CVE-2019-2605

CVE-2019-2605 affects Oracle Fusion Middleware’s Oracle Business Intelligence Enterprise Edition (Web Catalog) with affected versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows an unauthenticated attacker, over HTTP, to read data from the BI EE Web Catalog; exploitation is de...

CVE-2019-2605

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware subcomponent: Web Catalog. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network...

Lessons learned from the Microsoft SOC—Part 2: Organizing people

In the second post in our series, we focus on the most valuable resource in the security operations center SOC—our people. This series is designed to share our approach and experience with operations, so you can use what we learned to improve your SOC. In Part 1: Organization, we covered the SOC’...

CARBANAK Week Part One: A Rare Occurrence

It is very unusual for FLARE to analyze a prolifically-used, privately-developed backdoor only to later have the source code and operator tools fall into our laps. Yet this is the extraordinary circumstance that sets the stage for CARBANAK Week, a four-part blog series that commences with this...

CB TAU Threat Intelligence Notification: HopLight Campaign (Linked to North Korea) is Reusing Substantial Amount of Code

On April 10, 2019 the US Department of Homeland Security DHS released a Malware Analysis Report MAR-10135536-8 which detailed the trojan HopLight. HopLight has been linked to different North Korean DPRK campaigns also known as the Lazarus Group. The CB Threat Analysis Unit TAU has continued to...

Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection

Exploit Title: XXE in Oracle Business Intelligence and XML Publisher Date: 16.04.19 Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link: https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html Version: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Tested...

Oracle Business Intelligence / XML Publisher 12.2.1.4.0 - XML External Entity Injection Exploit

Exploit for windows platform in category web applications Exploit Title: XXE in Oracle Business Intelligence and XML Publisher Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link: https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html Version:...

Oracle Business Intelligence XML Publisher 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - XML External Entity Injection

Oracle Business Intelligence XML Publisher 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - XML External Entity Injection Exploit Title: XXE in Oracle Business Intelligence and XML Publisher Date: 16.04.19 Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link:...

Oracle Business Intelligence Directory Traversal

Exploit Title: Directory traversal in Oracle Business Intelligence Date: 16.04.19 Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link: https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html Version: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Tested on...

Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal Exploit

Exploit for windows platform in category web applications Exploit Title: Directory traversal in Oracle Business Intelligence Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link: https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html Version:...

Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal

Exploit Title: Directory traversal in Oracle Business Intelligence Date: 16.04.19 Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link: https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html Version: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Tested on...

Oracle Business Intelligence 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - Directory Traversal

Oracle Business Intelligence 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - Directory Traversal Exploit Title: Directory traversal in Oracle Business Intelligence Date: 16.04.19 Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link:...

A Mystery Agent Is Doxing Iran's Hackers and Dumping Their Code

Iranian intelligence seems to be getting its own taste of a Shadow Brokers-style leak of secrets...

Oracle BI Publisher Access Control Error Vulnerability (CNVD-2019-29192)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's Oracle business innovation platform for enterprise and cloud environments. The platform provides middleware, software collection and other functions. BI Publisher formerly known as XML Publisher is one of the reporting...

Oracle E-Business Suite Interaction Center Intelligence Component Access Control Error Vulnerability

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management and other functions. Interaction Center Intelligence ...

Oracle Fusion Middleware Business Intelligence Enterprise Edition Information Disclosure Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a suite of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collections and other features. business Intelligence Enterprise Edition is one of the components for the...

The vulnerability of SAP BusinessObjects Business Intelligence platform, related to the unlimited download of dangerous files, allows a hacker to execute arbitrary code.

The vulnerability of SAP BusinessObjects Business Intelligence platform is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Spear Phishing Campaign Targets Ukraine Government and Military; Infrastructure Reveals Potential Link to So-Called Luhansk People's Republic

In early 2019, FireEye Threat Intelligence identified a spear phishing email targeting government entities in Ukraine. The spear phishing email included a malicious LNK file with PowerShell script to download the second-stage payload from the command and control C&C server. The email was received...

Building the security operations center of tomorrow—better insights with compound detection

In the physical world, humans are fantastic at connecting low quality signals into high quality analysis. Consider speaking with someone in a crowded place. You may not hear every word they say, but because you are fluent in the language and can piece together context from the words, you can hear...

The Anatomy of Threat Hunting: What You Need to Know and Why

No big surprise here: cybercrime will keep causing a major slowdown in the years to come as the business world proceed with digitalization. Despite implementing all traditional measures to stay protected, organizations keep falling prey to impersonation, phishing, and malware. Scary enough? What’...