PT-2019-2306

Name of the Vulnerable Software and Affected Versions eLearning Server 4G affected versions not specified Description The issue is related to inadequate access control in the eLearning Server 4G system, allowing a remote attacker to modify a user's portfolio by altering the user id value in an HT...

Design/Logic Flaw

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7-17.12 and 18.8. Difficult to exploit vulnerability allows...

CVE-2019-2512

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7-17.12 and 18.8. Difficult to exploit vulnerability allows...

CVE-2019-2512

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7-17.12 and 18.8. Difficult to exploit vulnerability allows...

Oracle Primavera P6 Enterprise Project Portfolio Management Access Control Error Vulnerability

Oracle Construction and Engineering Suite is a suite of portfolio management solutions for construction projects from Oracle Corporation.Primavera P6 Enterprise Project Portfolio Management P6 is one of the components for planning, managing and executing projects. Primavera P6 Enterprise Project...

PT-2019-1335

Name of the Vulnerable Software and Affected Versions Primavera P6 Enterprise Project Portfolio Management versions 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 through 17.12, 18.8 Description The issue is related to insufficient access control in the Web Access component, allowing an unauthenticated attack...

CVE-2019-2512: Undefined Security Weakness

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7-17.12 and 18.8. Difficult to exploit vulnerability allows...

500 Million Marriott Guest Records Stolen in Starwood Data Breach

The world's biggest hotel chain Marriott International today disclosed that unknown hackers compromised guest reservation database its subsidiary Starwood hotels and walked away with personal details of about 500 million guests. Starwood Hotels and Resorts Worldwide was acquired by Marriott...

Pagekit Bixie Portfolio plugin cross-site scripting vulnerability

Pagekit is a modular, lightweight CMS Content Management System.Bixie Portfolio plugin is used in one of the portfolio plugins. A cross-site scripting vulnerability exists in version 1.2.0 of the Pagekit Bixie Portfolio plugin. A remote attacker can exploit this vulnerability to inject arbitrary...

CVE-2018-3241

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows...

CVE-2018-3241

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows...

CVE-2018-3281

CVE-2018-3281 affects Oracle Primavera P6 Enterprise Project Portfolio Management Web Access across versions 8.4, 15.1, 15.2, 16.1, 16.2, 17.7–17.12 and 18.8. The vulnerability allows unauthenticated remote HTTP access to compromise P6 EPPM; attacks require user interaction and can lead to unauth...

Unspecified Vulnerability in Oracle Primavera P6 Enterprise Project Portfolio Management (CNVD-2018-24257)

Oracle Construction and Engineering Suite is a suite of portfolio management solutions for construction projects from Oracle Corporation.Primavera P6 Enterprise Project Portfolio Management P6 is one of the components for planning, managing and executing projects. Primavera P6 Enterprise Project...

CVE-2018-3281: Undefined Security Weakness

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows...

CVE-2018-3241: Undefined Security Weakness

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows...

PT-2018-2370

Name of the Vulnerable Software and Affected Versions Primavera P6 Enterprise Project Portfolio Management versions 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 through 17.12, 18.8 Description The issue is related to insufficient access control in the Web Access component, allowing an unauthenticated attack...

PT-2018-2373

Name of the Vulnerable Software and Affected Versions Primavera P6 Enterprise Project Portfolio Management versions 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 through 17.12, 18.8 Description The issue is related to inadequate access control in the Web Access component, allowing an unauthenticated attacker...

Code injection

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...

CVE-2018-18087

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...

CVE-2018-18087

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...