High WID-SEC-2025-0820 4 CVEs

Oracle Enterprise Manager: Mehrere Schwachstellen

Published Apr 15, 2025 · Updated Apr 15, 2025 · de-DE

Vendor: Oracle Product: Enterprise Manager Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Enterprise Manager ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Enterprise Manager (OEM) ist ein Set von System Management Werkzeugen von Oracle für Oracle Umgebungen. Es beinhaltet Werkzeuge zum Monitoring von Oracle Umgebung und zur Automatisierung von Datenbank- und Applikations Administration.

Vulnerabilities 4

Critical 10.0

CVE-2024-52046 EPSS 25%

Apache MINA: MINA applications using unbounded deserialization may allow RCE

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by s…

Apache Software Foundation Apache MINA apache-nifi apache-nifi-toolkit Debian Ubuntu Wolfi Maven

Dec 25, 2024
Critical 9.8

CVE-2022-45047 Public exploit

Apache MINA SSHD: Java unsafe deserialization vulnerability

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSH…

Apache Software Foundation Apache MINA SSHD org.apache.sshd:sshd-core org.apache.sshd:sshd-common Maven

Nov 16, 2022
High 7.5

CVE-2023-1370

Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Mar 13, 2023
High 7.5

CVE-2024-57699

Netplex Json-smart Uncontrolled Recursion vulnerability

A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issu…

trino trino-plugin-opensearch trino-plugin-pinot trino-plugin-lakehouse Debian Ubuntu Wolfi Maven

Feb 5, 2025

Revision history

2025-04-15 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2025 - Appendix Oracle Enterprise Manager vom 2025-04-15
https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixEM