Oracle Insurance Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• Critical 9.8
  CVE-2021-41616

  Apache ddlutils 1.0 readobject vulnerability

  Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was ins…

  Apache Software Foundation Apache DB ddlutils org.apache.ddlutils:ddlutils Maven
  Sep 30, 2021
• Critical 9.8
  CVE-2021-43113

  Command injection in itext7-core

  iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

  com.itextpdf:itext7-core libitext5-java libitext5-java com.itextpdf:itextpdf Debian Ubuntu Maven
  Dec 15, 2021
• Critical 9.8
  CVE-2022-46337

  Apache Derby: LDAP injection vulnerability in authenticator

  A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the …

  Apache Software Foundation Apache Derby druid spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven
  Nov 20, 2023
• High 8.2
  CVE-2023-37536

  HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

  An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

  HCL Software BigFix Platform xerces-c xerces-c Debian Ubuntu
  Oct 11, 2023
• High 8.0
  CVE-2022-41853 Public exploit

  Remote code execution in HyperSQL DataBase

  Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath re…

  HyperSQL DataBase hsqldb hsqldb hsqldb Debian Ubuntu Maven
  Oct 6, 2022
• Medium 6.1
  CVE-2024-24816 Public exploit

  Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

  CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in t…

  ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm
  Feb 7, 2024

Revision history

1. 2024-04-16 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Insurance Applications vom 2024-04-16
  https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixINSU