Oracle PeopleSoft: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• Critical 9.8
  CVE-2022-42920

  Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

  Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pa…

  Apache Software Foundation Apache Commons BCEL bcel bcel Debian Ubuntu Azure Linux Maven
  Nov 7, 2022
• High 7.5
  CVE-2022-45688 Public exploit

  json stack overflow vulnerability

  A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

  cn.hutool:hutool-json org.json:json Maven
  Dec 13, 2022
• Medium 6.5
  CVE-2023-22090

  Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Event…

  Oracle PeopleSoft Enterprise CC Common Application Objects
  Oct 17, 2023
• Medium 6.5
  CVE-2023-34462

  netty-handler SniHandler 16MB allocation

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

  netty netty netty netty Debian Ubuntu Wolfi Maven
  Jun 22, 2023
• Medium 6.1
  CVE-2023-22080

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). S…

  Oracle PeopleSoft Enterprise PT PeopleTools
  Oct 17, 2023

Revision history

1. 2023-10-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - October 2023 - Appendix Oracle PeopleSoft vom 2023-10-17
  https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixPS