High WID-SEC-2023-0136 6 CVEs

Oracle Construction and Engineering: Mehrere Schwachstellen

Published Jan 17, 2023 · Updated Jan 17, 2023 · de-DE

Vendor: Oracle Product: Construction and Engineering Product: Construction and Engineering <= 18.8.15 Product: Construction and Engineering <= 19.12.15 Product: Construction and Engineering <= 20.12.10 Product: Construction and Engineering <= 21.12.8 Product: Construction and Engineering 18.8 Product: Construction and Engineering 19.12 Product: Construction and Engineering 20.12 Product: Construction and Engineering 21.12 Product: Construction and Engineering 22.12 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Construction and Engineering ist eine Sammlung von Werkzeugen zur Unterstützung von Bau- und Ingenieurbüros. Sie umfasst u. a. Projektmanagement-Lösungen zur Verwaltung von Projekte, zur Schaffung von Transparenz, zur Zusammenarbeit und zur Verwaltung von Änderungen.

Vulnerabilities 6

Critical 9.8

CVE-2022-42889 Public exploit EPSS 100%

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

Apache Software Foundation Apache Commons Text commons-text commons-text Debian Ubuntu Maven

Oct 13, 2022
High 7.5

CVE-2022-34917

Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException…

Apache Software Foundation Apache Kafka org.apache.kafka:kafka Maven

Sep 20, 2022
High 7.5

CVE-2022-42003

Uncontrolled Resource Consumption in Jackson-databind

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Oct 2, 2022
Medium 5.4

CVE-2023-21888

Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: WebUI). Supported ver…

Oracle Primavera Gateway

Jan 17, 2023
Medium 4.3

CVE-2022-3171

Memory handling vulnerability in ProtocolBuffers Java core and lite

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields …

Google Protocolbuffers druid trino Debian Ubuntu Wolfi Maven RubyGems

Oct 12, 2022
Low 3.3

CVE-2021-23358 Public exploit

Arbitrary Code Injection

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

js-jquery underscore underscore underscore Debian Ubuntu Azure Linux npm

Mar 29, 2021

Revision history

2023-01-17 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Construction and Engineering vom 2023-01-17
https://www.oracle.com/security-alerts/cpujan2023.html#AppendixPVA