oracle blockchain platform vulnerabilities and exploits

(subscribe to this query)

4.7

CVSSv3

slapd in OpenLDAP 2.4.45 and previous versions creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a &qu...

Openldap Openldap Oracle Blockchain Platform

8.8

CVSSv3

Dropwizard-Validation prior to 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fi...

Dropwizard Dropwizard Validation Oracle Blockchain Platform

2 Github repositories

7.5

CVSSv3

contrib/slapd-modules/nops/nops.c in OpenLDAP up to and including 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote malicious users to cause a denial of service (slapd crash) via ...

Openldap Openldap Opensuse Leap 15.0 Opensuse Leap 15.1 Oracle Blockchain Platform Mcafee Policy Auditor

7.4

CVSSv3

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Nodejs Node.js Oracle Graalvm 19.3.2 Oracle Graalvm 20.1.0 Oracle Banking Extensibility Workbench 14.4.0 Oracle Banking Extensibility Workbench 14.3.0 Oracle Mysql Cluster Oracle Blockchain Platform

4.2

CVSSv3

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat E...

Openldap Openldap Redhat Enterprise Linux 8.0 Opensuse Leap 15.1 Opensuse Leap 15.2 Mcafee Policy Auditor Oracle Blockchain Platform

7.5

CVSSv3

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. T...

Nghttp2 Nghttp2 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Opensuse Leap 15.1 Fedoraproject Fedora 31 Fedoraproject Fedora 33 Oracle Enterprise Communications Broker 3.1.0 Oracle Graalvm 19.3.2 Oracle Graalvm 20.1.0 Oracle Mysql Oracle Enterprise Communications Broker 3.2.0 Oracle Banking Extensibility Workbench 14.4.0 Oracle Banking Extensibility Workbench 14.3.0 Oracle Blockchain Platform Nodejs Node.js

7.5

CVSSv3

A Node.js application that allows an malicious user to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. ...

Nodejs Node.js Fedoraproject Fedora 32 Fedoraproject Fedora 33 Oracle Graalvm 19.3.4 Oracle Graalvm 20.3.0 Oracle Retail Xstore Point Of Service 16.0.6 Oracle Retail Xstore Point Of Service 17.0.4 Oracle Retail Xstore Point Of Service 18.0.3 Oracle Retail Xstore Point Of Service 19.0.2 Oracle Jd Edwards Enterpriseone Tools Oracle Mysql Cluster Oracle Blockchain Platform C-ares Project C-ares

2 Github repositories

8.1

CVSSv3

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

Nodejs Node.js Oracle Banking Extensibility Workbench 14.4.0 Oracle Banking Extensibility Workbench 14.3.0 Oracle Retail Xstore Point Of Service 16.0.6 Oracle Retail Xstore Point Of Service 17.0.4 Oracle Retail Xstore Point Of Service 18.0.3 Oracle Retail Xstore Point Of Service 19.0.2 Oracle Retail Xstore Point Of Service 20.0.1 Oracle Mysql Cluster Oracle Blockchain Platform Netapp Snapcenter -Netapp Oncommand Workflow Automation -Netapp Oncommand Insight -Netapp Active Iq Unified Manager -

1 Github repository

8.1

CVSSv3

FasterXML jackson-databind 2.x prior to 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

8.1

CVSSv3

FasterXML jackson-databind 2.x prior to 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

Fasterxml Jackson-databind Netapp Service Level Manager -Debian Debian Linux 9.0 Oracle Webcenter Portal 12.2.1.3.0 Oracle Application Testing Suite 13.3.0.1 Oracle Banking Platform 2.6.2 Oracle Agile Plm 9.3.6 Oracle Webcenter Portal 12.2.1.4.0 Oracle Communications Services Gatekeeper 7.0 Oracle Retail Merchandising System 15.0.3 Oracle Banking Platform 2.7.0 Oracle Banking Platform 2.7.1 Oracle Banking Platform 2.9.0 Oracle Communications Evolved Communications Application Server 7.1 Oracle Banking Platform 2.8.0 Oracle Banking Virtual Account Management 14.3.0 Oracle Insurance Policy Administration J2ee 11.2.0 Oracle Communications Interactive Session Recorder 6.3 Oracle Communications Interactive Session Recorder 6.4 Oracle Communications Diameter Signaling Router Oracle Communications Unified Inventory Management 7.4.1 Oracle Retail Xstore Point Of Service 16.0.6

Get Started

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook