Oracle Siebel CRM: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• Critical 9.8
  CVE-2025-31651 Public exploit

  Apache Tomcat: Bypass of rules in Rewrite Valve

  Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectivel…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 28, 2025
• High 7.5
  CVE-2021-28165 Public exploit EPSS 54%

  Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

  In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

  The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  Apr 1, 2021
• High 7.5
  CVE-2024-4140

  An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service w…

  rjbs Email-MIME perl-email-mime libemail-mime-perl Debian Ubuntu Alpine
  May 2, 2024
• High 7.5
  CVE-2025-48988 Public exploit EPSS 31%

  Apache Tomcat: FileUpload large number of parts with headers DoS

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time th…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• Medium 5.3
  CVE-2020-13956

  Cross-site scripting in Apache HttpClient

  Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

  druid trino trino-plugin-opensearch trino-plugin-pinot Debian Ubuntu Wolfi Maven
  Dec 2, 2020
• Medium 4.3
  CVE-2024-47554

  Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

  Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …

  Apache Software Foundation Apache Commons IO druid kserve-storage-controller Debian Ubuntu Azure Linux Wolfi Maven
  Oct 3, 2024

Revision history

1. 2025-10-21 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - October 2025 - Appendix Oracle Siebel CRM vom 2025-10-21
  https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixSECR