Latest oracle rest data services Vulnerabilities

● CVE-2021-41184

### Impact Accepting the value of the `of` option of the [`.position()`](https://api.jqueryui.com/position/) util from untrusted sources may execute untrusted code. For example, invoking the following...

rubygems/jquery-ui-rails<7.0.0

nuget/jQuery.UI.Combined<1.13.0

maven/org.webjars.npm:jquery-ui<1.13.0

npm/jquery-ui<1.13.0

IBM QRadar SIEM<=7.5.0 GA

IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4

and 75 more

● CVE-2021-41182

### Impact Accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```js...

rubygems/jquery-ui-rails<7.0.0

maven/org.webjars.npm:jquery-ui<1.13.0

nuget/jQuery.UI.Combined<1.13.0

npm/jquery-ui<1.13.0

IBM QRadar SIEM<=7.5.0 GA

IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4

and 126 more

● CVE-2021-41183

### Impact Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```...

ubuntu/jqueryui<1.10.1+dfsg-1ubuntu0.14.04.1~

ubuntu/jqueryui<1.13.0

ubuntu/jqueryui<1.12.1+dfsg-5ubuntu0.18.04.1~

ubuntu/jqueryui<1.12.1+dfsg-5ubuntu0.20.04.1

ubuntu/jqueryui<1.10.1+dfsg-1ubuntu0.16.04.1~

rubygems/jquery-ui-rails<7.0.0

and 116 more

● CVE-2021-32014

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.

Sheetjs Sheetjs<=0.16.9

Sheetjs Sheetjs Pro<=0.16.9

Oracle REST Data Services<21.2.4

● CVE-2021-32012

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).

Sheetjs Project Sheetjs<=0.16.9

Sheetjs Project Sheetjs Pro<=0.16.9

Oracle REST Data Services<21.2.4

● CVE-2021-32013

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).

Sheetjs Project Sheetjs<=0.16.9

Sheetjs Project Sheetjs Pro<=0.16.9

Oracle REST Data Services<21.2.4

● CVE-2021-34429

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security co...

redhat/jetty<9.4.43

redhat/jetty<10.0.6

redhat/jetty<11.0.6

Eclipse Jetty>=9.4.37<9.4.43

Eclipse Jetty>=10.0.1<10.0.6

Eclipse Jetty>=11.0.1<11.0.6

and 19 more

● CVE-2021-34428

Eclipse Jetty could allow a physical attacker to bypass security restrictions, caused by a session ID is not invalidated flaw when an exception is thrown from the SessionListener#sessionDestroyed() me...

redhat/jenkins<0:2.289.3.1630554997-1.el8

IBM Cognos Command Center<=10.2.4.1

debian/jetty9

redhat/jetty<9.4.41

redhat/jetty<10.0.3

redhat/jetty<11.0.3

and 19 more

● CVE-2021-28169

Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw in the ConcatServlet. By sending a specially-crafted request using a doubly encoded path, an attacker coul...

redhat/jenkins<0:2.289.3.1630554997-1.el8

IBM Cognos Command Center<=10.2.4.1

debian/jetty9

redhat/jetty<9.4.41

redhat/jetty<10.0.3

redhat/jetty<11.0.3

and 12 more

● CVE-2021-29425

Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-cra...

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 185 more

● CVE-2021-28165

### Impact When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large (greater than 17408) TLS frame that is incorrectly handled, causing CPU re...

maven/org.eclipse.jetty:jetty-server>=11.0.0<11.0.2

maven/org.eclipse.jetty:jetty-server>=10.0.0<10.0.2

maven/org.eclipse.jetty:jetty-server>=7.2.2<9.4.39

redhat/rh-eclipse-jetty<0:9.4.40-1.1.el7_9

redhat/jenkins<0:2.277.3.1620393611-1.el8

redhat/runc<0:1.0.0-95.rhaos4.8.gitcd80260.el8

and 29 more

● CVE-2020-27223

Eclipse Jetty is vulnerable to a denial of service, caused by an error when handling a request containing multiple Accept headers with a large number of quality parameters. By sending a specially-craf...

