Skip to content
OpenAdvisories
High WID-SEC-2026-4089 12 CVEs

Oracle Construction and Engineering: Mehrere Schwachstellen

Published Oct 20, 2026 · Updated Oct 20, 2026 · de-DE

Vendor: Oracle Product: Construction and Engineering Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Construction and Engineering ist eine Sammlung von Werkzeugen zur Unterstützung von Bau- und Ingenieurbüros. Sie umfasst u. a. Projektmanagement-Lösungen zur Verwaltung von Projekte, zur Schaffung von Transparenz, zur Zusammenarbeit und zur Verwaltung von Änderungen.

Vulnerabilities 12

  • High 8.1
    CVE-2026-41855

    Spring Framework Unsafe Deserialization via Jackson JMS Converters

    In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions vi…

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • High 7.5
    CVE-2026-66144

    Apache Neethi: Remote PolicyReference fetch lacks resource bounds

    Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes t…

    Apache Software Foundation Apache Neethi
  • High 7.5
    CVE-2026-68497

    jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

    jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._dese…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-75140

    jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

    jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. T…

    jhy soup gradle-stage0 apache-tika-3.2 Debian Ubuntu Azure Linux Wolfi Maven
  • High 7.4
    CVE-2026-101736

    Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). Supported vers…

    Oracle Primavera Unifier
  • High 7.4
    CVE-2026-78254

    Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write

    The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker…

    Apache Software Foundation Apache Ant ant ant Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-101735

    Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Sup…

    Oracle Primavera Unifier
  • Medium 6.5
    CVE-2026-101475

    Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported v…

    Oracle Primavera Unifier
  • Medium 6.5
    CVE-2026-91376

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineerin…

    Oracle Primavera P6 Enterprise Project Portfolio Management
  • Medium 6.3
    CVE-2026-49844 Public exploit

    Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

    Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-…

    Apache Software Foundation Apache Log4j API druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-84501

    Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

    An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProv…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu
  • Medium 4.3
    CVE-2026-91399

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineerin…

    Oracle Primavera P6 Enterprise Project Portfolio Management

Revision history

  1. #1

    Initiale Fassung

References