Skip to content
OpenAdvisories
High 1 exploited CVE WID-SEC-2024-0870 13 CVEs

Oracle Communications Applications: Mehrere Schwachstellen

Published Apr 16, 2024 · Updated Apr 22, 2024 · Revision 2 · de-DE

Vendor: Oracle Vendor: Red Hat Product: Communications Applications Product: Enterprise Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Communications Applications umfasst eine Sammlung von Werkzeugen zur Verwaltung von Messaging-, Kommunikationsdiensten und -ressourcen.

Vulnerabilities 13

  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023
  • Critical 9.1
    CVE-2022-34381

    Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain a…

    Dell Dell BSAFE SSL-J Dell BSAFE Crypto-J
  • High 7.5
    CVE-2022-34169 Public exploit EPSS 82%

    Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

    The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

    Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven
  • High 7.5
    CVE-2024-21634

    Ion Java StackOverflow vulnerability

    Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encode…

    Amazon Ion ion-java wavefront-proxy gradle-stage0 Wolfi Maven
  • High 7.1
    CVE-2023-6378

    Logback "receiver" DOS vulnerability

    A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

    QOS.CH Sarl logback trino tez Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2021-37533

    Apache Commons Net's FTP client trusts the host from PASV response by default

    Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

    Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2023-4043

    Parsson DoS when parsing numbers from untrusted sources

    In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a n…

    Eclipse Foundation Parsson org.eclipse.parsson:project Maven
  • Medium 5.5
    CVE-2023-2976

    Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

    Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

    Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  • Medium 5.5
    CVE-2024-26308 Public exploit

    Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

    Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2023-34053

    Spring Framework server Web Observations DoS Vulnerability

    In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the applicat…

    Spring Spring Framework libspring-java org.springframework:spring-webmvc Ubuntu Maven
  • Medium 5.3
    CVE-2023-34055

    Spring Boot server Web Observations DoS Vulnerability

    In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following…

    Spring Spring Boot org.springframework.boot:spring-boot-actuator Maven
  • Medium 4.7
    CVE-2023-0833

    Red hat a-mq streams: component version with information disclosure flaw

    A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access informa…

    Red Hat Red Hat AMQ Streams 2.4.0 Red Hat AMQ Streams 2.2.1
  • Unscored —
    CVE-2023-47100 Rejected

    DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-47038. Reason: This record is a duplicate of CVE-2023-47038. Notes: Al…

    perl Wolfi

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References