Oracle Construction and Engineering: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• Critical 9.8
  CVE-2021-43113

  Command injection in itext7-core

  iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

  com.itextpdf:itext7-core libitext5-java libitext5-java com.itextpdf:itextpdf Debian Ubuntu Maven
  Dec 15, 2021
• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025
• High 8.4
  CVE-2025-66516 Public exploit Scanner template EPSS 89%

  Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

  Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the…

  Apache Software Foundation Apache Tika PDF parser module Apache Tika core Apache Tika parsers Debian Ubuntu Wolfi Maven
  Dec 4, 2025
• High 7.5
  CVE-2025-41249 Public exploit

  CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

  The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions…

  VMware Spring Framework thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Sep 16, 2025
• Medium 6.3
  CVE-2025-68161

  Apache Log4j Core: Missing TLS hostname verification in Socket appender

  The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

  Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven
  Dec 18, 2025
• Medium 5.6
  CVE-2025-48795

  Apache CXF: Denial of Service and sensitive data exposure in logs

  Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of servi…

  Apache Software Foundation Apache CXF wildfly-openjdk-21 wildfly-openjdk-17 Wolfi Maven
  Jul 15, 2025
• Medium 4.5
  CVE-2025-26791

  DOMPurify allows Cross-site Scripting (XSS)

  DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

  cure53 DOMPurify grafana-image-renderer dompurify Debian Ubuntu Wolfi npm
  Feb 14, 2025

Revision history

1. 2026-01-20 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2026 - Appendix Oracle Construction and Engineering vom 2026-01-20
  https://www.oracle.com/security-alerts/cpujan2026.html#AppendixPVA