Skip to content
OpenAdvisories
Medium WID-SEC-2023-1792 2 CVEs

Oracle Policy Automation: Mehrere Schwachstellen

Published Jul 18, 2023 · Updated Jul 18, 2023 · de-DE

Vendor: Oracle Product: Policy Automation Product: Policy Automation < 12.2.30 Product: Policy Automation < 12.2.31 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Policy Automation ausnutzen, um die Verfügbarkeit zu gefährden.

Product

Oracle Policy Automation dient der automatisierten Verwaltung und Durchsetzung von Richtlinien.

Vulnerabilities 2

  • High 7.5
    CVE-2023-1370

    Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

    [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

    json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2023-24998 Public exploit EPSS 49%

    Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

    Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…

    Apache Software Foundation Apache Tomcat Apache Commons FileUpload tomcat9 Debian Ubuntu Maven

Revision history

  1. #1

    Initiale Fassung

References