Oracle PeopleSoft: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 10

• High 8.8
  CVE-2023-38545 Public exploit EPSS 78%

  This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 18, 2023
• High 7.8
  CVE-2023-4807

  POLY1305 MAC implementation corrupts XMM registers on Windows

  Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impac…

  OpenSSL OpenSSL kata-containers openssl-fips-provider Azure Linux
  Sep 8, 2023
• Medium 6.5
  CVE-2021-37533

  Apache Commons Net's FTP client trusts the host from PASV response by default

  Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

  Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven
  Dec 3, 2022
• Medium 6.5
  CVE-2023-44483

  Apache Santuario: Private Key disclosure in debug-log output

  All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level i…

  Apache Software Foundation Apache Santuario sonarqube-10 org.apache.santuario:xmlsec Debian Ubuntu Wolfi Maven
  Oct 20, 2023
• Medium 6.1
  CVE-2024-21063

  Vulnerability in the PeopleSoft Enterprise HCM Benefits Administration product of Oracle PeopleSoft (component: Benefit…

  Oracle PeopleSoft Enterprise HCM Benefits Administration
  Apr 16, 2024
• Medium 6.1
  CVE-2024-21065

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Supported ve…

  Oracle PeopleSoft Enterprise PT PeopleTools
  Apr 16, 2024
• Medium 5.9
  CVE-2023-4043

  Parsson DoS when parsing numbers from untrusted sources

  In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a n…

  Eclipse Foundation Parsson org.eclipse.parsson:project Maven
  Nov 3, 2023
• Medium 5.5
  CVE-2022-24613

  Improper Handling of Exceptional Conditions inn metadata-extractor

  metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor …

  libmetadata-extractor-java com.drewnoakes:metadata-extractor libmetadata-extractor-java Debian Ubuntu Maven
  Feb 24, 2022
• Medium 5.4
  CVE-2024-21070

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Supp…

  Oracle PeopleSoft Enterprise PT PeopleTools
  Apr 16, 2024
• Medium 4.9
  CVE-2024-21097

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported ve…

  Oracle PeopleSoft Enterprise PT PeopleTools
  Apr 16, 2024

Revision history

1. 2024-04-16 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle PeopleSoft vom 2024-04-16
  https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixPS