Critical 1 exploited CVE WID-SEC-2022-1769 5 CVEs

Oracle E-Business Suite: Mehrere Schwachstellen

Published Oct 18, 2022 · Updated Feb 2, 2023 · Revision 2 · de-DE

Vendor: Oracle Product: E-Business Suite Product: E-Business Suite <= 12.2.11 Product: E-Business Suite 13.4.1.0.0 Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle E-Business Suite ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle E-Business Suite ist eine Sammlung geschäftlicher Anwendungen für Unternehmen.

Vulnerabilities 5

Critical 9.8

CVE-2022-21587 Exploited · Ransomware Public exploit Scanner template EPSS 98%

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

Oracle Web Applications Desktop Integrator

Oct 18, 2022
KEV Feb 2, 2023
Critical 9.8

CVE-2022-23305 Public exploit EPSS 67%

SQL injection in JDBC Appender in Apache Log4j V1

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…

Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven

Jan 18, 2022
Critical 9.8

CVE-2022-39428 EPSS 38%

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

Oracle Web Applications Desktop Integrator

Oct 18, 2022
High 7.3

CVE-2019-10086 EPSS 29%

Insecure Deserialization in Apache Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default chara…

Apache Apache Commons Beanutils trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

Aug 20, 2019
Medium 6.5

CVE-2022-21636

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). …

Oracle Applications Framework

Oct 18, 2022

Revision history

2023-02-02 #2
Exploit-Hinweis für CVE-2022-21587 aufgenommen
2022-10-18 #1
Initiale Fassung

References

CISA Known Exploited Vulnerabilities Catalog vom 2023-02-02
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Oracle Critical Patch Update Advisory - October 2022 - Appendix Oracle E-Business Suite vom 2022-10-18
https://www.oracle.com/security-alerts/cpuoct2022.html#AppendixEBS