Oracle Primavera Unifier 21.12

Prototype Pollution

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

XSS in the `of` option of the `.position()` util

XSS in the `altField` option of the Datepicker widget

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

NULL pointer deref in signature_algorithms processing

Timing Attack Vulnerability for Apache Kafka Connect and Clients

Possible limited path traversal vulnerabily in Apache Commons IO

Apache Tika Regular Expression Denial of Service in Standards Extractor

Apache Tika BPGParser Memory Usage DoS

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

Temp directory permission issue in Guava