Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle REST Data Services ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Product
Oracle REST Data Services (ORDS) ermöglicht die Erstellung grundlegender RESTful Web Services unter Verwendung von PL/SQL.
Vulnerabilities 35
-
High 8.8
Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.2.2…
-
High 8.3
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI…
-
High 8.1
Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with a…
-
High 7.7
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.2. E…
-
Medium 6.9
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Medium 6.5
Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.2.…
-
Medium 6.3
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2…
-
Medium 6.1
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are …
-
Medium 5.9
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are …
-
Medium 5.4
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…
-
Medium 5.4
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2…
-
Medium 5.4
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Ea…
-
Medium 5.4
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are …
-
Medium 5.4
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Ea…
-
Medium 5.4
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Ea…
-
Medium 5.4
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…
-
Medium 5.4
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.1. E…
-
Medium 5.3
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…
-
Medium 5.3
Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.…
-
Medium 5.3
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Ea…
-
Medium 5.3CVE-2026-54515 Public exploit
jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…
-
Medium 5.0
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…
-
Medium 4.9
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…
-
Medium 4.7
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2…
-
Medium 4.7
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2…
-
Medium 4.3
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Ea…
-
Medium 4.3
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Ea…
-
Medium 4.2
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Medium 4.2
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Medium 4.2
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Low 3.7
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Low 3.1
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Low 3.1
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D…
-
Low 2.7
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2…
-
Low 2.4
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E…
Revision history
-
#1
Initiale Fassung
References
-
Oracle Critical Patch Update Advisory - October 2026 - Appendix Oracle REST Data Services vom 2026-10-20
https://www.oracle.com/security-alerts/cpuoct2026.html#AppendixREST