Skip to content
COOEY

FEDRAMP CATALOG › Aconex for Defense

Aconex for Defense

Oracle · package FR1712871948

Current status Authorized · Moderate impact · since 2026-07-07 Service modelSaaS MarketplaceRev5 · source: marketplace Security posture 78 critical 34 high 46 on KEV · 119 correlated CVEs
CMMC DOMAINS ADDRESSED
SC · System and Communications ProtectionIA · Identification and AuthenticationMP · Media ProtectionAU · Audit and Accountability
STATUS TIMELINE · SCD2
STATUSFROMTO
Authorized2026-07-07current
AUTHORIZATIONS
AGENCYTYPEDATE
Department of DefenseAgency2023-01-04
EXPOSED CVEs · CORRELATED TO THIS PRODUCT all exposures
SEVERITYCVETITLE
HIGHCVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
CRITICALCVE-2026-60977CVE-2026-60977: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware
CRITICALCVE-2026-60990CVE-2026-60990: Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion
CRITICALCVE-2026-61001CVE-2026-61001: Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middle
CRITICALCVE-2026-61003CVE-2026-61003: Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middl
CRITICALCVE-2026-61066CVE-2026-61066: Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware
CRITICALCVE-2026-61241CVE-2026-61241: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa
CRITICALCVE-2026-61248CVE-2026-61248: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa
CRITICALCVE-2026-61258CVE-2026-61258: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa
CRITICALCVE-2026-70905CVE-2026-70905: Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (
HIGHCVE-2026-46817Oracle E-Business Suite Improper Privilege Management Vulnerability
CRITICALCVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
HIGHCVE-2024-21182Oracle WebLogic Server Unspecified Vulnerability
HIGHCVE-2025-61757Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
CRITICALCVE-2025-61884Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
CRITICALCVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability
HIGHCVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
HIGHCVE-2020-2883Oracle WebLogic Server Unspecified Vulnerability
HIGHCVE-2024-21287Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
HIGHCVE-2020-14644Oracle WebLogic Server Remote Code Execution Vulnerability
HIGHCVE-2022-21445Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
HIGHCVE-2017-3506Oracle WebLogic Server OS Command Injection Vulnerability
HIGHCVE-2020-2551Oracle Fusion Middleware Unspecified Vulnerability
HIGHCVE-2016-3427Oracle Java SE and JRockit Unspecified Vulnerability
HIGHCVE-2023-21839Oracle WebLogic Server Unspecified Vulnerability
CRITICALCVE-2022-21587Oracle E-Business Suite Unspecified Vulnerability
HIGHCVE-2021-35587Oracle Fusion Middleware Unspecified Vulnerability
HIGHCVE-2018-2628Oracle WebLogic Server Unspecified Vulnerability
HIGHCVE-2010-0840Oracle JRE Unspecified Vulnerability
CRITICALCVE-2012-1710Oracle Fusion Middleware Unspecified Vulnerability
CRITICALCVE-2013-0422Oracle JRE Remote Code Execution Vulnerability
CRITICALCVE-2013-0431Oracle JRE Sandbox Bypass Vulnerability
HIGHCVE-2013-2423Oracle JRE Unspecified Vulnerability
HIGHCVE-2019-3010Oracle Solaris Privilege Escalation Vulnerability
HIGHCVE-2012-0518Oracle Fusion Middleware Unspecified Vulnerability
HIGHCVE-2012-5076Oracle Java SE Sandbox Bypass Vulnerability
CRITICALCVE-2013-2465Oracle Java SE Unspecified Vulnerability
HIGHCVE-2019-2616Oracle BI Publisher Unauthorized Access Vulnerability
HIGHCVE-2008-3431Oracle VirtualBox Insufficient Input Validation Vulnerability
HIGHCVE-2011-3544Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
CRITICALCVE-2012-0507Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
CRITICALCVE-2012-1723Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
CRITICALCVE-2012-4681Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
HIGHCVE-2015-2590Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
HIGHCVE-2015-4902Oracle Java SE Integrity Check Vulnerability
CRITICALCVE-2022-25315CVE-2022-25315: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNa
CRITICALCVE-2022-25235CVE-2022-25235: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of e
CRITICALCVE-2022-25236CVE-2022-25236: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert names
CRITICALCVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
CRITICALCVE-2022-23852CVE-2022-23852: Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer
HIGHCVE-2020-14864Oracle Business Intelligence Enterprise Edition Path Transversal
CRITICALCVE-2022-23218CVE-2022-23218: The deprecated compatibility function svcunix_create in the sunrpc module of the
CRITICALCVE-2022-23219CVE-2022-23219: The deprecated compatibility function clnt_create in the sunrpc module of the GN
CRITICALCVE-2019-2725Oracle WebLogic Server, Injection
HIGHCVE-2021-23450CVE-2021-23450: All versions of package dojo are vulnerable to Prototype Pollution via the setOb
HIGHCVE-2012-3152Oracle Fusion Middleware Unspecified Vulnerability
HIGHCVE-2015-4852Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
HIGHCVE-2020-14750Oracle WebLogic Server Remote Code Execution Vulnerability
HIGHCVE-2020-14871Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
HIGHCVE-2020-14882Oracle WebLogic Server Remote Code Execution Vulnerability
HIGHCVE-2020-14883Oracle WebLogic Server Unspecified Vulnerability
HIGHCVE-2020-2555Oracle Multiple Products Remote Code Execution Vulnerability
CRITICALCVE-2021-22945CVE-2021-22945: When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some
