NCSC-2025-0124

Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Communications producten, waaronder de Cloud Native Core en Policy Management.

De kwetsbaarheden in Oracle Communications producten stellen ongeauthenticeerde aanvallers in staat om ongeautoriseerde toegang te verkrijgen tot gevoelige gegevens en kunnen leiden tot Denial-of-Service (DoS) aanvallen. Specifieke versies van de Cloud Native Core, zoals de Binding Support Function en Network Repository Function, zijn getroffen, met CVSS-scores die variëren van 4.3 tot 9.8, wat wijst op significante risico's voor de beschikbaarheid en vertrouwelijkheid van de systemen.

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

medium

high

Path Equivalence: 'file.name' (Internal Dot)

Use of Incorrectly-Resolved Name or Reference

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Deserialization of Untrusted Data

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stack-based Buffer Overflow

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Dependency on Vulnerable Third-Party Component

Improper Isolation or Compartmentalization

Always-Incorrect Control Flow Implementation

Use of Potentially Dangerous Function

Improper Neutralization of Special Elements Used in a Template Engine

Missing Report of Error Condition

Missing Release of Resource after Effective Lifetime

Observable Timing Discrepancy

Incorrect Resource Transfer Between Spheres

Acceptance of Extraneous Untrusted Data With Trusted Data

Excessive Iteration

Incorrect Implementation of Authentication Algorithm

Incorrect Permission Assignment for Critical Resource

Time-of-check Time-of-use (TOCTOU) Race Condition

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Improper Validation of Syntactic Correctness of Input

Improper Check for Unusual or Exceptional Conditions

Integer Overflow to Buffer Overflow

Insufficient Verification of Data Authenticity

Divide By Zero

Files or Directories Accessible to External Parties

Authorization Bypass Through User-Controlled Key

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Improper Resource Shutdown or Release

Missing Authorization

Improper Restriction of Operations within the Bounds of a Memory Buffer

Inefficient Regular Expression Complexity

Improper Certificate Validation

Improper Control of Generation of Code ('Code Injection')

Use of a Broken or Risky Cryptographic Algorithm

Uncontrolled Resource Consumption

Allocation of Resources Without Limits or Throttling

Uncontrolled Recursion

Improper Restriction of XML External Entity Reference

Exposure of Sensitive Information to an Unauthorized Actor

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Improper Privilege Management

Improper Input Validation