Oracle Utilities Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.4
  CVE-2020-25638

  SQL injection in hibernate-core

  A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an…

  org.hibernate:hibernate-core libhibernate3-java libhibernate3-java Debian Ubuntu Maven
  Dec 2, 2020

Revision history

1. 2024-04-16 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Utilities Applications vom 2024-04-16
  https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixUTIL