Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2018-2628

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 9.8 · CriticalBuzz score 55.3KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 55.3

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 9.5 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
9.5
4 sources across 1 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • Oracle Patches WebLogic Zero-Day Exploited in AttacksSecurityWeek

    Oracle has released an out-of-band update for WebLogic Server, a Java EE application server that is part of the company’s Fusion Middleware offering, to patch a zero-day vulnerability exploited in the wild by malicious actors.

    newswww.securityweek.comApr 29, 2019, 12:53 PM
  • Researchers warn of unpatched vulnerability in Oracle WebLogic ServerCSO Online

    Several security companies have detected scans over the past week that look for Oracle WebLogic servers vulnerable to a flaw that hasn’t yet been patched, possibly in preparation for malicious attacks. The vulnerability is a deserialization bug that can lead to remote code execution, but it’s located in a specific package called wls9_async_response that’s not […]

    newswww.csoonline.comApr 26, 2019, 8:26 PM
  • Nastiest malware of 2018: Top attack payloads wreaking havocHelp Net Security

    Webroot highlights the top cyberattacks of 2018 in its latest nastiest malware list, which showcases the malware and attack payloads that have been most detrimental to organisations and consumers alike. Three nastiest: Botnets and banking trojans Emotet is this year’s nastiest botnet that delivers banking Trojans. It aspires to increase the number of zombies in its spam botnet, with a concentration on credential gathering. Threat actors have recently developed a universal plug and play (UPnP) … More →

    newswww.helpnetsecurity.comOct 30, 2018, 12:23 PM
  • Security Affairs newsletter Round 161 – News of the weekSecurity Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs. Let me inform you that my new book, “Digging in the Deep Web” is online Kindle Edition Paper Copy Once again thank you! · 90% of the SAP customers exposed to hack due to 13 Year-Old configuration […]

    newssecurityaffairs.comMay 6, 2018, 5:51 PM
  • Hackers Target Poorly Patched Oracle WebLogic FlawSecurityWeek

    Hackers have been scanning the Internet for Oracle WebLogic Server installations that can be taken over using a recently addressed vulnerability. While patched systems should be protected against attacks, experts claim the fix implemented by Oracle can be bypassed.

    newswww.securityweek.comApr 30, 2018, 12:53 PM
  • Oracle botches CVE-2018-2628 patch and hackers promptly start scanning for vulnerable WebLogic installsSecurity Affairs

    According to a security expert, Oracle appears to have botched the CVE-2018-2628 fix, this means that attackers could bypass it to take over WebLogic servers. Earlier April, Oracle patched the critical CVE-2018-2628 vulnerability in Oracle WebLogic server, but an Alibaba security researcher @pyn3rd discovered that the proposed fix could be bypassed. https://twitter.com/pyn3rd/status/990114565219344384 The CVE-2018-2628 flaw was […]

    newssecurityaffairs.comApr 30, 2018, 10:05 AM
  • Oracle Patches 254 Flaws With April 2018 UpdateSecurityWeek

    Oracle’s Critical Patch Update (CPU) for April 2018 contains 254 new security fixes, 153 of which address vulnerabilities in business-critical applications.

    newswww.securityweek.comApr 18, 2018, 10:40 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence