE-2018-14719 | CVE-2018-14719: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec |
| CRITICAL | CVE-2018-14720 | CVE-2018-14720: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct ext |
| CRITICAL | CVE-2018-14721 | CVE-2018-14721: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to cond |
| CRITICAL | CVE-2018-19360 | CVE-2018-19360: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec |
| CRITICAL | CVE-2018-19361 | CVE-2018-19361: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec |
| CRITICAL | CVE-2018-19362 | CVE-2018-19362: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec |
| CRITICAL | CVE-2018-1273 | CVE-2018-1273: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older |
| CRITICAL | CVE-2018-1270 | CVE-2018-1270: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 a |
| CRITICAL | CVE-2018-7489 | CVE-2018-7489: FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x befor |
| CRITICAL | CVE-2017-15095 | CVE-2017-15095: A deserialization flaw was discovered in the jackson-databind in versions before |
| CRITICAL | CVE-2017-7525 | CVE-2017-7525: A deserialization flaw was discovered in the jackson-databind, versions before 2 |
| CRITICAL | CVE-2016-5018 | CVE-2016-5018: In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0. |
| CRITICAL | CVE-2016-9841 | CVE-2016-9841: inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecif |
| CRITICAL | CVE-2017-5645 | CVE-2017-5645: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket |
| CRITICAL | CVE-2016-8735 | CVE-2016-8735: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7 |
| CRITICAL | CVE-2012-4681 | CVE-2012-4681: Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Orac |
| CRITICAL | CVE-2012-1710 | CVE-2012-1710: Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in |