High WID-SEC-2025-2370 16 CVEs

Oracle Systems: Mehrere Schwachstellen

Published Oct 21, 2025 · Updated Nov 17, 2025 · Revision 3 · de-DE

Vendor: Oracle Vendor: Xerox Product: FreeFlow Print Server Product: Systems Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Systems ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Systems umfasst eine Sammlung von Hardware, Betriebssystemen, Servern und Anwendungen.

Vulnerabilities 16

High 8.8

CVE-2025-48734 Public exploit

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven

May 28, 2025
High 7.5

CVE-2024-38819 Public exploit Scanner template EPSS 56%

Spring Framework Path Traversal vulnerability

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the p…

libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven

Dec 19, 2024
High 7.5

CVE-2024-57699

Netplex Json-smart Uncontrolled Recursion vulnerability

A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issu…

trino trino-plugin-opensearch trino-plugin-pinot trino-plugin-lakehouse Debian Ubuntu Wolfi Maven

Feb 5, 2025
High 7.2

CVE-2025-62290

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The support…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025
Medium 6.5

CVE-2025-53068

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…

Oracle Oracle Solaris

Oct 21, 2025
Medium 5.5

CVE-2020-17521

Information Disclosure in Apache Groovy

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems…

Apache Software Foundation Apache Groovy org.codehaus.groovy:groovy-all groovy Debian Ubuntu Maven

Dec 7, 2020
Medium 5.5

CVE-2025-53070

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is af…

Oracle Oracle Solaris

Oct 21, 2025
Medium 4.9

CVE-2025-53046

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics). The supported v…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025
Medium 4.9

CVE-2025-62289

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025
Medium 4.9

CVE-2025-62475

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported versio…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025
Medium 4.9

CVE-2025-62476

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The su…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025
Medium 4.9

CVE-2025-62477

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The su…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025
Medium 4.9

CVE-2025-62478

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supporte…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025
Medium 4.3

CVE-2024-47554

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven

Oct 3, 2024
Low 2.7

CVE-2025-62479

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The support…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025
Low 2.7

CVE-2025-62480

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supp…

Oracle Oracle ZFS Storage Appliance Kit

Oct 21, 2025

Revision history

2025-11-17 #3
Neue Updates von XEROX aufgenommen
2025-10-22 #2
Referenz(en) aufgenommen: EUVD-2025-35243, EUVD-2025-35266, EUVD-2025-35288, EUVD-2025-35264, EUVD-2025-35239, EUVD-2025-35240, EUVD-2025-35241, EUVD-2025-35242
2025-10-21 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - October 2025 - Appendix Oracle Systems vom 2025-10-21
https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixSUNS
XEROX Security Advisory XRX25-018 vom 2025-11-18
https://security.business.xerox.com/wp-content/uploads/2025/11/Xerox-Security-Bulletin-XRX25-018-Xerox-FreeFlow-Print-Server-v7.pdf