Latest oracle financial services revenue management and billing analytics Vulnerabilities

● CVE-2022-23307

A deserialization flaw was found in Apache log4j 1.2.x. While reading serialized log events, they are improperly deserialized. Note this is the same as <a href="https://access.redhat.com/security/cve...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 193 more

● CVE-2022-23305

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 196 more

● CVE-2022-23302

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 194 more

● CVE-2021-4104

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

redhat/log4j<0:1.2.14-6.5.el6_10

redhat/log4j<0:1.2.17-17.el7_4

redhat/log4j<0:1.2.17-16.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 219 more

● CVE-2020-11023

### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may e...

maven/org.webjars.npm:jquery>=1.0.3<3.5.0

nuget/jQuery>=1.0.3<3.5.0

rubygems/jquery-rails<4.4.0

npm/jquery>=1.0.3<3.5.0

debian/jquery

debian/node-jquery<=2.2.4+dfsg-4

and 105 more

● CVE-2019-2904

Oracle ADF Faces Deserialization of Untrusted Data Remote Code Execution Vulnerability

Oracle ADF Faces

Oracle Application Testing Suite=12.5.0.3

Oracle Application Testing Suite=13.1.0.1

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Banking Enterprise Collections=2.7.0

and 43 more

● CVE-2019-10086

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Jav...

redhat/apache-commons-beanutils<0:1.8.3-15.el7_7

redhat/eap7-activemq-artemis<0:2.9.0-2.redhat_00009.1.el6ea

redhat/eap7-apache-commons-beanutils<0:1.9.4-1.redhat_00002.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-4.b08_redhat_00003.1.el6ea

redhat/eap7-glassfish-jaxb<0:2.3.3-4.b02_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-7.SP3_redhat_00005.1.el6ea

and 486 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.