CRITICALCVE-2021-40438CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an orig
CRITICALCVE-2021-3711CVE-2021-3711: In order to decrypt SM2 encrypted data an application is expected to call the AP
CRITICALCVE-2021-3520CVE-2021-3520: There's a flaw in lz4. An attacker who submits a crafted file to an application
CRITICALCVE-2021-29921CVE-2021-29921: In Python before 3,9,5, the ipaddress library mishandles leading zero characters
MEDIUMCVE-2021-21342CVE-2021-21342: XStream is a Java library to serialize objects to XML and back again. In XStream
MEDIUMCVE-2021-21344CVE-2021-21344: XStream is a Java library to serialize objects to XML and back again. In XStream
MEDIUMCVE-2021-21345CVE-2021-21345: XStream is a Java library to serialize objects to XML and back again. In XStream
MEDIUMCVE-2021-21346CVE-2021-21346: XStream is a Java library to serialize objects to XML and back again. In XStream
MEDIUMCVE-2021-21347CVE-2021-21347: XStream is a Java library to serialize objects to XML and back again. In XStream
MEDIUMCVE-2021-21350CVE-2021-21350: XStream is a Java library to serialize objects to XML and back again. In XStream
MEDIUMCVE-2021-21351CVE-2021-21351: XStream is a Java library to serialize objects to XML and back again. In XStream
CRITICALCVE-2021-3177CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callpro
CRITICALCVE-2020-27619CVE-2020-27619: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec test
CRITICALCVE-2020-10683CVE-2020-10683: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Enti
CRITICALCVE-2020-11656CVE-2020-11656: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, a
CRITICALCVE-2019-14893CVE-2019-14893: A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.1
CRITICALCVE-2020-9546CVE-2020-9546: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee
CRITICALCVE-2020-9547CVE-2020-9547: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee
CRITICALCVE-2020-9548CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee
CRITICALCVE-2020-1938CVE-2020-1938: When using the Apache JServ Protocol (AJP), care must be taken when trusting inc
CRITICALCVE-2020-8840CVE-2020-8840: FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JN
CRITICALCVE-2019-20330CVE-2019-20330: FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache bloc
CRITICALCVE-2019-19646CVE-2019-19646: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAG
CRITICALCVE-2019-19317CVE-2019-19317: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in
CRITICALCVE-2019-17531CVE-2019-17531: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th
CRITICALCVE-2019-17267CVE-2019-17267: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2
CRITICALCVE-2019-16942CVE-2019-16942: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th
CRITICALCVE-2019-16943CVE-2019-16943: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th
CRITICALCVE-2019-5481CVE-2019-5481: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CRITICALCVE-2019-5482CVE-2019-5482: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CRITICALCVE-2019-14540CVE-2019-14540: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2
CRITICALCVE-2019-16335CVE-2019-16335: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2
CRITICALCVE-2019-14379CVE-2019-14379: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles de
CRITICALCVE-2018-11307CVE-2018-11307: An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use o
CRITICALCVE-2013-7285CVE-2013-7285: Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework h
CRITICALCVE-2019-2725CVE-2019-2725: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middlewar
CRITICALCVE-2019-9636CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handl
CRITICALCVE-2019-3773CVE-2019-3773: Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of al
CRITICALCVE-2018-14718CVE-2018-14718: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec
CRITICALCVE-2018-14719CVE-2018-14719: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec
CRITICALCVE-2018-14720CVE-2018-14720: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct ext
CRITICALCVE-2018-14721CVE-2018-14721: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to cond
CRITICALCVE-2018-19360CVE-2018-19360: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec
CRITICALCVE-2018-19361CVE-2018-19361: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec
CRITICALCVE-2018-19362CVE-2018-19362: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec
CRITICALCVE-2018-1273CVE-2018-1273: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older
CRITICALCVE-2018-1270CVE-2018-1270: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 a
CRITICALCVE-2018-7489CVE-2018-7489: FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x befor
CRITICALCVE-2017-15095CVE-2017-15095: A deserialization flaw was discovered in the jackson-databind in versions before
CRITICALCVE-2017-7525CVE-2017-7525: A deserialization flaw was discovered in the jackson-databind, versions before 2
CRITICALCVE-2016-5018CVE-2016-5018: In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.
CRITICALCVE-2016-9841CVE-2016-9841: inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecif
CRITICALCVE-2017-5645CVE-2017-5645: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket
CRITICALCVE-2016-8735CVE-2016-8735: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7
CRITICALCVE-2012-4681CVE-2012-4681: Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Orac
CRITICALCVE-2012-1710CVE-2012-1710: Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in