Product:

Business_process_management_suite

(Oracle)
Date Id Summary Products Score Patch Annotated
2021-07-13 CVE-2021-35516 When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package. Commons_compress, Active_iq_unified_manager, Oncommand_insight, Banking_digital_experience, Banking_enterprise_default_management, Banking_party_management, Business_process_management_suite, Commerce_guided_search, Communications_billing_and_revenue_management, Communications_cloud_native_core_automated_test_suite, Communications_cloud_native_core_service_communication_proxy, Communications_cloud_native_core_unified_data_repository, Communications_diameter_intelligence_hub, Communications_messaging_server, Communications_session_route_manager, Financial_services_crime_and_compliance_management_studio, Financial_services_enterprise_case_management, Flexcube_universal_banking, Healthcare_data_repository, Insurance_policy_administration, Peoplesoft_enterprise_peopletools, Primavera_unifier, Utilities_testing_accelerator, Webcenter_portal 7.5
2021-07-13 CVE-2021-35517 When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. Commons_compress, Active_iq_unified_manager, Oncommand_insight, Banking_apis, Banking_digital_experience, Banking_enterprise_default_management, Banking_party_management, Banking_payments, Banking_trade_finance, Banking_treasury_management, Business_process_management_suite, Commerce_guided_search, Communications_billing_and_revenue_management, Communications_cloud_native_core_service_communication_proxy, Communications_cloud_native_core_unified_data_repository, Communications_diameter_intelligence_hub, Communications_messaging_server, Communications_session_route_manager, Financial_services_crime_and_compliance_management_studio, Financial_services_enterprise_case_management, Flexcube_universal_banking, Healthcare_data_repository, Insurance_policy_administration, Peoplesoft_enterprise_peopletools, Primavera_unifier, Utilities_testing_accelerator, Webcenter_portal 7.5
2021-07-13 CVE-2021-36090 When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. Commons_compress, Active_iq_unified_manager, Oncommand_insight, Banking_apis, Banking_digital_experience, Banking_enterprise_default_management, Banking_party_management, Banking_payments, Banking_platform, Banking_trade_finance, Banking_treasury_management, Business_process_management_suite, Commerce_guided_search, Communications_billing_and_revenue_management, Communications_cloud_native_core_automated_test_suite, Communications_cloud_native_core_service_communication_proxy, Communications_cloud_native_core_unified_data_repository, Communications_diameter_intelligence_hub, Communications_element_manager, Communications_messaging_server, Communications_session_report_manager, Communications_session_route_manager, Communications_unified_inventory_management, Financial_services_analytical_applications_infrastructure, Financial_services_crime_and_compliance_management_studio, Financial_services_enterprise_case_management, Flexcube_universal_banking, Healthcare_data_repository, Insurance_policy_administration, Peoplesoft_enterprise_peopletools, Primavera_gateway, Primavera_unifier, Utilities_testing_accelerator, Webcenter_portal 7.5
2021-08-18 CVE-2021-37714 jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available... Jsoup, Management_services_for_element_software_and_netapp_hci, Banking_trade_finance, Banking_treasury_management, Business_process_management_suite, Communications_messaging_server, Financial_services_crime_and_compliance_management_studio, Flexcube_universal_banking, Hospitality_token_proxy_service, Middleware_common_libraries_and_tools, Peoplesoft_enterprise_peopletools, Primavera_unifier, Retail_customer_management_and_segmentation_foundation, Stream_analytics, Webcenter_portal, Quarkus 7.5
2022-01-18 CVE-2022-23302 JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use... Log4j, Brocade_sannav, Snapmanager, Advanced_supply_chain_planning, Business_intelligence, Business_process_management_suite, Communications_eagle_ftp_table_base_retrieval, Communications_instant_messaging_server, Communications_messaging_server, Communications_network_integrity, Communications_offline_mediation_controller, Communications_unified_inventory_management, E\-Business_suite_cloud_manager_and_cloud_backup_module, Enterprise_manager_base_platform, Financial_services_revenue_management_and_billing_analytics, Healthcare_foundation, Hyperion_data_relationship_management, Hyperion_infrastructure_technology, Identity_management_suite, Identity_manager_connector, Jdeveloper, Middleware_common_libraries_and_tools, Mysql_enterprise_monitor, Tuxedo, Weblogic_server, Reload4j 8.8
2022-01-18 CVE-2022-23305 By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the... Log4j, Brocade_sannav, Snapmanager, Advanced_supply_chain_planning, Business_intelligence, Business_process_management_suite, Communications_eagle_ftp_table_base_retrieval, Communications_instant_messaging_server, Communications_messaging_server, Communications_network_integrity, Communications_offline_mediation_controller, Communications_unified_inventory_management, E\-Business_suite_cloud_manager_and_cloud_backup_module, E\-Business_suite_information_discovery, Enterprise_manager_base_platform, Financial_services_revenue_management_and_billing_analytics, Healthcare_foundation, Hyperion_data_relationship_management, Hyperion_infrastructure_technology, Identity_management_suite, Identity_manager_connector, Jdeveloper, Middleware_common_libraries_and_tools, Mysql_enterprise_monitor, Retail_extract_transform_and_load, Tuxedo, Weblogic_server, Reload4j 9.8
2022-01-18 CVE-2022-23307 CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. Chainsaw, Log4j, Advanced_supply_chain_planning, Business_intelligence, Business_process_management_suite, Communications_eagle_ftp_table_base_retrieval, Communications_instant_messaging_server, Communications_messaging_server, Communications_network_integrity, Communications_offline_mediation_controller, Communications_unified_inventory_management, E\-Business_suite_cloud_manager_and_cloud_backup_module, Enterprise_manager_base_platform, Financial_services_revenue_management_and_billing_analytics, Healthcare_foundation, Hyperion_data_relationship_management, Hyperion_infrastructure_technology, Identity_management_suite, Identity_manager_connector, Jdeveloper, Middleware_common_libraries_and_tools, Mysql_enterprise_monitor, Retail_extract_transform_and_load, Tuxedo, Weblogic_server, Reload4j 8.8
2020-03-23 CVE-2020-1950 A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. Tika, Ubuntu_linux, Debian_linux, Business_process_management_suite, Communications_messaging_server, Flexcube_private_banking 5.5
2020-03-23 CVE-2020-1951 A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23. Tika, Ubuntu_linux, Debian_linux, Business_process_management_suite, Communications_messaging_server, Flexcube_private_banking 5.5
2019-10-16 CVE-2019-2904 Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).... Application_testing_suite, Banking_enterprise_collections, Banking_enterprise_originations, Banking_enterprise_product_manufacturing, Banking_platform, Business_process_management_suite, Clinical, Communications_diameter_signaling_router, Communications_network_integrity, Communications_service_broker, Communications_services_gatekeeper, Enterprise_repository, Financial_services_lending_and_leasing, Financial_services_revenue_management_and_billing_analytics, Flexcube_private_banking, Health_sciences_data_management_workbench, Hyperion_planning, Rapid_planning, Retail_assortment_planning, Retail_clearance_optimization_engine, Retail_markdown_optimization, Retail_sales_audit 9.8