Oracle Siebel Core Automation vulnerabilities
6 vulnerabilities
Known vulnerabilities in Oracle Siebel Core Automation, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2021-34428the eclipse foundation · eclipse jetty +24 morethe eclipse foundation eclipse jettyFor Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.CVSS3.6LowEPSS0.96%PrioritiseCVE-2021-28165the eclipse foundation · eclipse jetty +27 morethe eclipse foundation eclipse jettyIn Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.CVSS7.8HighEPSS53.86%PrioritiseCVE-2021-28164the eclipse foundation · eclipse jetty +20 morethe eclipse foundation eclipse jettyIn Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.CVSS5.3MediumEPSS82.37%RoutineCVE-2021-28163the eclipse foundation · eclipse jetty +26 morethe eclipse foundation eclipse jettyIn Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.CVSS4.0MediumEPSS4.18%RoutineCVE-2020-27218the eclipse foundation · eclipse jetty +24 morethe eclipse foundation eclipse jettyIn Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.CVSS5.8MediumEPSS8.28%PrioritiseCVE-2020-27216the eclipse foundation · eclipse jetty +264 morethe eclipse foundation eclipse jettyIn Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.CVSS7.0HighEPSS4.35%