High WID-SEC-2023-2676 5 CVEs

Oracle Enterprise Manager: Mehrere Schwachstellen

Published Oct 17, 2023 · Updated Oct 17, 2023 · de-DE

Vendor: Oracle Product: Enterprise Manager Product: Enterprise Manager 12.4.0.0 Product: Enterprise Manager 13.3.0.1 Product: Enterprise Manager 13.5.0.0 Product: Enterprise Manager 13.5.1.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Enterprise Manager ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Enterprise Manager (OEM) ist ein Set von System Management Werkzeugen von Oracle für Oracle Umgebungen. Es beinhaltet Werkzeuge zum Monitoring von Oracle Umgebung und zur Automatisierung von Datenbank- und Applikations Administration.

Vulnerabilities 5

Critical 9.1

CVE-2023-23914

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functiona…

curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine

Feb 23, 2023
High 7.7

CVE-2022-25647 EPSS 12%

Deserialization of Untrusted Data

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven

May 1, 2022
High 7.5

CVE-2020-36518 Public exploit

Deeply nested json in jackson-databind

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Mar 11, 2022
High 7.5

CVE-2021-40690

Bypass of the secureValidation property

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abus…

Apache Software Foundation Apache Santuario org.apache.santuario:xmlsec libxml-security-java Debian Ubuntu Maven

Sep 19, 2021
High 7.5

CVE-2022-43680 Public exploit

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…

thunderbird insighttoolkit4 expat matanza Debian Ubuntu Azure Linux Alpine

Oct 24, 2022

Revision history

2023-10-17 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - October 2023 - Appendix Oracle Enterprise Manager vom 2023-10-17
https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixEM