Medium WID-SEC-2024-1657 8 CVEs

Oracle JD Edwards: Mehrere Schwachstellen

Published Jul 16, 2024 · Updated Jul 16, 2024 · de-DE

Vendor: Oracle Product: JD Edwards Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Komponenten der Oracle JDEdwards sind vollständig integrierte und komplette Lösungen geschäftlicher Anwendungen (ERP) für Unternehmen.

Vulnerabilities 8

Medium 6.5

CVE-2023-6129

POLY1305 MAC implementation corrupts vector registers on PowerPC

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker ca…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jan 9, 2024
Medium 6.5

CVE-2024-21168

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator…

Oracle JD Edwards EnterpriseOne Orchestrator

Jul 16, 2024
Medium 6.1

CVE-2022-31160 Public exploit

jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems

Jul 20, 2022
Medium 6.1

CVE-2024-21150

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

Oracle JD Edwards EnterpriseOne Tools

Jul 16, 2024
Medium 5.3

CVE-2023-33201

Bouncy Castle For Java LDAP injection vulnerability

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven

Jul 5, 2023
Medium 5.3

CVE-2023-3817

Excessive time spent checking DH q parameter value

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 31, 2023
Medium 5.0

CVE-2023-35887 Public exploit

Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" in…

Apache Software Foundation Apache MINA SSHD sonarqube org.apache.sshd:sshd-core Wolfi Maven

Jul 10, 2023
Unscored —

CVE-2023-38552

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can inte…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 18, 2023

Revision history

2024-07-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - July 2024 - Appendix Oracle JD Edwards vom 2024-07-16
https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJDE