High NCSC-2024-0305 12 CVEs

Kwetsbaarheden verholpen in Oracle Siebel CRM

Published Jul 17, 2024 · Updated Jul 17, 2024 · nl

Vendor: Oracle Product: Siebel CRM Product: Siebel CRM Cloud Applications Product: Siebel CRM Deployment Product: Siebel CRM End User Product: Siebel CRM Integration

Summary

Er zijn kwetsbaarheden verholpen in Oracle Siebel CRM.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

* Denial-of-Service (DoS)
* Toegang tot gevoelige gegevens
* Toegang tot systeemgegevens
* Manipulatie van gegevens
* (Remote) code execution (Gebruikersrechten)

Oplossingen
Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.

Vulnerabilities 12

Critical 9.8

CVE-2022-37434 Public exploit EPSS 19%

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…

openjpeg2 rsync fltk gdal Debian Ubuntu Azure Linux Alpine Wolfi

Aug 5, 2022
High 7.5

CVE-2021-36090 EPSS 13%

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Co…

Apache Software Foundation Apache Commons Compress org.apache.commons:commons-compress libcommons-compress-java Debian Ubuntu Azure Linux Maven

Jul 13, 2021
High 7.5

CVE-2022-34169 Public exploit EPSS 82%

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven

Jul 19, 2022
High 7.5

CVE-2022-42003

Uncontrolled Resource Consumption in Jackson-databind

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Oct 2, 2022
High 7.5

CVE-2023-46589

Apache Tomcat: HTTP request smuggling via malformed trailer headers

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

Nov 28, 2023
High 7.5

CVE-2023-5072

DoS Vulnerability in JSON-Java

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven

Oct 12, 2023
High 7.1

CVE-2023-5764

Ansible: template injection

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection …

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 1.2 Debian Ubuntu Azure Linux PyPI

Dec 12, 2023
Medium 5.3

CVE-2023-22081

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi

Oct 17, 2023
Medium 5.3

CVE-2023-33201

Bouncy Castle For Java LDAP injection vulnerability

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven

Jul 5, 2023
Medium 5.3

CVE-2023-47627

Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not…

aio-libs aiohttp py3-cassandra-medusa aiohttp Debian Ubuntu Azure Linux Wolfi PyPI

Nov 14, 2023
Medium 5.3

CVE-2023-5678

Excessive time spent in DH check / generation with large Q parameter value

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Nov 6, 2023
Unscored —

CVE-2023-41105

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(),…

python3.11 python3.11 Debian Ubuntu

Aug 23, 2023

Revision history

2024-07-17 #0
Initiele versie

References

Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2021-36090
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2022-34169
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2022-37434
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2022-42003
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-22081
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-33201
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-41105
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-46589
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-47627
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-5072
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-5678
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-5764
Reference - cveprojectv5; ibm; nvd; oracle
https://www.oracle.com/security-alerts/cpujul2024.html