Oracle Siebel CRM: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• Critical 10.0
  CVE-2025-24813 Exploited Public exploit Scanner template EPSS 100%

  Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

  Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Mar 10, 2025

  KEV Apr 1, 2025
• High 8.8
  CVE-2024-9143 EPSS 12%

  Low-level invalid GF(2^m) parameters lead to OOB memory access

  Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a pos…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 16, 2024
• High 7.5
  CVE-2021-33813 EPSS 19%

  XML External Entity (XXE) Injection in JDOM

  An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

  libjdom2-java org.jdom:jdom jdom2 libjdom1-java Debian Ubuntu Azure Linux Maven
  Jun 16, 2021
• High 7.4
  CVE-2024-27309

  Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode

  While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated wit…

  Apache Software Foundation Apache Kafka kafka org.apache.kafka:kafka-metadata Ubuntu Maven
  Apr 12, 2024
• High 7.3
  CVE-2025-0725

  gzip integer overflow

  When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

  curl curl mysql curl Debian Azure Linux Alpine Wolfi
  Feb 5, 2025
• Medium 5.3
  CVE-2025-30758

  Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: User Interface). Supported versions t…

  Oracle Siebel CRM End User
  Jul 15, 2025

Revision history

1. 2025-07-15 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - July 2025 - Appendix Oracle Siebel CRM vom 2025-07-15
  https://www.oracle.com/security-alerts/cpujul2025.html#AppendixSECR