Skip to content
OpenAdvisories
High NCSC-2024-0415 7 CVEs

Kwetsbaarheden verholpen in Oracle Enterprise Manager

Published Oct 17, 2024 · Updated Oct 17, 2024 · nl

Vendor: Oracle Product: Application Testing Suite Product: Enterprise Asset Management Product: Enterprise Data Quality Product: Enterprise Manager Product: Enterprise Manager Base Platform Product: Enterprise Manager for Fusion Middleware Product: Enterprise Manager Ops Center Product: enterprise_manager_for__database Product: enterprise_manager_for__virtual_infrastructure Product: enterprise_manager_for_peoplesoft Product: enterprise_manager_for_virtualization

Summary

Oracle heeft kwetsbaarheden verholpen in Enterprise Manager.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

- Denial-of-Service (DoS)
- Uitvoer van willekeurige code (Gebruikersrechten)
- Uitvoer van willekeurige code (Administratorrechten)
- Toegang tot gevoelige gegevens

Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 7

  • Critical 9.1
    CVE-2022-34381

    Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain a…

    Dell Dell BSAFE SSL-J Dell BSAFE Crypto-J
  • High 7.5
    CVE-2023-37920

    Certifi's removal of e-Tugra root certificate

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were…

    certifi python-certifi python-pip certifi Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • High 7.5
    CVE-2024-22201

    Jetty connection leaking on idle timeout when TCP congested

    Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptor…

    jetty jetty.project jetty9 jetty Debian Ubuntu Maven
  • Medium 6.7
    CVE-2023-28823

    Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may…

  • Medium 6.5
    CVE-2023-44483

    Apache Santuario: Private Key disclosure in debug-log output

    All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level i…

    Apache Software Foundation Apache Santuario sonarqube-10 org.apache.santuario:xmlsec Debian Ubuntu Wolfi Maven
  • Medium 5.5
    CVE-2024-26308 Public exploit

    Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

    Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2024-29025

    Netty HttpPostRequestDecoder can OOM

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the dis…

    netty netty druid netty Debian Ubuntu Wolfi Maven

Revision history

  1. #0

    Initiele versie

References