Medium 1 exploited CVE WID-SEC-2024-0108 5 CVEs

Oracle Commerce: Mehrere Schwachstellen

Published Jan 16, 2024 · Updated Jan 16, 2024 · de-DE

Vendor: Oracle Product: Commerce 11.3.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Commerce ist eine elektronische Handelsplattform.

Vulnerabilities 5

High 7.5

CVE-2023-44487 Exploited Public exploit EPSS 100%

HTTP/2 Stream Cancellation Attack

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL

Oct 10, 2023
KEV Oct 10, 2023
High 7.5

CVE-2023-46589

Apache Tomcat: HTTP request smuggling via malformed trailer headers

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

Nov 28, 2023
High 7.5

CVE-2023-5072

DoS Vulnerability in JSON-Java

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven

Oct 12, 2023
Medium 6.5

CVE-2022-40152 EPSS 18%

Stack Buffer Overflow in Woodstox

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effec…

x-stream Woodstox libxstream-java sonarqube-10 Debian Ubuntu Wolfi Maven

Sep 16, 2022
Low 3.3

CVE-2022-33879

Incomplete fix and new regex DoS in StandardsExtractingContentHandler

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 …

Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven

Jun 27, 2022

Revision history

2024-01-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Commerce vom 2024-01-16
https://www.oracle.com/security-alerts/cpujan2024.html#AppendixOCOM