DeutschShown in its original language — a full translation is planned for a future version.
Oracle Communications: Mehrere Schwachstellen
view advisory published 2024-04-16
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
01
describes (35)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-22257US | —OT elevated | — | ||
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8,
versions 6.2.x prior to 6.2.3, an applica… | ||||
| CVE-2024-22259US | — | — | ||
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the… | ||||
| CVE-2023-51775US | —OT elevated | — | ||
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. | ||||
| CVE-2024-22201US | high7.5 | — | ||
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many con… | ||||
| CVE-2024-26130US | high7.5 | — | ||
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize… | ||||
| CVE-2024-1635US | — | — | ||
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection w… | ||||
| CVE-2024-26308US | medium5.5 | Exploit | ||
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.
Users are recommen… | ||||
| CVE-2024-25062US | high7.5 | — | ||
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafte… | ||||
| CVE-2024-21626US | high8.6 | Exploit | ||
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker… | ||||
| CVE-2024-22233US | high7.5 | — | ||
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specificall… | ||||
| CVE-2023-51257US | high7.8 | — | ||
An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. | ||||
| CVE-2023-41056US | high8.1 | — | ||
Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and pote… | ||||
| CVE-2023-51074US | medium5.3 | — | ||
json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method. | ||||
| CVE-2023-4641US | medium5.5 | — | ||
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning… | ||||
| CVE-2023-48795US | medium5.9OT high | Exploit | ||
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet… | ||||
| CVE-2023-6507US | medium4.9 | — | ||
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.
When using the `extra… | ||||
| CVE-2023-47100US | — | — | ||
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-47038. Reason: This record is a duplicate of CVE-2023-47038. Notes: All CVE users should reference CVE-2023-47038… | ||||
| CVE-2023-49083US | high7.5 | — | ||
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could… | ||||
| CVE-2023-46589US | high7.5 | — | ||
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 throu… | ||||
| CVE-2023-34055US | medium6.5 | — | ||
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)… | ||||
showing 20 of 35
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2024:1878 vom 2024-04-18external
- Red Hat Security Advisory RHSA-2024:7987 vom 2024-10-10external
- Oracle Linux Security Advisory ELSA-2025-15608 vom 2025-09-11external
- Gentoo Linux Security Advisory GLSA-202405-01 vom 2024-05-04external
- XEROX Security Advisory XRX24-017 vom 2024-11-21external
- WID-SEC-W-2024-0869 - CSAF Versionself
- WID-SEC-2024-0869 - Portal Versionself
- Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Communications vom 2024-04-16external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan