DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Oracle Construction and Engineering: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2020-10-20
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.
01
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-9490US | high7.5 | — | ||
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to… | ||||
| CVE-2020-11993US | high7.5 | — | ||
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong conn… | ||||
| CVE-2020-11984US | critical9.8 | Exploit | ||
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE | ||||
| CVE-2020-13935US | high7.5 | Exploit | ||
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payl… | ||||
| CVE-2020-13934US | high7.5 | — | ||
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a su… | ||||
| CVE-2020-9488US | low3.7 | Exploit | ||
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which coul… | ||||
| CVE-2020-9489US | medium5.5 | — | ||
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika… | ||||
| CVE-2019-17558US | high7.5OT kritisch | KEV | ||
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates… | ||||
| CVE-2019-17495US | critical9.8 | Exploit | ||
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input f… | ||||
| CVE-2018-17196US | high8.8 | — | ||
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated cli… | ||||
| CVE-2017-9096US | high8.8 | Exploit | ||
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a… | ||||
| CVE-2015-1832US | critical9.1 | — | ||
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WID-SEC-W-2023-1048 - CSAF Versionself
- WID-SEC-2023-1048 - Portal Versionself
- Dell Security Advisory DSA-2024-070 vom 2024-02-03external
- IBM Security Bulletin 6985225 vom 2023-04-21external
- Oracle Critical Patch Update Advisory - October 2020 - Appendix Oracle Construction and Engineering vom 2020-10-20external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan