NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Oracle Communications
view advisory published 2024-07-17
Er zijn kwetsbaarheden verholpen in Oracle Communications.
01
describes (40)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-6162US | — | — | ||
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer i… | ||||
| CVE-2024-34069US | — | Exploit | ||
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some ci… | ||||
| CVE-2024-34064US | — | Exploit | ||
Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain sp… | ||||
| CVE-2024-2961US | — | Exploit | ||
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT charac… | ||||
| CVE-2024-22262US | — | Exploit | ||
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be v… | ||||
| CVE-2024-27316US | high7.5 | Exploit | ||
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, th… | ||||
| CVE-2024-28182US | — | — | ||
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATIO… | ||||
| CVE-2024-29025US | — | — | ||
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder`… | ||||
| CVE-2023-5685US | — | — | ||
A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled… | ||||
| CVE-2024-0450US | — | — | ||
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” z… | ||||
| CVE-2024-22257US | —OT elevated | — | ||
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8,
versions 6.2.x prior to 6.2.3, an applica… | ||||
| CVE-2024-28752US | — | Exploit | ||
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take a… | ||||
| CVE-2024-28849US | — | — | ||
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clear… | ||||
| CVE-2024-24549US | — | Exploit | ||
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configu… | ||||
| CVE-2024-23672US | — | — | ||
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource cons… | ||||
| CVE-2024-23807US | critical9.8 | — | ||
The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs.
Users are recommended to upgrade to… | ||||
| CVE-2023-51775US | —OT elevated | — | ||
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. | ||||
| CVE-2024-22201US | high7.5 | — | ||
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many con… | ||||
| CVE-2024-26130US | high7.5 | — | ||
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize… | ||||
| CVE-2024-22234US | high7.4 | — | ||
In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationT… | ||||
showing 20 of 40
02
references
External citations — patches, advisories, analysis.
- Source - nvdexternal
- Source - nvdexternal
- Source - nvdexternal
- Source - nvdexternal
- Source - nvdexternal
- Source - nvdexternal
- Source - nvdexternal
- Source - nvdexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan