High 1 exploited CVE WID-SEC-2023-1015 9 CVEs

Oracle Health Sciences Applications: Mehrere Schwachstellen

Published Apr 18, 2023 · Updated Dec 7, 2025 · Revision 3 · de-DE

Vendor: Oracle Product: Health Sciences Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Health Sciences Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Health Sciences Applications ist eine Zusammenstellung von Produkten für die Pharma-, Biotechnologie-, Medizin- und Gesundheitsbranche.

Vulnerabilities 9

Critical 9.8

CVE-2019-18935 Exploited · Ransomware Public exploit EPSS 100%

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…

Dec 11, 2019
KEV Nov 3, 2021
High 8.3

CVE-2023-21923

Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…

Oracle Health Sciences InForm

Apr 18, 2023
Medium 6.8

CVE-2023-21922

Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…

Oracle Health Sciences InForm

Apr 18, 2023
Medium 6.5

CVE-2021-41184 Public exploit EPSS 41%

XSS in the `of` option of the `.position()` util

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value pass…

jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems

Oct 26, 2021
Medium 6.5

CVE-2023-21993

Vulnerability in the Oracle Clinical Remote Data Capture product of Oracle Health Sciences Applications (component: For…

Oracle Clinical Remote Data Capture Option

Apr 18, 2023
Medium 5.9

CVE-2023-21924

Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…

Oracle Health Sciences InForm

Apr 18, 2023
Medium 5.5

CVE-2023-21926

Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…

Oracle Health Sciences InForm

Apr 18, 2023
Medium 5.4

CVE-2023-21921

Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…

Oracle Health Sciences InForm

Apr 18, 2023
Medium 5.3

CVE-2023-21925

Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…

Oracle Health Sciences InForm

Apr 18, 2023

Revision history

2025-12-07 #3
PoC aufgenommen
2025-02-04 #2
Aktive Ausnutzung gemeldet
2023-04-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle Health Sciences Applications vom 2023-04-18
https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixHCAR
eSentire Blog vom 2025-02-04
https://www.esentire.com/blog/threat-actors-use-cve-2019-18935-to-deliver-reverse-shells-and-juicypotatong-privilege-escalation-tool
PoC vom 2025-02-04
https://github.com/alanbarret/CVE-2019-18935