Latest oracle webcenter sites Vulnerabilities

● CVE-2024-20908

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allow...

Oracle WebCenter Sites=12.2.1.4.0

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-32808

CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the clipboard Widget plugin if used alongside the undo feature. A remote attacker could exploit ...

Ckeditor Ckeditor>=4.13.0<4.16.2

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Fedoraproject Fedora=35

Oracle Application Express<21.1.4

Oracle Banking Party Management=2.7.0

and 14 more

● CVE-2021-29505

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the...

redhat/xstream<0:1.3.1-14.el7_9

debian/libxstream-java

redhat/xstream<1.4.17

Xstream Project Xstream<1.4.17

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 37 more

● CVE-2021-27807

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

redhat/pdfbox<2.0.23

Apache PDFBox>=2.0.0<=2.0.22

Fedoraproject Fedora=32

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Banking Trade Finance Process Management=14.2.0

and 26 more

● CVE-2021-27906

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

redhat/pdfbox<2.0.23

Apache PDFBox>=2.0.0<=2.0.22

Fedoraproject Fedora=32

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Banking Corporate Lending Process Management=14.2.0

and 37 more

● CVE-2021-26271

CKEditor is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Advanced Tab for Dialogs plugin. By persuading a victim to paste specially-crafted t...

Ckeditor Ckeditor>=4.0<4.16

Oracle Agile PLM=9.3.5

Oracle Agile PLM=9.3.6

Oracle Application Express<21.1.0

Oracle Financial Services Analytical Applications Infrastructure>=8.0.6<=8.0.9

Oracle Financial Services Analytical Applications Infrastructure=8.1.0

and 19 more

● CVE-2020-11023

### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may e...

maven/org.webjars.npm:jquery>=1.0.3<3.5.0

nuget/jQuery>=1.0.3<3.5.0

rubygems/jquery-rails<4.4.0

npm/jquery>=1.0.3<3.5.0

debian/jquery

debian/node-jquery<=2.2.4+dfsg-4

and 105 more

● CVE-2020-2739

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows ...

Oracle WebCenter Sites=12.2.1.3.0

● CVE-2020-5258

Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this vulnerability to overwri...

IBM Financial Transaction Manager for Corporate Payment Services for Multi-Platform<=3.2.0-3.2.9

IBM Financial Transaction Manager for Digital Payments for Multi-Platform<=3.2.0-3.2.9

IBM Financial Transaction Manager for High Value Payments for Multi-Platform<=3.2.0-3.2.10.2

Linuxfoundation Dojo<1.11.10

Linuxfoundation Dojo>=1.12.0<1.12.8

Linuxfoundation Dojo>=1.13.0<1.13.7

and 21 more

● CVE-2020-7226

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length ...

redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea

redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea

redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea

redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea

redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-5.b08_redhat_00004.1.el6ea

and 269 more

● CVE-2020-2539

Oracle WebCenter Sites=12.2.1.3.0

● CVE-2019-12415

Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data by tool XSSFExportToXml. By sending a specially-crafted ...

redhat/poi<4.1.0

IBM Cloud Pak for Business Automation<=V22.0.2

IBM Cloud Pak for Business Automation<=V21.0.3 - V21.0.3-IF016

IBM Cloud Pak for Business Automation<=V22.0.1 - V22.0.1-IF006 and later fixes V21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes

Apache POI<=4.1.0

Oracle Application Testing Suite=12.5.0.3

and 63 more

● CVE-2019-17531

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. When Default Typing is enabled (either globally or for a specific property) for ...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 137 more

● CVE-2019-16942

FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by a polymorphic typing issue in the commons-dbcp class. By sending a specially-crafted request...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 157 more

● CVE-2019-16943

maven/com.fasterxml.jackson.core:jackson-databind<2.6.7.3

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.8.11.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.9.0<2.9.10.1

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

and 146 more

● CVE-2019-13990

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

redhat/rhvm-dependencies<0:4.4.0-1.el8e

IBM Data Risk Manager<=2.0.6

maven/org.quartz-scheduler:quartz<2.3.2

redhat/quartz<2.3.2

Softwareag Quartz<2.3.2

Oracle Apache Batik Mapviewer=12.2.0.1

and 178 more

● CVE-2019-2579

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability al...

Oracle WebCenter Sites=12.2.1.3.0

● CVE-2019-2578

Oracle WebCenter Sites=12.2.1.3.0

● CVE-2019-0228

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

Apache PDFBox=2.0.14

Apache James=3.3.0

Apache James=3.4.0

Fedoraproject Fedora=29

Fedoraproject Fedora=30

Oracle Banking Corporate Lending Process Management=14.2

and 26 more

● CVE-2019-5427

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Mchange C3p0<0.9.5.2

Fedoraproject Fedora=29

Fedoraproject Fedora=30

Oracle Communications Ip Service Activator=7.3.0

Oracle Communications Ip Service Activator=7.4.0

Oracle Communications Session Route Manager>=8.2.0<=8.2.2

and 13 more

● CVE-2019-11358

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted J...

redhat/ansible-tower<0:3.5.2-1.el7a

redhat/cfme<0:5.10.9.1-1.el7cf

redhat/cfme-amazon-smartstate<0:5.10.9.1-1.el7cf

redhat/cfme-appliance<0:5.10.9.1-1.el7cf

redhat/cfme-gemset<0:5.10.9.1-1.el7cf

redhat/ovirt-ansible-hosted-engine-setup<0:1.0.23-1.el7e

and 267 more

● CVE-2018-3238

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability al...

Oracle WebCenter Sites=11.1.1.8.0

● CVE-2018-15756

Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the ResourceHttpRequestHandler. By adding a range header with a high number of ranges, a ...

IBM GDE<=3.0.0.2

redhat/springframework<5.0.10

redhat/springframework<4.3.20

VMware Spring Framework>=4.2.0<4.3.20

VMware Spring Framework>=5.0.0<5.0.10

VMware Spring Framework=5.1.0

and 111 more

Latest oracle webcenter sites Vulnerabilities

Company

Resources

Contact