Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
Product
Oracle Fusion Middleware bündelt mehrere Produkte zur Erstellung, Betrieb und Management von intelligenten Business Anwendungen.
Vulnerabilities 50
-
Critical 9.8
Deserialization of Untrusted Data in Apache commons collections
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal …
-
Critical 9.8
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …
KEV Nov 3, 2021 -
High 7.4
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Support…
KEV Jun 3, 2024 -
High 8.8
Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mech…
-
High 8.8
Improper Access Control in Apache Tomcat
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and…
-
High 8.2CVE-2016-1182 EPSS 26%
Improper Input Validation in Apache Struts
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE…
-
High 8.1CVE-2016-1181 EPSS 13%
Improper Input Validation in Apache Struts
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a rela…
-
High 7.5
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a b…
-
Medium 6.3CVE-2016-0763 EPSS 11%
Improper Verification of Source of a Communication Channel in Apache Tomcat
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allow…
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticate…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary …
-
High —
Arbitrary code execution in Apache Commons BeanUtils
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate…
-
Unscored —CVE-2016-2177 EPSS 45%
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote at…
-
Unscored —
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of cons…
-
Unscored —CVE-2016-2179 EPSS 27%
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated wit…
-
Unscored —CVE-2016-2180 EPSS 30%
The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) im…
-
Unscored —CVE-2016-2181 EPSS 23%
The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number i…
-
Unscored —CVE-2016-2182 EPSS 44%
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, whi…
-
Unscored —CVE-2016-6302 EPSS 28%
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validati…
-
Unscored —CVE-2016-6303 EPSS 32%
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers …
-
Unscored —CVE-2016-6304 EPSS 63%
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote a…
-
Unscored —CVE-2016-6305 EPSS 16%
The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a…
-
Unscored —CVE-2016-6306 EPSS 42%
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial …
-
Unscored —CVE-2016-6307 EPSS 14%
The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive lengt…
-
Unscored —CVE-2016-6308 EPSS 12%
statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an …
-
Unscored —CVE-2016-6309 EPSS 70%
statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote att…
-
Unscored —CVE-2016-7052 EPSS 29%
crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference…
-
Unscored —
Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builde…
-
Unscored —
Vulnerability in the Oracle Social Network component of Oracle Fusion Middleware (subcomponent: Android Client). The su…
-
Unscored —
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Console Design). Suppo…
-
Unscored —
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Servlet Runtime). Supp…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported ver…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported ver…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported ver…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported ver…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Blob Server). Supporte…
-
Unscored —
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Rules Engine). The su…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Catalog Mover). Suppor…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Catalog Mover). Suppor…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —
Vulnerability in the Oracle API Gateway component of Oracle Fusion Middleware (subcomponent: Oracle API Gateway). The s…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supporte…
-
Unscored —
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Sup…
-
Unscored —
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). T…
Revision history
-
#5
Korrektur
-
#4
Aktive Ausnutzung gemeldet
-
#1
Initial Release
-
#2
n
-
#3
Version nicht vorhanden
References
-
Oracle Critical Patch Update Advisory - April 2017 - Oracle Fusion Middleware vom 2017-04-18
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixFMW
-
CISA Known Exploited Vulnerabilities Catalog vom 2024-06-03
https://www.cisa.gov/known-exploited-vulnerabilities-catalog