Kwetsbaarheden verholpen in Oracle JD Edwards

Summary

Details

Vulnerabilities 8

• Critical 9.1
  CVE-2024-5535 Public exploit

  SSL_select_next_proto buffer overread

  Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 27, 2024
• High 8.1
  CVE-2024-23807

  Apache Xerces C++: Use-after-free on external DTD scan

  The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD pro…

  Apache Software Foundation Apache Xerces C++ xerces-c xerces-c Ubuntu Azure Linux
  Feb 28, 2024
• High 8.1
  CVE-2024-25710

  Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

  Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Azure Linux Wolfi Maven
  Feb 19, 2024
• Medium 6.5
  CVE-2025-30740

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

  Oracle JD Edwards EnterpriseOne Tools
  Apr 15, 2025
• Medium 6.1
  CVE-2025-30709

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

  Oracle JD Edwards EnterpriseOne Tools
  Apr 15, 2025
• Medium 5.4
  CVE-2025-21586

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

  Oracle JD Edwards EnterpriseOne Tools
  Apr 15, 2025
• Medium 5.1
  CVE-2024-45613

  CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

  CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, le…

  ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  Sep 25, 2024
• Medium 4.3
  CVE-2024-47554

  Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

  Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

  Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven
  Oct 3, 2024

Revision history

1. 2025-04-16 #1.0.0

   Initiele versie

References

• Reference - cveprojectv5; nvd; oracle
  https://www.oracle.com/security-alerts/cpuapr2025.html