DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Oracle Fusion Middleware: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-10-15
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
01
beschreibt (29)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-21274US | — | — | ||
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily e… | ||||
| CVE-2024-21260US | —OT erhöht | — | ||
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily expl… | ||||
| CVE-2024-21246US | high7.5OT erhöht | — | ||
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12.2.1.4.0. Easily expl… | ||||
| CVE-2024-21234US | —OT erhöht | — | ||
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily expl… | ||||
| CVE-2024-21216US | critical9.8OT erhöht | — | ||
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily expl… | ||||
| CVE-2024-21215US | —OT erhöht | — | ||
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily expl… | ||||
| CVE-2024-21205US | —OT erhöht | — | ||
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12.2.1.4.0. Easily expl… | ||||
| CVE-2024-21192US | — | — | ||
Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Fusion Middleware (component: WebLogic Mgmt). The supported version that is affected is 12.… | ||||
| CVE-2024-21191US | high7.6 | — | ||
Vulnerability in the Oracle Enterprise Manager Fusion Middleware Control product of Oracle Fusion Middleware (component: FMW Control Plugin). The supported version that is affect… | ||||
| CVE-2024-21190US | high7.5 | — | ||
Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4… | ||||
| CVE-2024-45492US | critical9.8 | — | ||
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). | ||||
| CVE-2024-6345US | — | — | ||
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to… | ||||
| CVE-2024-38999US | — | — | ||
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or c… | ||||
| CVE-2024-36052US | — | — | ||
RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899. | ||||
| CVE-2024-22262US | — | Exploit | ||
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be v… | ||||
| CVE-2024-2511US | — | — | ||
Issue summary: Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions
Impact summary: An attacker may exploit certain server… | ||||
| CVE-2024-28182US | — | — | ||
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATIO… | ||||
| CVE-2024-29131US | — | — | ||
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to vers… | ||||
| CVE-2024-28752US | — | Exploit | ||
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take a… | ||||
| CVE-2024-24549US | — | Exploit | ||
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configu… | ||||
20 von 29 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- cPanel 132 Change Log vom 2025-10-01external
- Ubuntu Security Notice USN-7952-1 vom 2026-01-12external
- WID-SEC-W-2024-3191 - CSAF Versionself
- WID-SEC-2024-3191 - Portal Versionself
- IBM Security Bulletin 7175917 vom 2025-02-28external
- Oracle Critical Patch Update Advisory - October 2024 - Appendix Oracle Fusion Middleware vom 2024-10-15external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan