High WID-SEC-2024-3218 7 CVEs

Oracle Systems: Mehrere Schwachstellen

Published Oct 15, 2024 · Updated Oct 15, 2024 · de-DE

Vendor: Oracle Product: Systems Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Systems ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Systems umfasst eine Sammlung von Hardware, Betriebssystemen, Servern und Anwendungen.

Vulnerabilities 7

Critical 9.8

CVE-2022-46337

Apache Derby: LDAP injection vulnerability in authenticator

A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the …

Apache Software Foundation Apache Derby druid spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven

Nov 20, 2023
High 8.1

CVE-2024-22262 Public exploit

CVE-2024-22262: Spring Framework URL Parsing with Host Validation

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html a…

Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven

Apr 16, 2024
High 7.5

CVE-2023-5072

DoS Vulnerability in JSON-Java

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven

Oct 12, 2023
Medium 6.5

CVE-2023-44483

Apache Santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level i…

Apache Software Foundation Apache Santuario sonarqube-10 org.apache.santuario:xmlsec Debian Ubuntu Wolfi Maven

Oct 20, 2023
Medium 6.1

CVE-2024-23635

AntiSamy malicious input can provoke XSS when preserving comments

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subje…

nahsra antisamy libowasp-antisamy-java org.owasp.antisamy:antisamy Debian Ubuntu Maven

Feb 2, 2024
Medium 5.5

CVE-2023-2976

Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven

Jun 14, 2023
Medium 5.3

CVE-2023-33201

Bouncy Castle For Java LDAP injection vulnerability

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven

Jul 5, 2023

Revision history

2024-10-15 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - October 2024 - Appendix Oracle Systems vom 2024-10-15
https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixSUNS