Medium WID-SEC-2023-1030 6 CVEs

Oracle Siebel CRM: Mehrere Schwachstellen

Published Apr 18, 2023 · Updated Apr 18, 2023 · de-DE

Vendor: Oracle Product: Siebel CRM Product: Siebel CRM <= 21.10 Product: Siebel CRM <= 22.10 Product: Siebel CRM <= 22.5 Product: Siebel CRM <= 23.2 Product: Siebel CRM <= 23.3 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Siebel CRM ist eine CRM-Lösung von Oracle.

Vulnerabilities 6

High 7.5

CVE-2022-42003

Uncontrolled Resource Consumption in Jackson-databind

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Oct 2, 2022
High 7.5

CVE-2022-42252

Apache Tomcat request smuggling via malformed content-length

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing a…

Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

Nov 1, 2022
High 7.4

CVE-2021-3712 Public exploit EPSS 48%

Read buffer overruns processing ASN.1 strings

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

Aug 24, 2021
High 7.3

CVE-2021-37695

Execution of JavaScript code using malformed HTML in ckeditor

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objec…

ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm

Aug 12, 2021
High 7.2

CVE-2020-7712

Command Injection

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

json org.webjars.npm:json npm Maven

Aug 30, 2020
Medium 6.5

CVE-2023-21909

Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework). Supported versions that are aff…

Oracle Siebel UI Framework

Apr 18, 2023

Revision history

2023-04-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle Siebel CRM vom 2023-04-18
https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixSECR