# Oracle Application Testing Suite


- [CVE-2020-11023](https://insights.sbomify.com/CVE-2020-11023/): JQuery Cross-Site Scripting (XSS) (medium 6.9, exploited in the wild)
- [CVE-2026-35290](https://insights.sbomify.com/CVE-2026-35290/): Auth bypass in Oracle Application Testing Suite (critical 9.8)
- [CVE-2026-46876](https://insights.sbomify.com/CVE-2026-46876/): Auth bypass in Oracle Application Testing Suite (critical 9.8)
- [CVE-2026-46924](https://insights.sbomify.com/CVE-2026-46924/): Auth bypass in Oracle Application Testing Suite (critical 9.8)
- [CVE-2018-1285](https://insights.sbomify.com/CVE-2018-1285/): XML External Entity attack in log4net (critical 9.8)
- [CVE-2020-10683](https://insights.sbomify.com/CVE-2020-10683/): dom4j allows External Entities by default which might enable XXE attacks (critical 9.8)
- [CVE-2019-17571](https://insights.sbomify.com/CVE-2019-17571/): Deserialization of Untrusted Data in Log4j (critical 9.8)
- [CVE-2019-2904](https://insights.sbomify.com/CVE-2019-2904/): Auth bypass in Enterprise Repository (critical 9.8)
- [CVE-2018-1275](https://insights.sbomify.com/CVE-2018-1275/): Spring Framework has Improperly Implemented Security Check for Standard (critical 9.8)
- [CVE-2018-1270](https://insights.sbomify.com/CVE-2018-1270/): Spring Framework allows applications to expose STOMP over WebSocket endpoints (critical 9.8)
- [CVE-2017-5645](https://insights.sbomify.com/CVE-2017-5645/): Deserialization of Untrusted Data in Log4j (critical 9.8)
- [CVE-2026-70862](https://insights.sbomify.com/CVE-2026-70862/): Missing authorization in Oracle Application Testing Suite (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/application-testing-suite/