Oracle Financial Services Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 14

• Critical 9.1
  CVE-2024-5535 Public exploit

  SSL_select_next_proto buffer overread

  Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 27, 2024
• High 8.5
  CVE-2024-32114 Public exploit Scanner template

  Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

  In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can …

  Apache Software Foundation Apache ActiveMQ org.apache.activemq:apache-activemq Maven
  May 2, 2024
• High 8.1
  CVE-2023-50447

  Arbitrary Code Execution in Pillow

  Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Jan 19, 2024
• High 8.1
  CVE-2024-22262 Public exploit

  CVE-2024-22262: Spring Framework URL Parsing with Host Validation

  Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  a…

  Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  Apr 16, 2024
• High 7.5
  CVE-2024-32007

  Apache CXF Denial of Service vulnerability in JOSE

  An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. 

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-jose Maven
  Jul 19, 2024
• High 7.1
  CVE-2024-21284

  Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: …

  Oracle Oracle Banking Liquidity Management
  Oct 15, 2024
• High 7.1
  CVE-2024-21285

  Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: …

  Oracle Oracle Banking Liquidity Management
  Oct 15, 2024
• Medium 6.1
  CVE-2022-31160 Public exploit

  jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

  jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

  jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems
  Jul 20, 2022
• Medium 6.1
  CVE-2024-43407

  Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

  CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter …

  ckeditor ckeditor4 ckeditor ckeditor4 Debian Ubuntu npm Packagist
  Aug 21, 2024
• Medium 5.9
  CVE-2024-2511 EPSS 59%

  Unbounded memory growth with session handling in TLSv1.3

  Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Apr 8, 2024
• Medium 5.3
  CVE-2023-34055

  Spring Boot server Web Observations DoS Vulnerability

  In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following…

  Spring Spring Boot org.springframework.boot:spring-boot-actuator Maven
  Nov 28, 2023
• Medium 5.3
  CVE-2024-21281

  Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: …

  Oracle Oracle Banking Liquidity Management
  Oct 15, 2024
• Medium 5.3
  CVE-2024-29025

  Netty HttpPostRequestDecoder can OOM

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the dis…

  netty netty druid netty Debian Ubuntu Wolfi Maven
  Mar 25, 2024
• Medium 4.7
  CVE-2024-0232

  Sqlite: use-after-free bug in jsonparseaddnodearray

  A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash an…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian
  Jan 16, 2024

Revision history

1. 2024-10-15 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - October 2024 - Appendix Oracle Financial Services Applications vom 2024-10-15
  https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixIFLX