High WID-SEC-2023-1032 10 CVEs

Oracle PeopleSoft: Mehrere Schwachstellen

Published Apr 18, 2023 · Updated Apr 18, 2023 · de-DE

Vendor: Oracle Product: PeopleSoft Product: PeopleSoft 8.58 Product: PeopleSoft 8.59 Product: PeopleSoft 8.60 Product: PeopleSoft 9.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle PeopleSoft ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle PeopleSoft ist eine ERP Anwendung.

Vulnerabilities 10

Critical 9.8

CVE-2020-14343 Public exploit

Improper Input Validation in PyYAML

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the libra…

pyyaml pyyaml pyyaml py3-yaml Debian Ubuntu Azure Linux Alpine PyPI

Feb 9, 2021
Critical 9.8

CVE-2022-45047 Public exploit

Apache MINA SSHD: Java unsafe deserialization vulnerability

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSH…

Apache Software Foundation Apache MINA SSHD org.apache.sshd:sshd-common org.apache.sshd:sshd-core Maven

Nov 16, 2022
High 7.5

CVE-2022-34169 Public exploit EPSS 82%

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven

Jul 19, 2022
High 7.5

CVE-2022-45685

Jettison Out-of-bounds Write vulnerability

A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.

druid libjettison-java libjettison-java org.codehaus.jettison:jettison Debian Ubuntu Wolfi Maven

Dec 13, 2022
Medium 6.5

CVE-2021-37533

Apache Commons Net's FTP client trusts the host from PASV response by default

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven

Dec 3, 2022
Medium 6.1

CVE-2022-36033

jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled

jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that l…

jhy jsoup org.jsoup:jsoup jsoup Debian Ubuntu Azure Linux Maven

Aug 29, 2022
Medium 5.4

CVE-2023-21992

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Work…

Oracle PeopleSoft Enterprise HCM Human Resources

Apr 18, 2023
Medium 5.3

CVE-2022-41881

HAProxyMessageDecoder Stack Exhaustion DoS

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…

netty netty netty netty Debian Ubuntu Maven

Dec 12, 2022
Medium 5.3

CVE-2023-21916

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Supported …

Oracle PeopleSoft Enterprise PT PeopleTools

Apr 18, 2023
Medium 4.9

CVE-2023-21981

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Suppor…

Oracle PeopleSoft Enterprise PT PeopleTools

Apr 18, 2023

Revision history

2023-04-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle PeopleSoft vom 2023-04-18
https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixPS