High WID-SEC-2024-0122 7 CVEs

Oracle Hyperion: Mehrere Schwachstellen

Published Jan 16, 2024 · Updated Jan 16, 2024 · de-DE

Vendor: Oracle Product: Hyperion 11.2.14.0.000 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Hyperion ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Hyperion bietet Lösungen für Business Intelligence, Planung und Konsolidierung.

Vulnerabilities 7

Critical 9.8

CVE-2021-42575

Policies not properly enforced in OWASP Java HTML Sanitizer

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Maven

Oct 18, 2021
Critical 9.8

CVE-2022-37434 Public exploit EPSS 19%

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…

openjpeg2 rsync fltk crash Debian Ubuntu Azure Linux Alpine Wolfi

Aug 5, 2022
Critical 9.8

CVE-2023-50164 Public exploit EPSS 81%

Apache Struts: File upload component had a directory traversal vulnerability

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or …

Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven

Dec 7, 2023
High 7.5

CVE-2023-5072

DoS Vulnerability in JSON-Java

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven

Oct 12, 2023
High 7.3

CVE-2019-10086 EPSS 29%

Insecure Deserialization in Apache Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default chara…

Apache Apache Commons Beanutils trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

Aug 20, 2019
High 7.1

CVE-2022-44729

Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource…

Apache Software Foundation Apache XML Graphics Batik batik batik Debian Ubuntu Maven

Aug 22, 2023
Medium 6.5

CVE-2021-29425 Public exploit EPSS 11%

Possible limited path traversal vulnerabily in Apache Commons IO

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…

Apache Software Foundation Apache Commons IO druid commons-io:commons-io Debian Ubuntu Wolfi Maven

Apr 13, 2021

Revision history

2024-01-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Hyperion vom 2024-01-16
https://www.oracle.com/security-alerts/cpujan2024.html#AppendixHYP