redhat/jenkins<0:2.289.1.1624365627-1.el7

redhat/jenkins<0:2.277.3.1623846768-1.el7

redhat/jenkins<0:2.277.3.1623853726-1.el8

debian/jetty9

redhat/jetty-9.4.37.v20210219 jetty-10.0.1 jetty<11.0.1

IBM Secure Proxy<=6.0.2

and 25 more

● CVE-2020-27218

### Impact If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection and if an attacker can send a request with a body that is received en...

redhat/jenkins<0:2.289.1.1624365627-1.el7

redhat/jenkins<0:2.277.3.1623846768-1.el7

redhat/jenkins<0:2.277.3.1623853726-1.el8

redhat/jetty<9.4.35.

redhat/jetty<10.0.0.

redhat/jetty<11.0.0.

and 31 more

● CVE-2020-14744

Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services (component: General). Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c; Standalone...

Oracle REST Data Services<20.2.1

Oracle REST Data Services=11.2.0.4

Oracle REST Data Services=12.1.0.2

Oracle REST Data Services=12.2.0.1

Oracle REST Data Services=18c

Oracle REST Data Services=19c

● CVE-2020-14745

Oracle REST Data Services<20.2.1

Oracle REST Data Services=11.2.0.4

Oracle REST Data Services=12.1.0.2

Oracle REST Data Services=12.2.0.1

Oracle REST Data Services=18c

Oracle REST Data Services=19c

● CVE-2020-11023

### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may e...

maven/org.webjars.npm:jquery>=1.0.3<3.5.0

nuget/jQuery>=1.0.3<3.5.0

rubygems/jquery-rails<4.4.0

npm/jquery>=1.0.3<3.5.0

debian/jquery

debian/node-jquery<=2.2.4+dfsg-4

and 105 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 779 more

● CVE-2019-10246

Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw when configured for showing a listing of directory contents. By sending a specially-crafted request, a rem...

Eclipse Jetty=9.2.27-20190403

Eclipse Jetty=9.3.26-20190403

Eclipse Jetty=9.4.16-20190411

Microsoft Windows

NetApp OnCommand System Manager>=3.0<=3.1.3

NetApp Snap Creator Framework

and 49 more

● CVE-2019-10241

Eclipse Jetty is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the DefaultServlet and ResourceHandler. A remote attacker could exploit this vulnerability ...

Eclipse Jetty=9.2.0-20140523

Eclipse Jetty=9.2.0-20140526

Eclipse Jetty=9.2.0-maintenance_0

Eclipse Jetty=9.2.0-maintenance_1

Eclipse Jetty=9.2.0-rc0

Eclipse Jetty=9.2.1-20140609

and 138 more

● CVE-2019-11358

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted J...

redhat/ansible-tower<0:3.5.2-1.el7a

redhat/cfme<0:5.10.9.1-1.el7cf

redhat/cfme-amazon-smartstate<0:5.10.9.1-1.el7cf

redhat/cfme-appliance<0:5.10.9.1-1.el7cf

redhat/cfme-gemset<0:5.10.9.1-1.el7cf

redhat/ovirt-ansible-hosted-engine-setup<0:1.0.23-1.el7e

and 267 more

● CVE-2017-7657

Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of Chunked Transfer-Encoding chunk size. By sending a specially-crafted request, an attacker could exploit this vulne...

debian/jetty9

IBM Cognos Command Center<=10.2.4.1

redhat/jetty<9.3.24.

redhat/jetty<9.4.11.

Eclipse Jetty<=9.2.26

Eclipse Jetty>=9.3.0<9.3.24

and 25 more

● CVE-2017-7658

Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a specially-crafted request, an attacker could exploit this vulne...

debian/jetty9

IBM Cognos Command Center<=10.2.4.1

redhat/jetty<9.2.25.

redhat/jetty<9.3.24.

redhat/jetty<9.4.11.

Eclipse Jetty<=9.2.26

and 28 more

Latest oracle rest data services Vulnerabilities

Company

Resources

Contact