Oracle JD Edwards: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Critical 10.0
  CVE-2024-52046 EPSS 25%

  Apache MINA: MINA applications using unbounded deserialization may allow RCE

  The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by s…

  Apache Software Foundation Apache MINA apache-nifi apache-nifi-toolkit Debian Ubuntu Wolfi Maven
  Dec 25, 2024
• High 8.8
  CVE-2024-9143 EPSS 12%

  Low-level invalid GF(2^m) parameters lead to OOB memory access

  Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a pos…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 16, 2024
• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025
• High 7.2
  CVE-2024-13009

  Eclipse Jetty GZIP buffer release

  In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

  Eclipse Foundation Jetty tez cassandra-reaper Debian Ubuntu Wolfi Maven
  May 8, 2025
• Medium 6.1
  CVE-2025-53056

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Environment Tec…

  Oracle JD Edwards EnterpriseOne Tools
  Oct 21, 2025
• Medium 6.1
  CVE-2025-53060

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

  Oracle JD Edwards EnterpriseOne Tools
  Oct 21, 2025
• Medium 5.3
  CVE-2021-22897

  curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURL…

  curl Azure Linux
  Jun 11, 2021
• Medium 5.3
  CVE-2025-31672

  Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

  Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (inc…

  Apache Software Foundation Apache POI opensearch-2 libapache-poi-java Debian Ubuntu Wolfi Maven
  Apr 9, 2025

Revision history

1. 2025-10-22 #2

   Referenz(en) aufgenommen: EUVD-2025-35278, EUVD-2025-35274

2. 2025-10-21 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - October 2025 - Appendix Oracle JD Edwards vom 2025-10-21
  https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixJDE