Filtered by vendor Oracle Subscriptions
Total 10058 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-11771 3 Apache, Oracle, Redhat 3 Commons Compress, Weblogic Server, Jboss Fuse 2024-11-21 5.5 Medium
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.
CVE-2018-11763 5 Apache, Canonical, Netapp and 2 more 11 Http Server, Ubuntu Linux, Storage Automation Store and 8 more 2024-11-21 N/A
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
CVE-2018-11761 2 Apache, Oracle 2 Tika, Business Process Management Suite 2024-11-21 N/A
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
CVE-2018-11307 3 Fasterxml, Oracle, Redhat 18 Jackson-databind, Clusterware, Communications Instant Messaging Server and 15 more 2024-11-21 9.8 Critical
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
CVE-2018-11237 5 Canonical, Gnu, Netapp and 2 more 11 Ubuntu Linux, Glibc, Data Ontap Edge and 8 more 2024-11-21 7.8 High
An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.
CVE-2018-11236 4 Gnu, Netapp, Oracle and 1 more 10 Glibc, Data Ontap Edge, Element Software Management and 7 more 2024-11-21 N/A
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
CVE-2018-11219 4 Debian, Oracle, Redhat and 1 more 5 Debian Linux, Communications Operations Monitor, Openstack and 2 more 2024-11-21 N/A
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
CVE-2018-11218 4 Debian, Oracle, Redhat and 1 more 5 Debian Linux, Communications Operations Monitor, Openstack and 2 more 2024-11-21 N/A
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
CVE-2018-11212 7 Canonical, Debian, Ijg and 4 more 16 Ubuntu Linux, Debian Linux, Libjpeg and 13 more 2024-11-21 N/A
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
CVE-2018-11058 2 Dell, Oracle 13 Bsafe, Bsafe Crypto-c, Application Testing Suite and 10 more 2024-11-21 9.8 Critical
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would result in such issue.
CVE-2018-11057 2 Dell, Oracle 12 Bsafe, Application Testing Suite, Communications Analytics and 9 more 2024-11-21 5.9 Medium
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key.
CVE-2018-11056 2 Dell, Oracle 13 Bsafe, Bsafe Crypto-c, Application Testing Suite and 10 more 2024-11-21 6.5 Medium
RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would exhaust the stack, potentially causing a Denial Of Service.
CVE-2018-11055 2 Dell, Oracle 12 Bsafe, Application Testing Suite, Communications Analytics and 9 more 2024-11-21 5.5 Medium
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection.
CVE-2018-11054 2 Dell, Oracle 12 Bsafe, Application Testing Suite, Communications Analytics and 9 more 2024-11-21 7.5 High
RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service.
CVE-2018-11040 3 Debian, Oracle, Vmware 28 Debian Linux, Agile Product Lifecycle Management, Application Testing Suite and 25 more 2024-11-21 7.5 High
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CVE-2018-11039 3 Debian, Oracle, Vmware 33 Debian Linux, Agile Plm, Application Testing Suite and 30 more 2024-11-21 5.9 Medium
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
CVE-2018-10933 6 Canonical, Debian, Libssh and 3 more 10 Ubuntu Linux, Debian Linux, Libssh and 7 more 2024-11-21 N/A
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
CVE-2018-10237 3 Google, Oracle, Redhat 21 Guava, Banking Payments, Communications Ip Service Activator and 18 more 2024-11-21 5.9 Medium
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
CVE-2018-1000873 4 Fasterxml, Netapp, Oracle and 1 more 7 Jackson-modules-java8, Active Iq Unified Manager, Clusterware and 4 more 2024-11-21 6.5 Medium
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
CVE-2018-1000632 5 Debian, Dom4j Project, Netapp and 2 more 17 Debian Linux, Dom4j, Oncommand Workflow Automation and 14 more 2024-11-21 7.5 High
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.