Skip to content
OpenAdvisories
High NCSC-2025-0336 5 CVEs

Kwetsbaarheden verholpen in Oracle Hyperion

Published Oct 23, 2025 · Updated Oct 23, 2025 · nl

Vendor: Oracle Product: Hyperion Calculation Manager Product: Hyperion Data Relationship Management Product: Hyperion Financial Management Product: Hyperion Infrastructure Technology Product: Hyperion Planning

Summary

Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Hyperion, waaronder Hyperion Financial Management en Hyperion Data Relationship Management.

Details

Interpretaties
De kwetsbaarheden in Oracle Hyperion stellen ongeauthenticeerde aanvallers in staat om toegang te krijgen tot het systeem, wat kan leiden tot ongeautoriseerde gegevensaccess en manipulatie. Specifieke kwetsbaarheden zijn geclassificeerd met een CVSS-score van 6.1 tot 8.8, wat wijst op hun kritieke aard. Daarnaast zijn er kwetsbaarheden die Denial-of-Service (DoS) aanvallen mogelijk maken, met een CVSS-score van 7.5.

Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 5

  • High 8.8
    CVE-2025-48734 Public exploit

    Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

    Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

    Apache Software Foundation Apache Commons BeanUtils 1.x Apache Commons BeanUtils 2.x druid Debian Ubuntu Azure Linux Wolfi Maven
  • High 8.1
    CVE-2024-23807

    Apache Xerces C++: Use-after-free on external DTD scan

    The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD pro…

    Apache Software Foundation Apache Xerces C++ xerces-c xerces-c Ubuntu Azure Linux
  • High 7.5
    CVE-2025-48976 Public exploit EPSS 34%

    Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

    Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

    Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2021-3712 Public exploit EPSS 48%

    Read buffer overruns processing ASN.1 strings

    ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  • Medium 6.1
    CVE-2025-3573

    jquery-validation vulnerable to Cross-site Scripting

    Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a u…

    phpmyadmin phpmyadmin znuny znuny Debian Ubuntu npm

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://www.oracle.com/security-alerts/cpuoct2025.html