CVE-2015-4846

CVE-2015-4846 affects Oracle E-Business Suite (notably 12.1.3/12.1.4) via the Applications Manager SQL Extensions. The root cause is an unfiltered input in SQL extensions (afamexts.sql), enabling SQL injection by an authenticated remote attacker to view/modify data. Exploitation is described in E...

CVE-2015-4846: Undefined Security Weakness

Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality and integrity via vectors related to SQL Extensions. NOTE: the previous information is from t...

PT-2015-2523

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4 Description The issue affects the confidentiality and integrity of the system, potentially allowing remote authenticated users to execute arbitrary SQL commands via a...

ManageEngine Applications Manager CommonAPIUtil removeMonitorFrmMG haid SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the haid parameter when processing requests using the removeMonitorFrmMG method of the CommonAPIUtil class. By sending crafted request messages, a remote...

ManageEngine Multiple Products It360SPUtil resIds SQL Injection

An SQL injection vulnerability has been reported in ManageEngine Applications Manager and ManageEngine IT360 MSP Edition. This vulnerability is due to the insufficient validation of user-supplied input when processing requests sent to the It360SPUtil class. A remote, unauthenticated attacker can...

The vulnerability of the Oracle E-Business Suite system for automating business processes allows a perpetrator to compromise data integrity.

The vulnerability of the Oracle Applications Manager sub-component of the Oracle E-Business Suite automation system is related to errors in the code. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the integrity of data...

Unspecified Vulnerability in Oracle E-Business Oracle Applications Manager Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. A security vulnerability exists in the Oracle Applications Manager component of Oracle E-Business Suite, which can be exploited by remote attackers to compromise system integrity...

ManageEngine Applications Manager CommonAPIUtil SyncMonitors haid SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the haid parameter when processing requests using the SyncMonitors method of the CommonAPIUtil class. A remote attacker can exploit this vulnerability to inject and...

CVE-2015-4765: Undefined Security Weakness

Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via vectors related to OAM Dashboard...

Oracle E-Business Multiple Vulnerabilities (July 2015 CPU)

The version of Oracle E-Business installed on the remote host is missing the July 2015 Oracle Critical Patch Update CPU. It is, therefore, affected by affected by vulnerabilities in the following components : - Oracle Application Object Library CVE-2015-2618 - Oracle Application Object Library...

ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the groupId parameter when processing requests using the getMGList method of the CommonAPIUtil class...

ManageEngine Applications Manager DowntimeSchedulerServlet 'TASKID' Blind SQLi

The remote host is running a version of ManageEngine Applications Manager that is affected by a blind SQL injection vulnerability due to improper validation of user-supplied input to the 'TASKID' parameter in the 'DowntimeSchedulerServlet' servlet. A remote attacker can exploit this flaw to execu...

ManageEngine Applications Manager IT360UtilitiesServlet SQLi

The remote host is running a version of ManageEngine Applications Manager that is affected by a SQL injection vulnerability due to improper validation of user-supplied input to the 'IT360UtilitiesServlet' servlet. A remote attacker can exploit this flaw to execute arbitrary SQL statements. Note...

ManageEngine Applications Manager FailOverHelperServlet 'fileName' Parameter Arbitrary File Disclosure

The version of ManageEngine Applications Manager running on remote web server is affected by a file disclosure vulnerability due to a failure to properly sanitize user-supplied input to the 'fileName' parameter of the FailOverHelperServlet script. A remote, unauthenticated attacker, using a craft...

ManageEngine Applications Manager Unsupported Version Detection

According to its self-reported version, the ManageEngine Applications Manager installed on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities...

ManageEngine Applications Manager CommonAPIUtil SyncMonitors haid SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SyncMonitors method of the CommonAPIUtil class. The issue lies i...

ManageEngine Applications Manager CustomerManagementAPI custId SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CustomerManagementAPI class. The issue lies in the failure to...

ManageEngine Applications Manager IT360UtilitiesServlet query SQL Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IT360UtilitiesServlet servlet. The issue lies in the ability to...

ManageEngine Applications Manager DowntimeSchedulerServlet TASKID SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DowntimeSchedulerServlet servlet. The issue lies in the failure ...

ManageEngine Applications Manager It360SPUtil resIds SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the It360SPUtil class. The issue lies in the failure to sanitize...