Medium 1 exploited CVE WID-SEC-2024-0116 2 CVEs

Oracle Siebel CRM: Mehrere Schwachstellen

Published Jan 16, 2024 · Updated Jan 16, 2024 · de-DE

Vendor: Oracle Product: Siebel CRM Product: Siebel CRM < 23.12 Product: Siebel CRM <= 23.8 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Verfügbarkeit zu gefährden.

Product

Siebel CRM ist eine CRM-Lösung von Oracle.

Vulnerabilities 2

High 7.5

CVE-2023-44487 Exploited Public exploit EPSS 100%

HTTP/2 Stream Cancellation Attack

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL

Oct 10, 2023
KEV Oct 10, 2023
Medium 5.9

CVE-2023-1436

Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven

Mar 16, 2023

Revision history

2024-01-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Siebel CRM vom 2024-01-16
https://www.oracle.com/security-alerts/cpujan2024.html#AppendixSECR