High WID-SEC-2023-1027 4 CVEs

Oracle Utilities Applications: Mehrere Schwachstellen

Published Apr 18, 2023 · Updated Apr 18, 2023 · de-DE

Vendor: Oracle Product: Utilities Applications Product: Utilities Applications 2.3.0.2 Product: Utilities Applications 2.4.0.1 Product: Utilities Applications 2.5.0.0 Product: Utilities Applications 2.5.0.1 Product: Utilities Applications 4.2.0.3.0 Product: Utilities Applications 4.3.0.6.0 Product: Utilities Applications 4.4.0.0.0 Product: Utilities Applications 4.4.0.2.0 Product: Utilities Applications 4.4.0.3.0 Product: Utilities Applications 4.5.0.0.0 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Utilities Applications ist eine Produktfamilie mit branchenspezifischen Lösungen für Ver- und Entsorger.

Vulnerabilities 4

Critical 9.8

CVE-2022-23305 Public exploit EPSS 67%

SQL injection in JDBC Appender in Apache Log4j V1

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…

Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven

Jan 18, 2022
High 8.8

CVE-2020-13936 EPSS 23%

Velocity Sandbox Bypass

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/mod…

Apache Software Foundation Apache Velocity Engine velocity velocity Debian Ubuntu Maven

Mar 10, 2021
High 8.2

CVE-2022-41966 Public exploit

XStream Denial of Service via stack overflow

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…

x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven

Dec 27, 2022
Medium 6.5

CVE-2021-41184 Public exploit EPSS 41%

XSS in the `of` option of the `.position()` util

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value pass…

jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems

Oct 26, 2021

Revision history

2023-04-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle Utilities Applications vom 2023-04-18
https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixUTIL