Latest oracle utilities framework vulnerabilities since last week (CVE List)

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-39144

XStream Remote Code Execution Vulnerability

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

XStream XStream

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

and 34 more

● CVE-2021-39151

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39152

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicl...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39140

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on ...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39147

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39149

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39150

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicl...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39141

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39153

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 27 more

● CVE-2021-39145

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39154

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39146

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39148

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39139

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-2351

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Oracle Advanced Networking Option=12.1.0.2

Oracle Advanced Networking Option=12.2.0.1

Oracle Advanced Networking Option=19c

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management for Process=6.2.2.0

and 242 more

● CVE-2021-36374

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted ZIP archive, a remote a...

maven/org.apache.ant:ant>=1.9.0<1.9.16

maven/org.apache.ant:ant>=1.10.0<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

and 75 more

● CVE-2021-36373

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted TAR archive, a remote a...

redhat/Apache Ant<1.9.16

redhat/Ant<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile PLM=9.3.6

Oracle Banking Trade Finance=14.5

and 69 more

● CVE-2021-31684

A flaw was found in the json-smart package in the JSONParserByteArray. This flaw allows an attacker to cause a denial of service.

Json-smart Project Json-smart-v1>=1.3<1.3.3

Json-smart Project Json-smart-v2>=2.4<2.4.4

Oracle Utilities Framework=4.4.0.0.0

Oracle Utilities Framework=4.4.0.2.0

Oracle Utilities Framework=4.4.0.3.0

IBM Cognos Analytics<=12.0.0-12.0.1

and 2 more

● CVE-2021-27568

A flaw was found in json-smart. When an exception is thrown from a function, but is not caught, the program using the library may crash or expose sensitive information. The highest threat from this vu...

Json-smart Project Json-smart-v1<1.3.2

Json-smart Project Json-smart-v2<2.3.1

Json-smart Project Json-smart-v2>=2.4<2.4.1

Oracle Communications Cloud Native Core Policy=1.14.0

Oracle OSS Support Tools<2.12.42

Oracle PeopleSoft Enterprise PeopleTools=8.58

and 11 more

● CVE-2020-28052

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect pass...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api=1.65

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api=1.66

Apache Karaf=4.3.2

Oracle Banking Corporate Lending Process Management=14.2.0

Oracle Banking Corporate Lending Process Management=14.3.0

Oracle Banking Corporate Lending Process Management=14.5.0

and 81 more

● CVE-2020-14895

Vulnerability in the Oracle Utilities Framework product of Oracle Utilities Applications (component: System Wide). Supported versions that are affected are 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 -...

Oracle Utilities Framework>=4.3.0.1.0<=4.3.0.6.0

Oracle Utilities Framework=2.2.0.0.0

Oracle Utilities Framework=4.2.0.2.0

Oracle Utilities Framework=4.2.0.3.0

Oracle Utilities Framework=4.4.0.0.0

Oracle Utilities Framework=4.4.0.2.0

● CVE-2020-11979

As mitigation for <a href="https://access.redhat.com/security/cve/CVE-2020-1945">CVE-2020-1945</a> Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user...

redhat/jenkins<0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el7

redhat/jenkins<0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

and 147 more

● CVE-2020-36518

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.

debian/jackson-databind<=2.9.8-3+deb10u3

redhat/jackson-databind<0:2.14.1-2.el9

redhat/eap7-jackson-databind<0:2.12.6.1-1.redhat_00003.1.el8ea

redhat/eap7-jackson-databind<0:2.12.6.1-1.redhat_00003.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8

and 88 more

● CVE-2020-1945

Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of an insecure temporary directory to store source files. By sending a specially-crafted request, an attacke...

redhat/jenkins<0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el8

redhat/jenkins<0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

and 128 more

● CVE-2020-9488

Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appender. An attacker could exploit this vulnerability to launch a ma...

debian/apache-log4j2

redhat/qpid-cpp<0:1.36.0-31.el6_10a

redhat/qpid-proton<0:0.32.0-1.el6_10

redhat/qpid-cpp<0:1.36.0-31.el7a

redhat/qpid-proton<0:0.32.0-2.el7

redhat/nodejs-rhea<0:1.0.24-1.el8

and 110 more

● CVE-2020-2555

Oracle Multiple Products Remote Code Execution Vulnerability

Oracle Coherence=3.7.1.0

Oracle Coherence=12.1.3.0.0

Oracle Coherence=12.2.1.3.0

Oracle Coherence=12.2.1.4.0

Oracle Commerce Platform>=11.3.0<=11.3.2

Oracle Commerce Platform=11.0.0

and 16 more

● CVE-2020-25649

A flaw was found in FasterXML Jackson Databind which did not have entity expansion secured properly making it vulnerable to XML external entity (XXE). This vulnerability is similar to <a href="https:...

redhat/eap7-jackson-databind<0:2.10.4-1.redhat_00002.1.el6ea

redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el6ea

redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el6ea

redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el6ea

redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el6ea

and 147 more

● CVE-2019-17495

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltrat...

Smartbear Swagger Ui<3.23.11

Oracle Banking Apis>=18.1<=18.3

Oracle Banking Apis=19.1

Oracle Banking Apis=19.2

Oracle Banking Apis=20.1

Oracle Banking Apis=21.1

and 11 more

● CVE-2019-10086

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Jav...

redhat/apache-commons-beanutils<0:1.8.3-15.el7_7

redhat/eap7-activemq-artemis<0:2.9.0-2.redhat_00009.1.el6ea

redhat/eap7-apache-commons-beanutils<0:1.9.4-1.redhat_00002.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-4.b08_redhat_00003.1.el6ea

redhat/eap7-glassfish-jaxb<0:2.3.3-4.b02_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-7.SP3_redhat_00005.1.el6ea

and 486 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 795 more

● CVE-2020-10683

dom4j could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data. By sending specially crafted XML data, a remot...

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea

and 204 more

● CVE-2019-10173

A vulnerability was found in xstream API version 1.4.10, if the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands by manipulating the processe...

IBM Data Risk Manager<=2.0.6

redhat/xstream<1.4.11

Xstream Project Xstream=1.4.10

Oracle Banking Platform>=2.4.0<=2.10.0

Oracle Banking Platform=2.4.0

Oracle Banking Platform=2.7.1

and 20 more

● CVE-2018-1000632

dom4j could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation in multiple methods. By sending a specially-crafted XML content, an attacker could expl...

redhat/dom4j<2.0.3

redhat/dom4j<2.1.1

Dom4j Project Dom4j>=2.0.0<2.0.3

Dom4j Project Dom4j>=2.1.0<2.1.1

Debian Debian Linux=8.0

Oracle FLEXCUBE Investor Servicing=12.0.4

and 31 more

Latest oracle utilities framework Vulnerabilities

Company

Resources

Contact