CVE-2023-21981

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search. Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

Code injection

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search. Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2023-21981

CVE-2023-21981 affects Oracle PeopleSoft Enterprise PeopleTools (Elastic Search) with vulnerable versions 8.58–8.60. Root cause: insufficient input validation in Elastic Search leading to remote, network-based exploitation. Impact per sources: unauthorized access to protected data or full access ...

PT-2023-2673 · Oracle · Peoplesoft Enterprise Peopletools

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise PeopleTools versions 8.58 through 8.60 Description: The issue exists due to insufficient input validation in the Elastic Search component of Oracle PeopleSoft Enterprise PeopleTools. This allows a remote attacker to gain...

Kibana ESA-2023-02

Kibana versions before 7.17.9 and 8.6.1 have vulnerability CVE-2022-38900 in one of Kibana's implementation of decode-uri-component, which is vulnerable to Improper Input Validation, which could allow an authenticated attacker to perform a request that crashes the Kibana server process...

The vulnerability of the Elastic Search component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a perpetrator to gain unauthorized access to protected data or to modify, add, or delete protected data.

The vulnerability of the Elastic Search component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected data or to modify, add, or...

CVE-2023-21844

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2023-21844

CVE-2023-21844 affects Oracle PeopleSoft Enterprise PeopleTools, specifically the Elastic Search component in versions 8.59–8.60. The root cause is insufficient input validation in Elastic Search, enabling a low-privilege, network-accessible attacker (HTTP) to cause unauthorized update/insert/del...

CVE-2022-21639

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2022-21639

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2022-21639

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

Code injection

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2022-21639

CVE-2022-21639 affects Oracle PeopleSoft Enterprise PeopleTools with Elastic Search Integration (versions 8.59–8.60). An unauthenticated attacker can exploit over HTTP; Human interaction is required. Impact includes unauthorized data updates/inserts/deletes and reads. CVSS v3.1 base score 6.1 (Co...

CVE-2022-21639

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

This Week in Spring - August 16th, 2022

Hi, Spring fans! Welcome to another wonder-filled installment of This Week in Spring! Its been a week! Sometimes I can scarcely believe it myself. And can you believe its August 16th already?? My daughters starting school this week! Were in the northern hemisphere, and Summer break is already ove...

GHSA-MP9R-RH95-F8F8 Magento 2 Community Edition RCE Vulnerability

Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...

Magento 2 Community Edition RCE Vulnerability

Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...

Security Bulletin: Vulnerability in Apache Log4j affects the components (Elastic Search and Hadoop) of IBM Financial Crimes Insight for Claims Fraud

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Financial Crimes Insight for Claims Fraud for generating logs in some of its components. This bulletin provides mitigations for the Log4Shell vulnerability CVE-2021-44228 by applying the applicable workaround ste...

Elastic 安全漏洞

Elastic is the Netherlands Elastic company's set of open source distributed RESTful search engine built on Lucene . The product is mainly used in cloud computing and supports data indexing using JSON over HTTP. A security vulnerability exists in Elastic search.Elastic Elastic search may allow a...

CVE-2021-22997

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...