NCSC | Beveiligingsadviezen
Bekijk RSS-feed

Beveiligingsadviezen

Download

Beveilingsadvies; NCSC-2026-0027 [1.0.0]

Beveiligingsadvies
NCSC-2026-0027 [1.0.0]
Publicatie
21-01-2026 11:08 (Europe/Amsterdam)
Prioriteit
Normaal
Betreft
Kwetsbaarheden verholpen in Oracle Fusion Middleware

Kenmerken

  • Improper Input Validation
  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • Improper Control of Generation of Code ('Code Injection')
  • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
  • Improper Output Neutralization for Logs
  • Improper Restriction of Operations within the Bounds of a Memory Buffer
  • Heap-based Buffer Overflow
  • Out-of-bounds Read
  • Improper Neutralization of Escape, Meta, or Control Sequences
  • Generation of Error Message Containing Sensitive Information
  • Unchecked Return Value
  • Improper Access Control
  • Improper Authorization
  • Authentication Bypass by Alternate Name
  • Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • Uncontrolled Resource Consumption
  • Improper Resource Shutdown or Release
  • Use of Uninitialized Variable
  • NULL Pointer Dereference
  • Improper Restriction of XML External Entity Reference
  • Uncontrolled Recursion
  • Allocation of Resources Without Limits or Throttling
  • Out-of-bounds Write
  • Improper Control of Document Type Definition
  • Access of Resource Using Incompatible Type ('Type Confusion')
  • Incorrect Authorization
  • Server-Side Request Forgery (SSRF)
  • CWE-937
  • CWE-1035

Omschrijving

Oracle heeft kwetsbaarheden verholpen in verschillende producten, waaronder Oracle HTTP Server, Oracle WebLogic Server, en Oracle Fusion Middleware.

De kwetsbaarheden in de Oracle producten stellen ongeauthenticeerde aanvallers in staat om toegang te krijgen tot gevoelige gegevens, Denial-of-Service (DoS) aanvallen uit te voeren, en de integriteit van systemen te compromitteren. Specifieke kwetsbaarheden omvatten onjuist beheer van HTTP-headers, ongecontroleerde recursie, en onvoldoende bufferbeperkingen, wat kan leiden tot systeemcrashes en gegevensverlies.

Oplossingen

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Referenties

CVE's

Producten

Oracle
Data Integrator
Fusion Middleware
Identity Manager Connector
Managed File Transfer
Oracle Business Process Management Suite
Oracle Coherence
Oracle Global Lifecycle Management NextGen OUI Framework
Oracle HTTP Server
Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
Oracle Identity Manager
Oracle Outside In Technology
Oracle SOA Suite
Oracle Security Service
Oracle Service Bus
Oracle Unified Directory
Oracle WebCenter Enterprise Capture
Oracle WebLogic Server
Oracle Weblogic Server Proxy Plug-in
Service Delivery Platform
WebCenter Sites

Disclaimer

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.