High 1 exploited CVE WID-SEC-2023-1012 9 CVEs

Oracle Insurance Applications: Mehrere Schwachstellen

Published Apr 18, 2023 · Updated Apr 18, 2023 · de-DE

Vendor: Oracle Product: Insurance Applications Product: Insurance Applications <= 12.6.4.0.0 Product: Insurance Applications 1.0.1.8 Product: Insurance Applications 12.6.0.0.0 Product: Insurance Applications 12.7.0.0.0 Product: Insurance Applications 12.7.1.0.0 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Insurance Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Insurance Applications ist eine Produktfamilie mit Lösungen für die Versicherungsbranche.

Vulnerabilities 9

Critical 9.8

CVE-2022-22965 Exploited Public exploit Scanner template EPSS 100%

Remote Code Execution in Spring Framework

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…

libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven

Apr 1, 2022
KEV Apr 4, 2022
High 8.2

CVE-2020-11987 EPSS 14%

Server-side request forgery (SSRF) in Apache Batik

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GE…

batik batik org.apache.xmlgraphics:batik-svgbrowser Debian Ubuntu Maven

Feb 24, 2021
High 7.5

CVE-2020-25649 EPSS 18%

XML External Entity (XXE) Injection in Jackson Databind

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Dec 3, 2020
High 7.5

CVE-2022-42003

Uncontrolled Resource Consumption in Jackson-databind

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Oct 2, 2022
High 7.5

CVE-2023-24998 Public exploit EPSS 49%

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…

Apache Software Foundation Apache Tomcat Apache Commons FileUpload tomcat9 Debian Ubuntu Maven

Feb 20, 2023
High 7.3

CVE-2019-10086 EPSS 29%

Insecure Deserialization in Apache Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default chara…

Apache Apache Commons Beanutils trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

Aug 20, 2019
Medium 6.1

CVE-2021-35043

Cross-site Scripting in OWASP AntiSamy

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

libowasp-antisamy-java libowasp-antisamy-java org.owasp.antisamy:antisamy Debian Ubuntu Maven

Jul 19, 2021
Medium 4.7

CVE-2020-35168

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…

Dell Dell BSAFE Crypto-C Micro Edition

Jul 11, 2022
Unscored —

CVE-2022-27404

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the funct…

qt5-qtwebengine freetype freetype qt5-qtbase Debian Ubuntu Azure Linux Alpine

Apr 22, 2022

Revision history

2023-04-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle Insurance Applications vom 2023-04-18
https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixINSU