Skip to content
OpenAdvisories
Critical 2 exploited CVEs WID-SEC-2023-2946 36 CVEs

Oracle Fusion Middleware: Mehrere Schwachstellen

Published Jan 14, 2020 · Updated Nov 16, 2023 · Revision 3 · de-DE

Vendor: Oracle Vendor: Red Hat Product: Enterprise Linux Product: Fusion Middleware Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.

Product

Oracle Fusion Middleware bündelt mehrere Produkte zur Erstellung, Betrieb und Management von intelligenten Business Anwendungen.

Vulnerabilities 36

  • Critical 9.8
    CVE-2020-2551 Exploited Public exploit Scanner template EPSS 93%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppo…

    Oracle WebLogic Server
    KEV Nov 16, 2023
  • Critical 9.8
    CVE-2020-2555 Exploited Public exploit EPSS 97%

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). S…

    Oracle WebCenter Portal Utilities Framework
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-2546 Public exploit

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - Jav…

    Oracle WebLogic Server
  • High 7.5
    CVE-2017-12626 EPSS 10%

    Denial of Service in Apache POI

    Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI …

    Apache Software Foundation Apache POI libapache-poi-java org.apache.poi:poi Debian Ubuntu Maven
  • High 7.5
    CVE-2019-0227 Public exploit EPSS 92%

    Server Side Request Forgery in Apache Axis

    A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from so…

    Apache Apache Axis 1.4 axis org.apache.axis:axis Debian Ubuntu Maven
  • High 7.5
    CVE-2019-17359

    Out-of-Memory Error in Bouncy Castle Crypto

    The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

    org.bouncycastle:bcprov-jdk14 Maven
  • High 7.5
    CVE-2020-2728

    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM - LDAP user and role Synch). …

    Oracle Identity Manager
  • High 7.5
    CVE-2020-6950 Public exploit Scanner template EPSS 10%

    Directory traversal in Eclipse Mojarra

    Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.

    org.glassfish:mojarra-parent Maven
  • High 7.3
    CVE-2020-2543

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …

    Oracle Outside In Technology
  • High 7.2
    CVE-2020-2549

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). The s…

    Oracle WebLogic Server
  • High 7.1
    CVE-2020-2537

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: An…

    Oracle Oracle Business Intelligence Enterprise Edition
  • High 7.1
    CVE-2020-2538

    Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported…

    Oracle WebCenter Sites
  • Medium 6.5
    CVE-2020-2540

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …

    Oracle Outside In Technology
  • Medium 6.5
    CVE-2020-2541

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …

    Oracle Outside In Technology
  • Medium 6.5
    CVE-2020-2542

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …

    Oracle Outside In Technology
  • Medium 6.5
    CVE-2020-2576

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …

    Oracle Outside In Technology
  • Medium 6.1
    CVE-2018-8032 Public exploit EPSS 11%

    Moderate severity vulnerability that affects apache axis

    Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

    Apache Software Foundation Apache Axis axis org.apache.axis:axis Debian Ubuntu Maven
  • Medium 6.1
    CVE-2020-2530

    Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported versio…

    Oracle HTTP Server
  • Medium 6.1
    CVE-2020-2533

    Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticati…

    Oracle Reports Developer
  • Medium 6.1
    CVE-2020-2534

    Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticati…

    Oracle Reports Developer
  • Medium 6.1
    CVE-2020-2539

    Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported…

    Oracle WebCenter Sites
  • Medium 5.5
    CVE-2019-12415

    Improper Restriction of XML External Entity Reference in Apache POI

    In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External E…

    libapache-poi-java org.apache.poi:poi libapache-poi-java Debian Ubuntu Maven
  • Medium 5.4
    CVE-2020-2536

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …

    Oracle Outside In Technology
  • Medium 5.4
    CVE-2020-2729

    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Advanced Console). Supported vers…

    Oracle Identity Manager
  • Medium 5.3
    CVE-2019-10246

    Information Exposure vulnerability in Eclipse Jetty

    In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. T…

    The Eclipse Foundation Eclipse Jetty org.eclipse.jetty:jetty-server Maven
  • Medium 5.3
    CVE-2019-10247

    Installation information leak in Eclipse Jetty

    In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error …

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2020-2545

    Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported version…

    Oracle Security Service
  • Medium 5.1
    CVE-2020-2550

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppo…

    Oracle WebLogic Server
  • Medium 4.8
    CVE-2020-2547

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
  • Medium 4.8
    CVE-2020-2548

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). The s…

    Oracle WebLogic Server
  • Medium 4.8
    CVE-2020-2552

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppo…

    Oracle WebLogic Server
  • Medium 4.7
    CVE-2020-2535

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: An…

    Oracle Oracle Business Intelligence Enterprise Edition
  • Medium 4.3
    CVE-2020-2519

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
  • Medium 4.3
    CVE-2020-2544

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
  • Low 3.1
    CVE-2020-2531

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI…

    Oracle Oracle Business Intelligence Enterprise Edition
  • Unscored —
    CVE-2019-1559 EPSS 17%

    0-byte record padding oracle

    If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

Revision history

  1. #3

    Exploit-Hinweis für CVE-2020-2551 aufgenommen

  2. #2

    Neue Updates von Red Hat aufgenommen

  3. #1

    Initiale Fassung

References