R00T4Dm

اسم البرنامج المعرض للخطر والإصدارات المتأثرة إصدارات Apache Karaf Decanter الأقدم من 2.12.0 الوصف يعاني مجمع السجلات عبر مأخذ التوصيل (socket) الخاص بـ Decanter في Apache Karaf من مشكلة في عملية إزالة التسلسل. يعمل المجمع على المنفذ 4560 دون مصادقة. إذا تم الكشف عن الخاصية `allowed classes`، فيمكن التحايل على إعداداتها، مما يؤدي إلى حالات محتملة لرفض الخدمة (DoS) بسبب إزالة تسلسل البيانات غير الموثوق بها. لا يتم تثبيت أداة جمع السجلات عبر مأخذ التوصيل (socket) الخاصة بـ Decanter بشكل افتراضي، مما يعني أن المستخدمين الذين لم يقوموا بتثبيتها غير متأثرين. التوصيات قم بالتحديث إلى الإصدار 2.12.0 أو أحدث.

تتمثل الثغرة في هجوم «رفض الخدمة» (DoS) ناتج عن عملية إزالة التسلسل غير الآمنة لبيانات غير موثوقة. يمكن للمهاجم تزويد حمولة بيانات كبيرة ومصممة خصيصًا تستهلك موارد مفرطة من وحدة المعالجة المركزية (CPU) أثناء عملية إزالة التسلسل، مما يؤدي إلى استنفاد موارد وحدة المعالجة المركزية (CPU) وجعل التطبيق أو النظام غير متاح.

The issue allows admin users to exploit an XXE problem to view files.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3 or IIOP to compromise the server. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.

A vulnerability in the MySQL Server product allows a highly privileged attacker with network access via multiple protocols to compromise the server. The vulnerability is difficult to exploit and can result in unauthorized ability to cause a hang or frequently repeatable crash of MySQL Server, leading to a denial of service. The issue is related to insufficient input validation in the Server: Stored Procedure component.

The issue is related to errors in the code of the Oracle BI Publisher's BI Publisher Security component. It allows a remote attacker to gain read access to data using HTTP requests. Successful attacks can result in unauthorized read access to a subset of Oracle BI Publisher accessible data.

The issue is related to insufficient input validation in the Connection Manager component, allowing a low-privileged attacker with network access via TCP to compromise Oracle Communications Billing and Revenue Management. Successful attacks can result in the takeover of Oracle Communications Billing and Revenue Management.

The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition, resulting in unauthorized access to critical data or complete access to all accessible data. The vulnerability is related to the Analytics Web General component and is easily exploitable.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing a remote attacker to cause a denial of service via T3/IIOP protocols. Successful attacks can result in the ability to cause a hang or frequently repeatable crash of Oracle WebLogic Server.

The issue exists due to insufficient input validation in a component of Oracle WebLogic Server. Exploitation can allow a remote attacker to impact the confidentiality and integrity of protected information. Successful attacks require human interaction and can result in unauthorized access to some of the server's accessible data, including update, insert, or delete access, as well as unauthorized read access to a subset of the data.

The issue exists due to insufficient input validation in the Samples component of Oracle WebLogic Server, allowing a remote attacker to impact the confidentiality and integrity of protected information. Successful attacks require human interaction and may significantly impact additional products, resulting in unauthorized access to Oracle WebLogic Server data.

A vulnerability in the Oracle WebLogic Server product exists due to insufficient input validation in the Samples component. This easily exploitable issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in unauthorized update, insert, or delete access to some of Oracle WebLogic Server's accessible data, as well as unauthorized read access to a subset of Oracle WebLogic Server's accessible data.

The issue is related to insufficient input validation in the Samples component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle WebLogic Server's accessible data, as well as unauthorized read access to a subset of the server's accessible data.

The issue is a denial of service caused by sending a specially-crafted request. A remote attacker could exploit this to cause the server to consume all available CPU resources.

The issue arises from the Spring AMQP Message object's toString() method, which deserializes a body for a message with content type application/x-java-serialized-object. This allows for the construction of a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called. Additionally, the method can create a new String object from the message body, regardless of its size, potentially leading to an OOM Error with large messages.

The issue is related to insufficient input validation in the Core component of Oracle Coherence, allowing an unauthenticated attacker with network access via T3 or IIOP protocols to compromise Oracle Coherence. Successful attacks can result in the takeover of Oracle Coherence. The vulnerability is difficult to exploit.

The issue is related to the Web Services component of Oracle WebLogic Server, which can be exploited by an unauthenticated attacker with network access via T3 or IIOP protocols. This can lead to a denial of service (DOS) condition, causing the server to hang or crash repeatedly. The vulnerability is due to incorrect resource cleanup or release.

The issue exists due to insufficient input validation in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition. This allows a remote attacker to gain full control over the application via the HTTP protocol. Successful attacks can result in the takeover of Oracle Business Intelligence Enterprise Edition.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data.

The issue is related to errors in processing input data in the web component of Essbase Analytic Provider Services. It can be exploited by a remote attacker to cause a denial of service. Successful attacks can result in the ability to cause the service to hang or crash repeatedly, leading to a complete denial of service.