CVE-2021-2025 — Resource Exposure in Corporation Business Intelligence Enterprise Edition
CWE-668 — Resource ExposureCWE-674 — Uncontrolled RecursionCWE-697 — Incorrect ComparisonCWE-200 — Sensitive Information ExposureCWE-122 — Heap-based Buffer OverflowCWE-415 — Double FreeCWE-203 — Observable DiscrepancyCWE-476 — NULL Pointer DereferenceCWE-400 — Uncontrolled Resource ConsumptionCWE-89 — SQL InjectionCWE-444 — HTTP Request SmugglingCWE-1321 — Prototype PollutionCWE-130 — Improper Handling of Length Parameter InconsistencyCWE-763 — Release of Invalid Pointer or ReferenceCWE-787 — Out-of-bounds WriteCWE-416 — Use After FreeCWE-862 — Missing Authorization48 documents12 sources
Severity
8.2HIGHNVD
GHSA5.9
EPSS
2.2%
top 15.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 20
Latest updateDec 11
Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NExploitability: 2.8 | Impact: 4.7
Affected Packages2 packages
🔴Vulnerability Details
4GHSA▶
GHSA-7643-946g-hpgv: Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General)↗2022-05-24
CVEList▶
CVE-2021-2025: Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General)↗2021-01-20
📋Vendor Advisories
23Microsoft▶
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c.↗2022-07-12
Microsoft▶
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is↗2022-03-08
Microsoft▶
The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction which allows local users to obtain potent↗2022-02-08
Microsoft▶
A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw a local attacker with special user privilege can circumvent the verifier and may lea↗2022-02-08