Latest oracle communications design studio Vulnerabilities

● CVE-2022-22969

<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Reque...

Pivotal Spring Security Oauth>=2.5.0<2.5.2

Oracle Communications Design Studio=7.4.2

maven/org.springframework.security.oauth:spring-security-oauth2>=2.5.0<2.5.2.RELEASE

maven/org.springframework.security.oauth:spring-security-oauth2>=2.4.0.RELEASE<2.4.2.RELEASE

maven/org.springframework.security.oauth:spring-security-oauth2>=2.5.0.RELEASE<2.5.2.RELEASE

● CVE-2021-43797

### Impact Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to...

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el8ea

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el7ea

redhat/candlepin<0:4.1.13-1.el7

redhat/candlepin<0:4.1.13-1.el8

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8

and 60 more

● CVE-2021-2351

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Oracle Advanced Networking Option=12.1.0.2

Oracle Advanced Networking Option=12.2.0.1

Oracle Advanced Networking Option=19c

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management for Process=6.2.2.0

and 242 more

● CVE-2021-29425

Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-cra...

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 185 more

● CVE-2021-21409

### Impact The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request...

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec-http2>=4.0.0<4.1.61.Final

redhat/qpid-proton<0:0.33.0-6.el7_9

redhat/qpid-proton<0:0.33.0-8.el8

redhat/eap7-elytron-web<0:1.6.3-1.Final_redhat_00001.1.el6ea

and 75 more

● CVE-2021-23337

`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

redhat/cockpit-ovirt<0:0.15.1-2.el8e

redhat/ovirt-engine-ui-extensions<0:1.2.6-1.el8e

redhat/ovirt-web-ui<0:1.6.9-1.el8e

redhat/nodejs-lodash<4.17.21

npm/lodash-template<=1.0.0

npm/lodash.template<=4.5.0

and 50 more

● CVE-2020-28500

A flaw was found in nodejs-lodash. A Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions is possible.

redhat/cockpit-ovirt<0:0.15.1-2.el8e

redhat/ovirt-engine-ui-extensions<0:1.2.6-1.el8e

redhat/ovirt-web-ui<0:1.6.9-1.el8e

npm/lodash.trim<=4.5.1

npm/lodash.trimend<=4.5.1

npm/lodash-es<4.17.21

and 44 more

● CVE-2021-21290

### Impact When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. The CVSSv3.1 ...

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec-http>=4.0.0<4.1.59.Final

redhat/qpid-proton<0:0.33.0-6.el7_9

redhat/qpid-proton<0:0.33.0-8.el8

redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el6ea

and 91 more

● CVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depen...

maven/org.springframework:spring-framework-bom<4.3.29

maven/org.springframework:spring-framework-bom>=5.0.0<=5.0.18

maven/org.springframework:spring-framework-bom>=5.1.0<=5.1.17

maven/org.springframework:spring-framework-bom>=5.2.0<=5.2.8

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

redhat/springframework<5.2.9

and 80 more

● CVE-2020-11612

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server...

redhat/qpid-cpp<0:1.36.0-30.el6_10a

redhat/qpid-proton<0:0.31.0-3.el6_10

redhat/qpid-cpp<0:1.36.0-30.el7a

redhat/qpid-proton<0:0.31.0-3.el7

redhat/nodejs-rhea<0:1.0.21-1.el8

redhat/qpid-cpp<0:1.39.0-5.el8a

and 72 more

● CVE-2019-16168

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the q...

IBM Data Risk Manager<=2.0.6

ubuntu/sqlite3<3.22.0-1ubuntu0.2

ubuntu/sqlite3<3.27.2-2ubuntu0.2

ubuntu/sqlite3<3.29.0-2

ubuntu/sqlite3<3.11.0-1ubuntu1.3

SQLite SQLite>=3.8.5<=3.29.0

and 28 more

● CVE-2019-10086

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Jav...

redhat/apache-commons-beanutils<0:1.8.3-15.el7_7

redhat/eap7-activemq-artemis<0:2.9.0-2.redhat_00009.1.el6ea

redhat/eap7-apache-commons-beanutils<0:1.9.4-1.redhat_00002.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-4.b08_redhat_00003.1.el6ea

redhat/eap7-glassfish-jaxb<0:2.3.3-4.b02_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-7.SP3_redhat_00005.1.el6ea

and 486 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 795 more

● CVE-2019-0227

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversi...

Apache Axis=1.4

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile Product Lifecycle Management Framework=9.3.3

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Big Data Discovery=1.6

and 76 more

● CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

Apache Axis>=1.0<=1.4

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile Product Lifecycle Management Framework=9.3.3

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Big Data Discovery=1.6

and 73 more

Latest oracle communications design studio Vulnerabilities

Company

Resources

Contact