High WID-SEC-2023-1795 4 CVEs

Oracle JD Edwards: Mehrere Schwachstellen

Published Jul 18, 2023 · Updated Jul 18, 2023 · de-DE

Vendor: Oracle Product: JD Edwards Product: JD Edwards < 9.2.7.3 Product: JD Edwards < 9.2.7.4 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Komponenten der Oracle JDEdwards sind vollständig integrierte und komplette Lösungen geschäftlicher Anwendungen (ERP) für Unternehmen.

Vulnerabilities 4

High 8.3

CVE-2022-1471 Public exploit EPSS 100%

Remote Code execution in SnakeYAML

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven

Dec 1, 2022
High 8.1

CVE-2022-43548 EPSS 15%

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Dec 5, 2022
Medium 6.1

CVE-2023-22055

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

Oracle JD Edwards EnterpriseOne Tools

Jul 18, 2023
Medium 5.4

CVE-2023-22050

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator…

Oracle JD Edwards EnterpriseOne Orchestrator

Jul 18, 2023

Revision history

2023-07-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - July 2023 - Appendix Oracle JD Edwards vom 2023-07-18
https://www.oracle.com/security-alerts/cpujul2023.html#AppendixJDE