NCSC-2025-0026

Oracle heeft kwetsbaarheden verholpen in JD Edwards EnterpriseOne Tools (specifiek voor versies prior tot 9.2.9.2).

De kwetsbaarheden in Oracle JD Edwards EnterpriseOne Tools stellen ongeauthenticeerde kwaadwillenden in staat om het systeem te compromitteren via HTTP-verzoeken. Dit kan leiden tot ongeautoriseerde toegang tot kritieke gegevens en gegevenswijzigingen.

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

medium

high

Truncation of Security-relevant Information

Use of Weak Hash

Buffer Over-read

Creation of Temporary File in Directory with Insecure Permissions

Expected Behavior Violation

Improper Validation of Syntactic Correctness of Input

URL Redirection to Untrusted Site ('Open Redirect')

Improper Validation of Integrity Check Value

Files or Directories Accessible to External Parties

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Use of a Broken or Risky Cryptographic Algorithm

Uncontrolled Resource Consumption

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Out-of-bounds Write

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Unchecked Input for Loop Condition

Use of Blocking Code in Single-threaded, Non-blocking Context

Improper Handling of Insufficient Permissions or Privileges

Improper Check for Unusual or Exceptional Conditions

Missing Cryptographic Step

Out-of-bounds Read

Improper Resource Shutdown or Release

NULL Pointer Dereference

Improper Control of Generation of Code ('Code Injection')

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Deserialization of Untrusted Data

Heap-based Buffer Overflow

Improper Input Validation

Incorrect Default Permissions