PT-2022-18719

Name of the Vulnerable Software and Affected Versions FEBS-Security version 1.0 Description The issue allows attackers to access and modify users' personal information due to insecure permissions configured in the userid parameter at the "/user/getuserprofile" API endpoint. Recommendations For...

GL Accounts Component Access Modification

The vulnerability of the GL Accounts component of the Oracle Trade Management business platform is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain read, modify, add, or delete access to data using the HTTP protocol...

Enterprise Manager Base Platform Access Manipulation

The vulnerability of the Policy Framework component of the Enterprise Manager Base Platform is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain access to read, modify, add, or delete data...

Samples component Oracle WebLogic Server Data Access

The vulnerability of the Samples component of the Oracle WebLogic Server application server exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read data or modify data through HTTP requests...

Oracle WebLogic Server Unauthorized Access

The vulnerability of the Core server component of Oracle WebLogic Server is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete data, or to cause service failures using...

Oracle Configurator UI Servlet Data Access

The vulnerability of the UI Servlet component of the Oracle Configurator relates to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain access to read, modify, add, or delete data using the HTTP protocol over the network...

Expenses Component CurrencyOverride Unauthorized Access

The vulnerability of the Expenses component in the Oracle Project Costing calculation service’s CurrencyOverride feature is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to create, modify, o...

Primavera Portfolio Management Web API Unauthorized Access

The vulnerability of the Web API component of Primavera Portfolio Management software relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete data using network HTTP protoco...

IBM Security Verify Access: Input validation error vulnerability

IBM Security Verify Access ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT, and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...

Server MySQL Privilege Escalation

The vulnerability of the MySQL Server component’s Security: Privileges section relates to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain access to modify, add, or delete data using the MySQL network protocol...

Oracle Solaris Installer Privilege Escalation

The vulnerability of the Oracle Solaris operating system installer, related to errors in the code. Exploiting this vulnerability can allow an attacker to gain access to modify, add, delete data, or cause partial service failure...

CVE-2022-22311

IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens...

PeopleSoft Enterprise PeopleTools Optimization Framework Data Read/Modify

The vulnerability of the Optimization Framework component of the Oracle PeopleSoft Enterprise PeopleTools business application exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain read access to data or to modify, ad...

CVE-2022-26338

Delta Electronics DIAEnergie All versions prior to 1.8.02.004 has a blind SQL injection vulnerability exists in HandlerPagePKID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands...

MySQL Optimizer DoS Data Modification Deletion

The vulnerability of the MySQL Server component involves insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures or gain access to modify, add, or delete data using the MySQL network protocol...

Hardcoded credentials

ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data...

CVE-2022-25577

ALF-BanCO vulnerable: v8.2.5 and earlier use a hardcoded password to encrypt the SQLite database, enabling read/modify access if an attacker gains remote or local system access. Root cause: hardcoded credentials in the application; affected component is the ALF-BanCO data encryption path for the ...

CVE-2021-27474 Rockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous Function

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre...

CVE-2021-27474: Use of Potentially Dangerous Function

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre...

mysql: InnoDB unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...