Skip to content
OpenAdvisories
Medium WID-SEC-2026-1193 4 CVEs

Oracle Construction and Engineering: Mehrere Schwachstellen

Published Apr 21, 2026 · Updated Apr 21, 2026 · de-DE

Vendor: Oracle Product: Construction and Engineering Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Construction and Engineering ist eine Sammlung von Werkzeugen zur Unterstützung von Bau- und Ingenieurbüros. Sie umfasst u. a. Projektmanagement-Lösungen zur Verwaltung von Projekte, zur Schaffung von Transparenz, zur Zusammenarbeit und zur Verwaltung von Änderungen.

Vulnerabilities 4

  • High 8.7
    CVE-2025-52999 Public exploit

    jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data

    jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a Stackov…

    FasterXML jackson-core druid tez Debian Ubuntu Wolfi Maven
  • Medium 6.3
    CVE-2025-68161

    Apache Log4j Core: Missing TLS hostname verification in Socket appender

    The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

    Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven
  • Medium 5.6
    CVE-2025-48795

    Apache CXF: Denial of Service and sensitive data exposure in logs

    Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of servi…

    Apache Software Foundation Apache CXF wildfly-openjdk-21 wildfly-openjdk-17 Wolfi Maven
  • Medium 4.5
    CVE-2025-26791

    DOMPurify allows Cross-site Scripting (XSS)

    DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

    cure53 DOMPurify grafana-image-renderer dompurify Debian Ubuntu Wolfi npm

Revision history

  1. #1

    Initiale Fassung

References