Skip to content
OpenAdvisories
High WID-SEC-2024-1659 8 CVEs

Oracle Insurance Applications: Mehrere Schwachstellen

Published Jul 16, 2024 · Updated Jul 16, 2024 · de-DE

Vendor: Oracle Product: Insurance Applications Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Insurance Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Insurance Applications ist eine Produktfamilie mit Lösungen für die Versicherungsbranche.

Vulnerabilities 8

  • High 8.2
    CVE-2024-22257

    Erroneous authentication pass in Spring Security

    In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the Au…

    org.springframework.security:spring-security-core Maven
  • High 8.1
    CVE-2024-22262 Public exploit

    CVE-2024-22262: Spring Framework URL Parsing with Host Validation

    Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  a…

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • High 7.5
    CVE-2022-34169 Public exploit EPSS 82%

    Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

    The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

    Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven
  • Medium 6.1
    CVE-2024-23635

    AntiSamy malicious input can provoke XSS when preserving comments

    AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subje…

    nahsra antisamy libowasp-antisamy-java org.owasp.antisamy:antisamy Debian Ubuntu Maven
  • Medium 5.5
    CVE-2023-21036 Public exploit

    In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidV…

    Android
  • Medium 5.5
    CVE-2023-29081

    InstallShield Symlink Vulnerability Affecting Suite Project Setups

    A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally authenticated users to cause a Denial of Service (DoS) condition when handling move operations on local, temporary folde…

    Revenera InstallShield
  • Medium 5.5
    CVE-2024-26308 Public exploit

    Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

    Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2020-13956

    Cross-site scripting in Apache HttpClient

    Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

    druid trino trino-plugin-opensearch trino-plugin-pinot Debian Ubuntu Wolfi Maven

Revision history

  1. #1

    Initiale Fassung

References