High 1 exploited CVE WID-SEC-2025-2353 5 CVEs

Oracle Construction and Engineering: Mehrere Schwachstellen

Published Oct 21, 2025 · Updated Oct 21, 2025 · de-DE

Vendor: Oracle Product: Construction and Engineering Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Construction and Engineering ist eine Sammlung von Werkzeugen zur Unterstützung von Bau- und Ingenieurbüros. Sie umfasst u. a. Projektmanagement-Lösungen zur Verwaltung von Projekte, zur Schaffung von Transparenz, zur Zusammenarbeit und zur Verwaltung von Änderungen.

Vulnerabilities 5

High 8.1

CVE-2025-27363 Exploited Public exploit EPSS 28%

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…

FreeType FreeType freetype freetype Debian Ubuntu Azure Linux Alpine

Mar 11, 2025
KEV May 6, 2025
High 7.5

CVE-2025-27553

Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved fil…

Apache Software Foundation Apache Commons VFS org.apache.commons:commons-vfs2 commons-vfs Debian Ubuntu Maven

Mar 23, 2025
High 7.5

CVE-2025-48976 Public exploit EPSS 34%

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven

Jun 16, 2025
High 7.3

CVE-2025-5878 Public exploit

ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initia…

ESAPI esapi-java-legacy libowasp-esapi-java libowasp-esapi-java Debian Ubuntu

Jun 29, 2025
Medium 5.3

CVE-2025-48924 Public exploit

Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven

Jul 11, 2025

Revision history

2025-10-21 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - October 2025 - Appendix Oracle Construction and Engineering vom 2025-10-21
https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixPVA