High WID-SEC-2024-0890 6 CVEs

Oracle Supply Chain: Mehrere Schwachstellen

Published Apr 16, 2024 · Updated Apr 16, 2024 · de-DE

Vendor: Oracle Product: Supply Chain Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Supply Chain ist eine Sammlung von Applikationen für verschiedene Zwecke.

Vulnerabilities 6

High 8.1

CVE-2024-21092

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…

Oracle Agile Product Lifecycle Management for Process

Apr 16, 2024
High 7.5

CVE-2022-34169 Public exploit EPSS 82%

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven

Jul 19, 2022
High 7.5

CVE-2023-24998 Public exploit EPSS 49%

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…

Apache Software Foundation Apache Tomcat Apache Commons FileUpload tomcat9 Debian Ubuntu Maven

Feb 20, 2023
High 7.5

CVE-2023-46589

Apache Tomcat: HTTP request smuggling via malformed trailer headers

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

Nov 28, 2023
Medium 6.5

CVE-2024-21091

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: D…

Oracle Agile Product Lifecycle Management for Process

Apr 16, 2024
Medium 5.5

CVE-2023-42503

Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue…

Apache Software Foundation Apache Commons Compress trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

Sep 14, 2023

Revision history

2024-04-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Supply Chain vom 2024-04-16
https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixSCP