Oracle Optimization vulnerabilities

3 known vulnerabilities in Oracle Optimization from Usu. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Oracle Optimization: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-29937Apr 29, 2022UsuEPSS 1.52%

  USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (for example) an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation

• 8.8 High severity

  Oracle Optimization: Deserialization of Untrusted Data

  CVE-2022-29936Apr 29, 2022UsuEPSS 2.21%

  USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product.

• 7.8 High severity

  Oracle Optimization: Missing Authentication for Critical Functionality

  CVE-2022-29934Apr 29, 2022Usu

  USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product.