PT-2013-2439

Name of the Vulnerable Software and Affected Versions IBM Data Growth Solution for Oracle E-business Suite versions 6.0 through 9.1 Description A cross-site request forgery CSRF issue exists, allowing remote authenticated users to hijack the authentication of arbitrary users. This occurs in the...

CVE-2013-0577: Undefined Security Weakness

The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote authenticated users to bypass intended access restrictions and create, modify, or delete documents or scripts via unspecified vectors...

CVE-2013-0580: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote authenticated users to hijack the authentication of arbitrary users...

CVE-2013-0579: Undefined Security Weakness

The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote attackers to impersonate arbitrary users by leveraging access to a legitimate user's web browser either 1 before or 2 after authentication...

PT-2013-4888 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.2.2 Description: The issue allows remote attackers to cause a denial of service, specifically memory consumption, via unspecified input that is converted to a symbol. This is related to the power and ipmi boot...

Department of Transport UK - SQL Injection Vulnerability

Document Title: =============== Department of Transport UK - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=732 Release Date: ============= 2013-08-28 Vulnerability Laboratory ID VL-ID: ==================================== 73...

Oracle Linux 5 : Important: / kernel (ELSA-2007-0705)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0705 advisory. 2.6.18-8.1.10.0.1.el5 - Fix bonding primary=ethX Bert Barbe IT 101532 ORA 5136660 - Add entropy module option to e1000/bnx2 John Sobecki ORA 6045759...

CVE-2013-2953

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 relies on the MD5 algorithm for signatures in X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof SSL servers via a crafted certificate...

CVE-2013-2954

The login page in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not limit the number of incorrect authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2013-2956

SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-2959

The Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not provide an encrypted session for transmitting login credentials, which allows remote attackers to obtain sensitive information by sniffing the network...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, related to a stored XSS issue...

Design/Logic Flaw

The Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not provide an encrypted session for transmitting login credentials, which allows remote attackers to obtain sensitive information by sniffing the network...

Sql injection

SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2955

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, related to a stored XSS issue...

CVE-2013-2954

The login page in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not limit the number of incorrect authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2013-2954

CVE-2013-2954 affects IBM InfoSphere Optim Data Growth for Oracle E-Business Suite (versions 6.0–9.1). The IBM bulletin documents an inadequate account lockout: the Optim E-Business Console login page does not limit consecutive incorrect authentication attempts, enabling potential brute-force acc...

CVE-2013-2955

The CVE-2013-2955 entry is supported by IBM’s Security Bulletin for IBM InfoSphere Optim Data Growth for Oracle E-Business Suite (versions 6.0–9.1 affected). Description: Stored Cross-Site Scripting via a crafted URL could cause an authenticated user to have their browser execute arbitrary script...

CVE-2013-2959

IBM's advisory for CVE-2013-2959 states that the IBM InfoSphere Optim Data Growth for Oracle E-Business Suite Console does not encrypt login credentials in transit, affecting versions 6.0 through 9.1. Exploitation could sniff credentials over the network. The root cause is unencrypted login traff...