High NCSC-2025-0022 6 CVEs

Kwetsbaarheden verholpen in Oracle Enterprise Manager

Published Jan 22, 2025 · Updated Jan 22, 2025 · nl

Vendor: Oracle Product: Application Testing Suite Product: Enterprise Manager Base Platform Product: enterprise_manager_for_mysql_database

Summary

Oracle heeft kwetsbaarheden verholpen in Oracle Enterprise Manager

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om toegang te verkrijgen tot gevoelige data of een Denial-of-Service te veroorzaken.

Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 6

Critical 10.0

CVE-2024-38999

jrburke requirejs vulnerable to prototype pollution

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

py3.10-jupyterhub py3.13-jupyterhub py3.12-jupyterhub py3.11-jupyterhub Debian Ubuntu Wolfi npm

Jul 1, 2024
High 7.5

CVE-2024-29857

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CP…

druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven NuGet

May 9, 2024
High 7.5

CVE-2024-38819 Public exploit Scanner template EPSS 56%

Spring Framework Path Traversal vulnerability

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the p…

libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven

Dec 19, 2024
Medium 5.3

CVE-2023-51074

json-path Out-of-bounds Write vulnerability

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

trino trino-plugin-opensearch trino-plugin-lakehouse trino-plugin-pinot Ubuntu Wolfi Maven

Dec 27, 2023
Low 3.1

CVE-2024-38820 Public exploit

CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

VMware Spring thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Oct 18, 2024
Unscored —

CVE-2024-38998 Public exploit Rejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…

Jul 1, 2024

Revision history

2025-01-22 #0
Initiele versie

References

Reference - cveprojectv5; nvd; oracle
https://www.oracle.com/security-alerts/cpujan2025.html