CVE-2019-2653

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite subcomponent: Print Server. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker...

CVE-2019-2643

CVE-2019-2643 affects Oracle E-Business Suite, specifically the Trade Management component (UI). Affected versions include 12.1.1, 12.1.2, 12.1.3, 12.2.3–12.2.8. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management; attacks requir...

CVE-2019-2652

CVE-2019-2652 affects Oracle E-Business Suite iStore, Shopping Cart subcomponent. Vulnerable in supported E-Business Suite versions 12.1.1–12.2.8; attack surface is Oracle iStore via HTTP. The vulnerability allows an unauthenticated remote attacker with network access to compromise iStore and may...

CVE-2019-2615

CVE-2019-2615 affects Oracle WebLogic Server (WLS Core Components) with vulnerable versions 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. The issue allows a high-privilege attacker with network access via HTTP to access data on the WebLogic Server, per Red Hat and NVD records; CVSS 3.0 base score 4.9 (C...

CVE-2019-2604

The CVE-2019-2604 entry concerns a vulnerability in the Oracle Marketing subcomponent of Oracle E-Business Suite (Marketing Administration). Affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. The issue allows an unauthenticated attacker with network access via...

CVE-2019-2598

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: SQR. Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2019-2600

Vulnerability in the Oracle Email Center component of Oracle E-Business Suite subcomponent: Message Display. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-2590

CVE-2019-2590 affects Oracle PeopleSoft HCM Talent Acquisition Manager (Job Opening) in version 9.2. Vulnerable component and root cause: unauthenticated access via HTTP leading to potential unauthorized data access and data modification, with CVSS v3.0 base score 8.2 (Confidentiality High, Integ...

CVE-2019-2588

CVE-2019-2588 affects Oracle BI Publisher (XML Publisher) within Oracle Fusion Middleware. The NUCLEI template confirms a path traversal vulnerability in BI Publisher Security affecting versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0. An attacker could exploit a vulnerability in the BI Publisher ...

CVE-2019-2565

Vulnerability in the JD Edwards World Technical Foundation component of Oracle JD Edwards Products subcomponent: Service Enablement. Supported versions that are affected are A9.2, A9.3.1 and A9.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2565

Vulnerability in the JD Edwards World Technical Foundation component of Oracle JD Edwards Products subcomponent: Service Enablement. Supported versions that are affected are A9.2, A9.3.1 and A9.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2018-3314

The CVE-2018-3314 entry affects Oracle Retail Applications MICROS Relate CRM Software, Customer subcomponent, version 11.4. The vulnerability description indicates a network-accessible issue via HTTP that could allow a low-privilege attacker to unauthorizedly create, modify, or delete data, impac...

CVE-2018-3123

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: libmysqld. Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2018-2880

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. The supported version that is affected is 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successful attacks...

CVE-2019-2616

Vulnerability in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access...

Unspecified Vulnerability in Oracle Virtualization VM VirtualBox Component (CNVD-2019-36159)

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Experts: Breach at IT Outsourcing Giant Wipro

Indian information technology IT outsourcing and consulting giant Wipro Ltd. NYSE:WIT is investigating reports that its own IT systems have been hacked and are being used to launch attacks against some of the company's customers, multiple sources tell KrebsOnSecurity. Wipro has refused to respond...

Facebook Caught Asking Some Users Passwords for Their Email Accounts

Facebook has been caught practicing the worst ever user-verification mechanism that could put the security of its users at risk. Generally, social media or any other online service asks users to confirm a secret code or a unique URL sent to the email address they provided for the account...

What Hacker History Can Tell Enterprises About Future Attack Strategy

There's an oft-quoted saying: "History repeats itself." For those that believe in the cyclical patterns that sometimes emerge over time, this aphorism definitely rings true. Today, we'll be applying this type of thinking to the cybercrime realm. Over the course of hacker history, numerous trends...

Default configuration

SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web interface without valid...