Skip to content
OpenAdvisories
High NCSC-2024-0296 4 CVEs

Kwetsbaarheden verholpen in Oracle Enterprise Manager

Published Jul 17, 2024 · Updated Jul 17, 2024 · nl

Vendor: Oracle Product: Application Testing Suite Product: Enterprise Manager Base Platform Product: Enterprise Manager for Exadata Product: Enterprise Manager for Fusion Middleware Product: Enterprise Manager Ops Center Product: enterprise_manager_for_peoplesoft Product: enterprise_manager_for_virtualization

Summary

Er zijn kwetsbaarheden verholpen in Oracle Enterprise Manager.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

* Denial-of-Service (DoS)
* Toegang tot gevoelige gegevens
* Toegang tot systeemgegevens
* Manipulatie van gegevens

Oplossingen
Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.

Vulnerabilities 4

  • High 7.5
    CVE-2023-1370

    Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

    [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

    json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2021-37533

    Apache Commons Net's FTP client trusts the host from PASV response by default

    Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

    Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2023-48795 Public exploit Scanner template EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  • Medium 5.3
    CVE-2023-40167 Public exploit

    Jetty accepts "+" prefixed value in Content-Length

    Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…

    Eclipse Foundation jetty.project druid cassandra-reaper Debian Ubuntu Wolfi Maven

Revision history

  1. #0

    Initiele versie

References