High WID-SEC-2023-1023 6 CVEs

Oracle Commerce: Mehrere Schwachstellen

Published Apr 18, 2023 · Updated Apr 18, 2023 · de-DE

Vendor: Oracle Product: Commerce Product: Commerce 11.3.0 Product: Commerce 11.3.1 Product: Commerce 11.3.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Commerce ist eine elektronische Handelsplattform.

Vulnerabilities 6

Critical 9.8

CVE-2021-42575

Policies not properly enforced in OWASP Java HTML Sanitizer

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Maven

Oct 18, 2021
High 7.5

CVE-2022-42003

Uncontrolled Resource Consumption in Jackson-databind

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Oct 2, 2022
High 7.5

CVE-2022-45143

Apache Tomcat: JsonErrorReportValve escaping

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to s…

Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven

Jan 3, 2023
Medium 6.5

CVE-2022-23437 EPSS 12%

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged durat…

Apache Software Foundation Apache Xerces xerces:xercesImpl libxerces2-java Debian Ubuntu Azure Linux Maven

Jan 24, 2022
Medium 6.5

CVE-2022-24729

Regular expression Denial of Service in dialog plugin

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significa…

ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu

Mar 16, 2022
Medium 6.5

CVE-2022-40152 EPSS 18%

Stack Buffer Overflow in Woodstox

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effec…

x-stream Woodstox libxstream-java sonarqube-10 Debian Ubuntu Wolfi Maven

Sep 16, 2022

Revision history

2023-04-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle Commerce vom 2023-04-18
https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixOCOM