Medium WID-SEC-2025-0809 4 CVEs

Oracle Siebel CRM: Mehrere Schwachstellen

Published Apr 15, 2025 · Updated Apr 15, 2025 · de-DE

Vendor: Oracle Product: Siebel CRM Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Siebel CRM ist eine CRM-Lösung von Oracle.

Vulnerabilities 4

High 7.5

CVE-2024-47197

Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials

Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.…

Apache Software Foundation Maven Archetype Plugin org.apache.maven.plugins:maven-archetype-plugin Maven

Sep 26, 2024
Medium 6.3

CVE-2024-9902 Public exploit

Ansible-core: ansible-core user may read/write unauthorized content

A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivi…

Red Hat Red Hat Enterprise Linux 10 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Linux Debian Ubuntu Azure Linux PyPI

Nov 6, 2024
Medium 6.1

CVE-2024-38357

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded int…

tinymce tinymce roundcube tinymce Ubuntu npm Packagist PyPI NuGet

Jun 19, 2024
Medium 4.8

CVE-2024-42367

In aiohttp, compressed files as symlinks are not protected from path traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outs…

aio-libs aiohttp kserve-storage-controller py3-cassandra-medusa Debian Azure Linux Wolfi PyPI

Aug 9, 2024

Revision history

2025-04-15 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2025 - Appendix Oracle Siebel CRM vom 2025-04-15
https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixSECR