DeutschShown in its original language — a full translation is planned for a future version.
Oracle Utilities: Mehrere Schwachstellen
view advisory published 2019-04-16
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Utilities ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
01
describes (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-11040US | high7.5 | — | ||
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON wi… | ||||
| CVE-2018-11039US | medium5.9 | — | ||
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTT… | ||||
| CVE-2018-1258US | high8.8OT elevated | — | ||
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious… | ||||
| CVE-2018-1257US | medium6.5 | — | ||
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a… | ||||
| CVE-2018-8088US | critical9.8 | — | ||
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the… | ||||
| CVE-2015-9251US | medium6.1 | Exploit | ||
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses… | ||||
| CVE-2017-17484US | critical9.8 | — | ||
The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, wh… | ||||
| CVE-2017-14952US | critical9.8 | — | ||
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a… | ||||
| CVE-2014-9654US | critical9.8 | — | ||
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values w… | ||||
| CVE-2017-7868US | high7.5 | — | ||
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in c… | ||||
| CVE-2017-7867US | high7.5 | — | ||
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in c… | ||||
| CVE-2014-9911US | critical9.8 | — | ||
Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attac… | ||||
| CVE-2016-1000031US | critical9.8 | — | ||
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution | ||||
| CVE-2016-7415US | critical9.8 | — | ||
Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial o… | ||||
| CVE-2016-6293US | critical9.8 | — | ||
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at t… | ||||
| CVE-2015-5922US | high10.0 | — | ||
Unspecified vulnerability in International Components for Unicode (ICU) before 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2, has unknown impact and attack vector… | ||||
| CVE-2014-8147US | high7.5 | Exploit | ||
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses a… | ||||
| CVE-2014-8146US | high7.5 | Exploit | ||
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does n… | ||||
| CVE-2014-7940US | high7.5 | — | ||
The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN revision 293126, as used in Google Chrome before 40.0.2214.91, does not in… | ||||
| CVE-2014-7926US | high7.5 | — | ||
The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers t… | ||||
showing 20 of 21
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan