Oracle Demantra 12.2.1 SQL Injection

Vulnerability title: SQL Injection in Oracle Demantra CVE: CVE-2014-0372 Vendor: Oracle Product: Demantra Affected version: 12.2.1 Fixed version: 12.2.3 Reported by: Oliver Gruskovnjak Details: The Oracle Demantra application is vulnerable to SQL injection. An attacker with access to the vulnerab...

Oracle Demantra 12.2.1 - Persistent Cross-Site Scripting

Oracle Demantra 12.2.1 - Persistent Cross-Site Scripting Details: The TaskSender area is vulnerable to a stored cross-site scripting vulnerability. Impact: An attacker could exploit this flaw to get active HTML or script code executed in an authenticated user’s browser. Cross-site Scripting may b...

Oracle Demantra 12.2.1 Arbitrary File Retrieval

Vulnerability title: Local File Inclusion in Oracle Demantra CVE: CVE-2013-5877 Vendor: Oracle Product: Demantra Affected version: 12.2.1 Fixed version: 10.1.1.2 Reported by: Oliver Gruskovnjak Details: A Local File Include LFI vulnerability has been discovered in Oracle Demantra. The vulnerabili...

Oracle Demantra 12.2.1 - Persistent Cross-Site Scripting

Details: The TaskSender area is vulnerable to a stored cross-site scripting vulnerability. Impact: An attacker could exploit this flaw to get active HTML or script code executed in an authenticated user’s browser. Cross-site Scripting may be used to perform attacks such as session hijacking by...

Oracle Demantra Database Credentials Leak

This module exploits a database credentials leak found in Oracle Demantra 12.2.1 in combination with an authentication bypass. This way an unauthenticated user can retrieve the database name, username and password on any vulnerable machine. Module Options msf use...

Oracle Demantra Arbitrary File Retrieval with Authentication Bypass

This module exploits a file download vulnerability found in Oracle Demantra 12.2.1 in combination with an authentication bypass. By combining these exposures, an unauthenticated user can retrieve any file on the system by referencing the full file path to any file a vulnerable machine. Module...

Buffer overflow

Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect integrity via unknown vectors related to DM Others...

Oracle Supply Chain Products Suite - Remote Security

source: https://www.securityfocus.com/bid/64836/info Oracle Supply Chain Products Suite is prone to a remote vulnerability in Oracle Demantra Demand Management. The vulnerability can be exploited over the 'HTTP' protocol. The 'DM Others' sub component is affected. Attackers can exploit this issue...