Kwetsbaarheden verholpen in Oracle Financial Services Applications

Summary

Details

Vulnerabilities 21

• Critical 9.8
  CVE-2022-36944 Public exploit EPSS 11%

  Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization

  Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase conte…

  org.scala-lang:scala-library Maven
  Sep 23, 2022
• Critical 9.8
  CVE-2023-47248 Public exploit Scanner template EPSS 13%

  PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

  Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied in…

  Apache Software Foundation PyArrow pyarrow PyPI
  Nov 9, 2023
• High 8.5
  CVE-2024-32114 Public exploit Scanner template

  Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

  In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can …

  Apache Software Foundation Apache ActiveMQ org.apache.activemq:apache-activemq Maven
  May 2, 2024
• High 8.1
  CVE-2023-50447

  Arbitrary Code Execution in Pillow

  Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Jan 19, 2024
• High 8.1
  CVE-2024-22262 Public exploit

  CVE-2024-22262: Spring Framework URL Parsing with Host Validation

  Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  a…

  Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  Apr 16, 2024
• High 8.1
  CVE-2024-23807

  Apache Xerces C++: Use-after-free on external DTD scan

  The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD pro…

  Apache Software Foundation Apache Xerces C++ xerces-c xerces-c Ubuntu Azure Linux
  Feb 28, 2024
• High 7.5
  CVE-2023-26031

  Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems

  Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root …

  Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-yarn-project Maven
  Nov 16, 2023
• High 7.5
  CVE-2023-52425

  libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

  insighttoolkit4 expat vtk swish-e Debian Ubuntu Azure Linux Alpine
  Feb 4, 2024
• High 7.5
  CVE-2024-22201

  Jetty connection leaking on idle timeout when TCP congested

  Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptor…

  jetty jetty.project jetty9 jetty Debian Ubuntu Maven
  Feb 26, 2024
• High 7.5
  CVE-2024-24549 Public exploit EPSS 23%

  Apache Tomcat: HTTP/2 header handling DoS

  Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Mar 13, 2024
• High 7.5
  CVE-2024-25062

  An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD…

  qt6-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 4, 2024
• Medium 6.5
  CVE-2023-44483

  Apache Santuario: Private Key disclosure in debug-log output

  All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level i…

  Apache Software Foundation Apache Santuario sonarqube-10 org.apache.santuario:xmlsec Debian Ubuntu Wolfi Maven
  Oct 20, 2023
• Medium 6.5
  CVE-2023-6129

  POLY1305 MAC implementation corrupts vector registers on PowerPC

  Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker ca…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 9, 2024
• Medium 6.1
  CVE-2024-21188

  Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Appl…

  Oracle Financial Services Revenue Management and Billing
  Jul 16, 2024
• Medium 6.1
  CVE-2024-24816 Public exploit

  Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

  CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in t…

  ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm
  Feb 7, 2024
• Medium 5.9
  CVE-2024-2511 EPSS 59%

  Unbounded memory growth with session handling in TLSv1.3

  Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Apr 8, 2024
• Medium 5.5
  CVE-2024-26308 Public exploit

  Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

  Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven
  Feb 19, 2024
• Medium 5.4
  CVE-2024-29133

  Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

  Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

  Apache Software Foundation Apache Commons Configuration druid trino Debian Ubuntu Wolfi Maven
  Mar 21, 2024
• Medium 5.3
  CVE-2023-34055

  Spring Boot server Web Observations DoS Vulnerability

  In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following…

  Spring Spring Boot org.springframework.boot:spring-boot-actuator Maven
  Nov 28, 2023
• Medium 5.3
  CVE-2023-51074

  json-path Out-of-bounds Write vulnerability

  json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

  trino trino-plugin-opensearch trino-plugin-pinot trino-plugin-lakehouse Ubuntu Wolfi Maven
  Dec 27, 2023
• Medium 5.3
  CVE-2024-29025

  Netty HttpPostRequestDecoder can OOM

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the dis…

  netty netty druid netty Debian Ubuntu Wolfi Maven
  Mar 25, 2024

Revision history

1. 2024-07-17 #0

   Initiele versie

References

• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2022-36944
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-26031
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-34055
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-44483
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-47248
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-50447
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-51074
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-52425
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-6129
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-21188
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-22201
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-22262
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-23807
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-24549
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-24816
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-25062
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-2511
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-26308
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-29025
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-29133
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-32114
• Reference - cveprojectv5; ibm; nvd; oracle
  https://www.oracle.com/security-alerts/cpujul2024.html