High NCSC-2024-0302 8 CVEs

Kwetsbaarheden verholpen in Oracle JD Edwards

Published Jul 17, 2024 · Updated Jul 17, 2024 · nl

Vendor: Oracle Product: JD Edwards EnterpriseOne Orchestrator Product: JD Edwards EnterpriseOne Tools Product: jd_edwards_world_security

Summary

Er zijn kwetsbaarheden verholpen in Oracle JD Edwards.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

* Denial-of-Service (DoS)
* Toegang tot gevoelige gegevens
* Toegang tot systeemgegevens
* Manipulatie van gegevens

Oplossingen
Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.

Vulnerabilities 8

Medium 6.5

CVE-2023-6129

POLY1305 MAC implementation corrupts vector registers on PowerPC

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker ca…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jan 9, 2024
Medium 6.5

CVE-2024-21168

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator…

Oracle JD Edwards EnterpriseOne Orchestrator

Jul 16, 2024
Medium 6.1

CVE-2022-31160 Public exploit

jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems

Jul 20, 2022
Medium 6.1

CVE-2024-21150

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

Oracle JD Edwards EnterpriseOne Tools

Jul 16, 2024
Medium 5.3

CVE-2023-33201

Bouncy Castle For Java LDAP injection vulnerability

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven

Jul 5, 2023
Medium 5.3

CVE-2023-3817

Excessive time spent checking DH q parameter value

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 31, 2023
Medium 5.0

CVE-2023-35887 Public exploit

Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" in…

Apache Software Foundation Apache MINA SSHD sonarqube org.apache.sshd:sshd-core Wolfi Maven

Jul 10, 2023
Unscored —

CVE-2023-38552

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can inte…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 18, 2023

Revision history

2024-07-17 #0
Initiele versie

References

Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2022-31160
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-33201
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-35887
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-3817
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-38552
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-6129
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-21150
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-21168
Reference - cveprojectv5; ibm; nvd; oracle
https://www.oracle.com/security-alerts/cpujul2024.html