High 1 exploited CVE NCSC-2024-0306 5 CVEs

Kwetsbaarheden verholpen in Oracle Supply Chain

Published Jul 17, 2024 · Updated Jul 17, 2024 · nl

Vendor: Oracle Product: Agile Engineering Data Management Product: autovue_for_agile_product_lifecycle_management

Summary

Er zijn kwetsbaarheden verholpen in Oracle Supply Chain.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

* Denial-of-Service (DoS)
* Toegang tot gevoelige gegevens
* Toegang tot systeemgegevens
* Manipulatie van gegevens
* (Remote) code execution (Gebruikersrechten)

Oplossingen
Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.

Vulnerabilities 5

High 7.5

CVE-2023-44487 Exploited Public exploit EPSS 100%

HTTP/2 Stream Cancellation Attack

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL

Oct 10, 2023
KEV Oct 10, 2023
High 8.2

CVE-2023-37536

HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

HCL Software BigFix Platform xerces-c xerces-c Debian Ubuntu

Oct 11, 2023
High 7.5

CVE-2022-34169 Public exploit EPSS 82%

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven

Jul 19, 2022
High 7.5

CVE-2023-24998 Public exploit EPSS 49%

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…

Apache Software Foundation Apache Tomcat Apache Commons FileUpload tomcat9 Debian Ubuntu Maven

Feb 20, 2023
High 7.5

CVE-2023-46589

Apache Tomcat: HTTP request smuggling via malformed trailer headers

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

Nov 28, 2023

Revision history

2024-07-17 #0
Initiele versie

References

Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2022-34169
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-24998
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-37536
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-44487
Source - nvd
https://nvd.nist.gov/vuln/detail/CVE-2023-46589
Reference - cveprojectv5; ibm; nvd; oracle
https://www.oracle.com/security-alerts/cpujul2024.html