Critical WID-SEC-2025-0814 8 CVEs

Oracle JD Edwards: Mehrere Schwachstellen

Published Apr 15, 2025 · Updated Apr 15, 2025 · de-DE

Vendor: Oracle Product: JD Edwards Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Komponenten der Oracle JDEdwards sind vollständig integrierte und komplette Lösungen geschäftlicher Anwendungen (ERP) für Unternehmen.

Vulnerabilities 8

Critical 9.1

CVE-2024-5535 Public exploit

SSL_select_next_proto buffer overread

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jun 27, 2024
High 8.1

CVE-2024-23807

Apache Xerces C++: Use-after-free on external DTD scan

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD pro…

Apache Software Foundation Apache Xerces C++ xerces-c xerces-c Ubuntu Azure Linux

Feb 28, 2024
High 8.1

CVE-2024-25710

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Azure Linux Wolfi Maven

Feb 19, 2024
Medium 6.5

CVE-2025-30740

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

Oracle JD Edwards EnterpriseOne Tools

Apr 15, 2025
Medium 6.1

CVE-2025-30709

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

Oracle JD Edwards EnterpriseOne Tools

Apr 15, 2025
Medium 5.4

CVE-2025-21586

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

Oracle JD Edwards EnterpriseOne Tools

Apr 15, 2025
Medium 5.1

CVE-2024-45613

CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, le…

ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm

Sep 25, 2024
Medium 4.3

CVE-2024-47554

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven

Oct 3, 2024

Revision history

2025-04-15 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2025 - Appendix Oracle JD Edwards vom 2025-04-15
https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixJDE