Investigation Regarding Misconfigured Microsoft Storage Location

October 28, 2022 update: Added a Customer FAQ section. Summary Summary Security researchers at SOCRadar informed Microsoft on September 24, 2022, of a misconfigured Microsoft endpoint. This misconfiguration resulted in the potential for unauthenticated access to some business transaction data...

Vulnerabilities fixed in Oracle Database Server

Vulnerabilities have been fixed in Oracle Database Server. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to sensitive data Orac...

CVE-2022-21606

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

CVE-2022-21606

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

CVE-2022-21606

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

Design/Logic Flaw

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

PT-2025-38020

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s CIFS implementation within the cifs create function. If CIFS shuts down, the transaction ID xid is not freed before returning, leading to an xid leak...

PT-2022-5178 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server version 19c Description: The issue exists due to insufficient protection of the web page structure in the Oracle Services for Microsoft Transaction Server component. This allows a remote attacker to potentially gain rea...

CVE-2022-21606

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

CVE-2022-21606: Improper Neutralization of Input During Web Page Generation

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

CVE-2022-21606

CVE-2022-21606 affects Oracle Database Server 19c, specifically the Oracle Services for Microsoft Transaction Server component on Windows. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Transaction Server component; exploitation requires human ...

Griefing of execute transaction sender

Lines of code Vulnerability details Description In function execute from BlurExchange contract there is a call of executeTokenTransfer function. The last one contains the following logic: function executeTokenTransfer address collection, address from, address to, uint256 tokenId, uint256 amount,...

PT-2022-34804 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.71 Description: The issue is related to a potential stack overflow in the mlxbf i2c smbus start transaction function. The actual impact and attack plausibility have not yet been proven. Recommendations: Fo...

PT-2022-34761

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.19.12 Description The issue is related to a potential stack overflow in the mlxbf i2c smbus start transaction function. The actual impact and attack plausibility have not yet been proven. Recommendations For...

CVE-2022-34308

IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437...

CVE-2022-34308

IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437...

PT-2025-53120

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the multi transaction new function within the AppArmor subsystem. Specifically, the variable t is not freed or passed out if copy from user fails, leading to a...

After pool is initialized, user can perform a sandwich attack through front-running and back-running mint transaction by calling swap function twice to manipulate initial price to be much different than market price and gain much more of output token than expected

Lines of code Vulnerability details Impact After the following initialize function is called, the pool does not own any of the tokens at that moment since the mint function below is not called yet. When the mint transaction is sent, a malicious user can notice it in the mempool and front-run it b...

PT-2025-38327

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists within the Btrfs file system related to quota management. Specifically, the issue occurs when enabling quotas, where a transaction commit is followed by setting t...

Security Bulletin: CICS Transaction Gateway for Multiplatforms

Abstract Multiple security vulnerablilities exist in the JREs shipped with CICS TG for client applications. CICS TG itself is not vulnerable to these risks but client side applications using the JREs might be. You will need to evaluate your own code to determine if you are vulnerable. Content...