High NCSC-2024-0304 10 CVEs

Kwetsbaarheden verholpen in Oracle PeopleSoft

Published Jul 17, 2024 · Updated Jul 17, 2024 · nl

Vendor: Oracle Product: enterprise_manager_for_peoplesoft Product: PeopleSoft Enterprise CC Common Application Objects Product: PeopleSoft Enterprise HCM Benefits Administration Product: PeopleSoft Enterprise HCM Global Payroll Switzerland Product: PeopleSoft Enterprise HCM Human Resources Product: PeopleSoft Enterprise HCM Shared Components Product: PeopleSoft Enterprise PeopleTools Product: PeopleSoft Enterprise PT PeopleTools Product: peoplesoft_enterprise_crm_client_management

Summary

Er zijn kwetsbaarheden verholpen in Oracle PeopleSoft.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

* Denial-of-Service (DoS)
* Toegang tot gevoelige gegevens
* Toegang tot systeemgegevens
* Manipulatie van gegevens

Oplossingen
Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.

Vulnerabilities 10

High 7.5

CVE-2023-28756

Ruby Time component ReDoS issue

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are …

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems

Mar 31, 2023
Medium 6.4

CVE-2024-21158

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…

Oracle PeopleSoft Enterprise PT PeopleTools

Jul 16, 2024
Medium 6.1

CVE-2024-21178

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…

Oracle PeopleSoft Enterprise PT PeopleTools

Jul 16, 2024
Medium 5.9

CVE-2023-48795 Public exploit Scanner template EPSS 94%

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io

Dec 18, 2023
Medium 5.5

CVE-2023-42503

Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue…

Apache Software Foundation Apache Commons Compress trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

Sep 14, 2023
Medium 5.5

CVE-2024-26308 Public exploit

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven

Feb 19, 2024
Medium 5.4

CVE-2024-21122

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Text Catalog)…

Oracle PeopleSoft Enterprise HCM Shared Components

Jul 16, 2024
Medium 4.7

CVE-2024-0232

Sqlite: use-after-free bug in jsonparseaddnodearray

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash an…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian

Jan 16, 2024
Medium 4.3

CVE-2024-21154

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources…

Oracle PeopleSoft Enterprise HCM Human Resources

Jul 16, 2024
Medium 4.1

CVE-2024-21180

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards).…

Oracle PeopleSoft Enterprise PT PeopleTools

Jul 16, 2024

Revision history

2024-07-17 #0
Initiele versie

References

Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-28756
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-42503
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-48795
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-0232
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-21122
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-21154
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-21158
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-21178
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-21180
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2024-26308
Reference - cveprojectv5; ibm; nvd; oracle
https://www.oracle.com/security-alerts/cpujul2024.html