High 1 exploited CVE WID-SEC-2025-0825 6 CVEs

Oracle Commerce: Mehrere Schwachstellen

Published Apr 15, 2025 · Updated Apr 15, 2025 · de-DE

Vendor: Oracle Product: Commerce Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Commerce ist eine elektronische Handelsplattform.

Vulnerabilities 6

Critical 10.0

CVE-2025-24813 Exploited Public exploit Scanner template EPSS 100%

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t…

Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Mar 10, 2025
KEV Apr 1, 2025
High 7.5

CVE-2021-23450 EPSS 30%

Prototype Pollution

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

dojo dojo dojo Debian Ubuntu npm

Dec 17, 2021
High 7.5

CVE-2024-38819 Public exploit Scanner template EPSS 56%

Spring Framework Path Traversal vulnerability

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the p…

libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven

Dec 19, 2024
Medium 5.4

CVE-2025-21576

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Personalization Server). Su…

Oracle Oracle Commerce Platform

Apr 15, 2025
Medium 5.3

CVE-2023-51074

json-path Out-of-bounds Write vulnerability

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

trino trino-plugin-opensearch trino-plugin-lakehouse trino-plugin-pinot Ubuntu Wolfi Maven

Dec 27, 2023
Medium 5.1

CVE-2024-45613

CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, le…

ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm

Sep 25, 2024

Revision history

2025-04-15 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2025 - Appendix Oracle Commerce vom 2025-04-15
https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixOCOM