Oracle Retail Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Critical 9.8
  CVE-2022-42920

  Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

  Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pa…

  Apache Software Foundation Apache Commons BCEL bcel bcel Debian Ubuntu Azure Linux Maven
  Nov 7, 2022
• Critical 9.8
  CVE-2022-46337

  Apache Derby: LDAP injection vulnerability in authenticator

  A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the …

  Apache Software Foundation Apache Derby druid spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven
  Nov 20, 2023
• Critical 9.1
  CVE-2022-34381

  Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain a…

  Dell Dell BSAFE SSL-J Dell BSAFE Crypto-J
  Feb 2, 2024
• High 7.5
  CVE-2023-34981

  Apache Tomcat: AJP response header mix-up

  A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (…

  Apache Software Foundation Apache Tomcat tomcat10 org.apache.tomcat.embed:tomcat-embed-core Debian Maven
  Jun 21, 2023
• Medium 6.1
  CVE-2022-31160 Public exploit

  jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

  jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

  jquery jquery-ui jquery-ui jquery-ui-rails Debian Ubuntu npm Maven NuGet RubyGems
  Jul 20, 2022
• Medium 5.9
  CVE-2023-1436

  Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

  An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Mar 16, 2023
• Medium 5.9
  CVE-2023-48795 Public exploit Scanner template EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  Dec 18, 2023
• Medium 5.5
  CVE-2023-2976

  Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

  Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  Jun 14, 2023

Revision history

1. 2024-04-16 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Retail Applications vom 2024-04-16
  https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixRAPP