Skip to content
OpenAdvisories
Medium WID-SEC-2024-1769 6 CVEs

Hitachi Ops Center: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Aug 5, 2024 · Updated Aug 5, 2024 · de-DE

Vendor: Hitachi Product: Ops Center Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Hitachi Ops Center ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Hitachi Ops Center ist eine Softwarelösung für Rechenzentren zur Verwaltung, Optimierung, Orchestrierung und zum Schutz von Daten.

Vulnerabilities 6

  • High 8.1
    CVE-2023-4853

    Quarkus: http security policy bypass

    A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy al…

    Red Hat RHEL-8 based Middleware Containers Red Hat Process Automation 7 Red Hat build of Quarkus Maven
  • Medium 6.5
    CVE-2023-2974

    Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocol

    A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

    Red Hat Red Hat build of Quarkus 2.13.8.Final io.quarkus:quarkus-core Maven
  • Medium 6.5
    CVE-2023-32081

    Vert.x STOMP server process client frames that would not send initially a connect frame

    Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an in…

    vert-x3 vertx-stomp io.vertx:vertx-stomp Maven
  • Medium 5.5
    CVE-2023-0482 Public exploit

    Insecure Temporary File in RESTEasy

    In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

    resteasy resteasy3.0 resteasy3.0 org.jboss.resteasy:resteasy-core Debian Ubuntu Maven
  • Medium 5.5
    CVE-2023-33546

    janino vulnerable to denial of service due to stack overflow

    Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack…

    org.codehaus.janino:janino-parent janino Debian Maven
  • Medium 4.8
    CVE-2023-24815

    Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web

    Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wi…

    vert-x3 vertx-web io.vertx:vertx-web Maven

Revision history

  1. #1

    Initiale Fassung

References