Skip to content
OpenAdvisories
Medium WID-SEC-2023-2678 4 CVEs

Oracle Construction and Engineering: Mehrere Schwachstellen

Published Oct 17, 2023 · Updated Oct 17, 2023 · de-DE

Vendor: Oracle Product: Construction and Engineering Product: Construction and Engineering <= 19.12.16 Product: Construction and Engineering <= 19.12.17 Product: Construction and Engineering <= 20.12.12 Product: Construction and Engineering <= 20.12.16 Product: Construction and Engineering <= 21.12.10 Product: Construction and Engineering <= 21.12.16 Product: Construction and Engineering <= 22.12.9 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Construction and Engineering ist eine Sammlung von Werkzeugen zur Unterstützung von Bau- und Ingenieurbüros. Sie umfasst u. a. Projektmanagement-Lösungen zur Verwaltung von Projekte, zur Schaffung von Transparenz, zur Zusammenarbeit und zur Verwaltung von Änderungen.

Vulnerabilities 4

  • High 7.5
    CVE-2022-45688 Public exploit

    json stack overflow vulnerability

    A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

    cn.hutool:hutool-json org.json:json Maven
  • Medium 6.1
    CVE-2022-31160 Public exploit

    jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

    jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

    jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems
  • Medium 5.5
    CVE-2023-2976

    Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

    Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

    Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  • Low 3.3
    CVE-2022-41954

    Temporary File Information Disclosure Vulnerability

    MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permi…

    joniles mpxj net.sf.mpxj:mpxj net.sf.mpxj-for-csharp Maven PyPI NuGet

Revision history

  1. #1

    Initiale Fassung

References