Kwetsbaarheden verholpen in Oracle Database producten

Summary

Details

Vulnerabilities 15

• Critical 9.5
  CVE-2024-52577

  Apache Ignite: Possible RCE when deserializing incoming messages by the server node

  In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose cl…

  Apache Software Foundation Apache Ignite trino trino-plugin-opensearch Wolfi Maven
  Feb 14, 2025
• Critical 9.4
  CVE-2025-4517 Public exploit

  Arbitrary writes via tarfile realpath overflow

  Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() usin…

  Python Software Foundation CPython python3 python3.12 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 3, 2025
• High 8.1
  CVE-2025-61763

  Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.7.3.0.0…

  Oracle Oracle Essbase
  Oct 21, 2025
• High 7.5
  CVE-2024-57699

  Netplex Json-smart Uncontrolled Recursion vulnerability

  A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issu…

  trino trino-plugin-opensearch trino-plugin-lakehouse trino-plugin-pinot Debian Ubuntu Wolfi Maven
  Feb 5, 2025
• High 7.5
  CVE-2025-48976 Public exploit EPSS 34%

  Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

  Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

  Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• High 7.5
  CVE-2025-52520

  Apache Tomcat: DoS via integer overflow in multipart file upload

  For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Jul 10, 2025
• Medium 6.8
  CVE-2025-4949

  XXE vulnerability in Eclipse JGit

  In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are v…

  Eclipse JGit Eclipse JGit thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 21, 2025
• Medium 6.3
  CVE-2025-8885

  Possible DOS in processing specially formed ASN.1 Object Identifiers

  Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated wi…

  Legion of the Bouncy Castle BC-JAVA BC-FJA bouncycastle Debian Ubuntu Maven
  Aug 12, 2025
• Medium 6.3
  CVE-2025-8916

  Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

  Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpk…

  Legion of the Bouncy Castle BC-JAVA BCPKIX-FIPS druid Debian Ubuntu Wolfi Maven
  Aug 13, 2025
• Medium 5.9
  CVE-2025-61881

  Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.28, …

  Oracle Oracle Database Server
  Oct 21, 2025
• Medium 5.8
  CVE-2025-53047

  Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are…

  Oracle Oracle Database Server
  Oct 21, 2025
• Medium 5.8
  CVE-2025-53864

  Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

  Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the G…

  Connect2id Nimbus JOSE+JWT druid tez Ubuntu Wolfi Maven
  Jul 11, 2025
• Medium 5.3
  CVE-2020-13956

  Cross-site scripting in Apache HttpClient

  Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

  druid trino trino-plugin-opensearch trino-plugin-lakehouse Debian Ubuntu Wolfi Maven
  Dec 2, 2020
• Low 2.7
  CVE-2025-53051 Public exploit

  Vulnerability in the RDBMS Functional Index component of Oracle Database Server. Supported versions that are affected a…

  Oracle Oracle Database Server
  Oct 21, 2025
• Low 2.7
  CVE-2025-61749

  Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-2…

  Oracle Oracle Database Server
  Oct 21, 2025

Revision history

1. 2025-10-23 #1.0.0

   Initiele versie