Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Product
Oracle Retail Applications ist eine Sammlung von Produkten zur Unterstützung u. a. von Handelsfirmen und der Gastronomie.
Vulnerabilities 5
-
Critical 9.8
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…
-
High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…
-
Medium 6.5
Apache Commons Net's FTP client trusts the host from PASV response by default
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…
-
Medium 6.5
Spring Framework vulnerable to denial of service
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
-
Medium 5.9
Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
Revision history
-
#1
Initiale Fassung
References
-
Oracle Critical Patch Update Advisory - July 2023 - Appendix Oracle Retail Applications vom 2023-07-18
https://www.oracle.com/security-alerts/cpujul2023.html#AppendixRAPP