CVE Vulnerability Catalog

Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via T3 or IIOP can compromise Oracle Access Manager.

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a high privileged attacker with network access via HTTP to compromise Oracle Access Manager.

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).

Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can modify or delete critical data, gain complete access to it and cause a partial denial of service (partial DoS).

Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Access Manager, and the attack may significantly impact additional products (scope change).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a low privileged attacker with network access via T3, IIOP to compromise Oracle Identity Manager.

Vulnerability in Oracle Identity Manager (Core component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Identity Manager.

Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.

Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.

Vulnerability in Oracle Web Applications Desktop Integrator (component: File download) affecting versions 12.2.3-12.2.15. A low privileged attacker with network access via HTTP can easily exploit it, resulting in unauthorized access to critical data or complete access to all accessible data.

Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.

Vulnerability in Http4s (a Scala interface for HTTP services) prior to 0.23.35 and 1.0.0-M47. When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound, allowing a remote peer to exhaust heap memory.

Vulnerability in Http4s prior to 0.23.35 and 1.0.0-M47. Ember's HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message, enabling CL.CL request smuggling.

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching. Consequently, a cookie for example.com can be sent to an attacker-controlled hostname such as evilexample.com.

Vulnerability in Http4s prior to 0.23.35 and 1.0.0-M47. WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths, allowing a remote client to send a frame that causes an infinite decode loop and resource exhaustion.

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values due to parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times.

Vulnerability in Http4s prior to 0.23.35 and 1.0.0-M47. Ember's HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset, leading to disagreement with RFC-compliant intermediaries and enabling TE.CL or TE.0 request smuggling.

In Http4s, an Ember server with HTTP/2 enabled does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. A single unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in ember-client via server-initiated PUSH_PROMISE frames because enablePush is not enforced. Fixed in versions 0.23.35 and 1.0.0-M47.

In Http4s, Ember's HTTP/2 flow-control window is replenished based on bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. Fixed in versions 0.23.35 and 1.0.0-M47.