Kwetsbaarheden verholpen in Oracle Analytics

Summary

Details

Vulnerabilities 13

• Critical 10.0
  CVE-2024-38999

  jrburke requirejs vulnerable to prototype pollution

  jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

  py3.11-jupyterhub py3.10-jupyterhub py3.13-jupyterhub py3.12-jupyterhub Debian Ubuntu Wolfi npm
  Jul 1, 2024
• Critical 9.8
  CVE-2022-23305 Public exploit EPSS 67%

  SQL injection in JDBC Appender in Apache Log4j V1

  By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…

  Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Jan 18, 2022
• High 8.8
  CVE-2023-38545 Public exploit EPSS 78%

  This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 18, 2023
• High 8.8
  CVE-2024-21254

  Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that a…

  Oracle Oracle BI Publisher
  Oct 15, 2024
• High 7.6
  CVE-2024-21195

  Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates). Supported versions …

  Oracle Oracle BI Publisher
  Oct 15, 2024
• High 7.5
  CVE-2023-0401

  NULL dereference during PKCS7 data verification

  A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available t…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi crates.io
  Feb 8, 2023
• High 7.5
  CVE-2024-29736

  Apache CXF: SSRF vulnerability via WADL stylesheet parameter

  A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-service-description Maven
  Jul 19, 2024
• High 7.5
  CVE-2024-39689 Public exploit

  Certifi removes GLOBALTRUST root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

  certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI
  Jul 5, 2024
• Medium 5.5
  CVE-2024-26308 Public exploit

  Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

  Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven
  Feb 19, 2024
• Medium 5.4
  CVE-2024-29133

  Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

  Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

  Apache Software Foundation Apache Commons Configuration druid trino Debian Ubuntu Wolfi Maven
  Mar 21, 2024
• Medium 5.3
  CVE-2023-5678

  Excessive time spent in DH check / generation with large Q parameter value

  Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 6, 2023
• Medium 5.3
  CVE-2024-38809

  Spring Framework DoS via conditional HTTP request

  Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If…

  thingsboard-tb-node thingsboard-tb-mqtt-transport apache-nifi libspring-java Debian Ubuntu Wolfi Maven
  Sep 27, 2024
• Unscored —
  CVE-2023-35116

  jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted…

  Jun 14, 2023

Revision history

1. 2024-10-17 #0

   Initiele versie

References

• Reference - cveprojectv5; hkcert; nvd; oracle; redhat
  https://www.oracle.com/security-alerts/cpuoct2024.html