Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface). Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 2.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and Subscribe). Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows physical access to compromise Siebel CRM Integration. While the vulnerability is in Siebel CRM Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N).
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
| Version | Type | Source | Base | Exp | Imp |
|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | NVD | 7.5 | 3.9 | 3.6 |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 7.5 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Primary | cve.org | 5.3 | — | — |
| 3.1 | Secondary | NVD | 7.5 | 3.9 | 3.6 |
| 3.1 | Secondary | ENISA EUVD | 5.3 | — | — |
| 3.1 | Secondary | NVD | 5.3 | 3.9 | 1.4 |
| 3.1 | Secondary | GHSA | 5.3 | — | — |