High 1 exploited CVE WID-SEC-2025-2362 6 CVEs

Oracle Insurance Applications: Mehrere Schwachstellen

Published Oct 21, 2025 · Updated Oct 21, 2025 · de-DE

Vendor: Oracle Product: Insurance Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Insurance Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Insurance Applications ist eine Produktfamilie mit Lösungen für die Versicherungsbranche.

Vulnerabilities 6

High 8.1

CVE-2025-27363 Exploited Public exploit EPSS 28%

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…

FreeType FreeType freetype freetype Debian Ubuntu Azure Linux Alpine

Mar 11, 2025
KEV May 6, 2025
High 8.8

CVE-2025-48734 Public exploit

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

Apache Software Foundation Apache Commons BeanUtils 1.x Apache Commons BeanUtils 2.x druid Debian Ubuntu Azure Linux Wolfi Maven

May 28, 2025
High 7.5

CVE-2025-48976 Public exploit EPSS 34%

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven

Jun 16, 2025
Medium 5.5

CVE-2023-2976

Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven

Jun 14, 2023
Medium 5.3

CVE-2022-24329

Improper Locking in JetBrains Kotlin

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

thingsboard-tb-node thingsboard-tb-mqtt-transport thingsboard-tb-js-executor thingsboard-tb-web-ui Ubuntu Wolfi Maven

Feb 25, 2022
Medium 4.3

CVE-2024-47554

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven

Oct 3, 2024

Revision history

2025-10-21 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - October 2025 - Appendix Oracle Insurance Applications vom 2025-10-21
https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixINSU