High WID-SEC-2024-0868 6 CVEs

Oracle Construction and Engineering: Mehrere Schwachstellen

Published Apr 16, 2024 · Updated Apr 16, 2024 · de-DE

Vendor: Oracle Product: Construction and Engineering Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Construction and Engineering ist eine Sammlung von Werkzeugen zur Unterstützung von Bau- und Ingenieurbüros. Sie umfasst u. a. Projektmanagement-Lösungen zur Verwaltung von Projekte, zur Schaffung von Transparenz, zur Zusammenarbeit und zur Verwaltung von Änderungen.

Vulnerabilities 6

High 8.8

CVE-2023-50386 Public exploit EPSS 84%

Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.…

Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Maven

Feb 9, 2024
High 8.2

CVE-2024-21095

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineerin…

Oracle Primavera P6 Enterprise Project Portfolio Management

Apr 16, 2024
High 8.1

CVE-2024-22243 Public exploit

CVE-2024-22243: Spring Framework URL Parsing with Host Validation

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html a…

Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven

Feb 23, 2024
High 7.5

CVE-2023-5072

DoS Vulnerability in JSON-Java

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven

Oct 12, 2023
High 7.5

CVE-2023-52428

Denial of Service in Connect2id Nimbus JOSE+JWT

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

druid thingsboard-tb-node thingsboard-tb-mqtt-transport tez Wolfi Maven

Feb 11, 2024
Medium 5.5

CVE-2024-26308 Public exploit

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven

Feb 19, 2024

Revision history

2024-04-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Construction and Engineering vom 2024-04-16
https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixPVA