SAP Gateway Remote Command Execution

Added: 05/07/2019 Background SAP Gateway is a development framework, which allows non-SAP applications to communicate with SAP applications. Problem SAP Gateway behavior depends on two parameters, aclmode and simmode. If SAP Gateway access control lists ACLs are configured aclmode=0, anonymous...

SAP Gateway Remote Command Execution

Added: 05/07/2019 Background SAP Gateway is a development framework, which allows non-SAP applications to communicate with SAP applications. Problem SAP Gateway behavior depends on two parameters, aclmode and simmode. If SAP Gateway access control lists ACLs are configured aclmode=0, anonymous...

The vulnerability of the “Security Management Center” component of the Dr.Web Enterprise Security Suite antivirus tool allows a hacker to gain access to protected information.

The vulnerability of the “Security Management Center” component of the Dr.Web Enterprise Security Suite antivirus tool is related to deficiencies in the document export mechanism. Exploiting this vulnerability allows a malicious actor to obtain information about the installed components of the...

The vulnerability of the “Security Management Center” component of the Dr.Web Enterprise Security Suite antivirus tool allows a hacker to gain access to protected information.

The vulnerability of the “Security Management Center” component of the Dr.Web Enterprise Security Suite antivirus tool is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain information about the installed...

Denial Of Service (DoS)

openjdk is vulnerable to denial of service. Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed...

The vulnerability of the WLS Core Components of Oracle WebLogic Server application servers allows attackers to modify, add, or delete data.

The vulnerability of Oracle WebLogic Server’s application server’s WLS core components is related to lack of access control mechanisms. Exploiting this vulnerability allows an attacker to remotely modify, add, or delete data using the HTTP protocol...

Code injection

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component...

'Highly Critical' Unpatched Zero-Day Flaw Discovered In Oracle WebLogic

A team of cybersecurity researchers today published a post warning enterprises of an unpatched, highly critical zero-day vulnerability in Oracle WebLogic server application that some attackers might have already started exploiting in the wild. Oracle WebLogic is a scalable, Java-based multi-tier...

CVE-2019-2615

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

CVE-2019-2645

CVE-2019-2645 affects Oracle WebLogic Server (WLS Core Components). Affected versions are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. The underlying issue allows an unauthenticated attacker with network access via T3 to compromise WebLogic Server, potentially taking over the server. CVSS v3.0 base sco...

CVE-2019-2615

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

CVE-2019-2618

CVE-2019-2618 affects Oracle WebLogic Server (WLS Core Components) in Oracle Fusion Middleware. Affected versions: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0. The issue is a directory traversal/file-upload flaw that can permit a high-privileged, unauthenticated or authenticated attacker over HTTP to writ...

CVE-2019-2568

CVE-2019-2568 affects Oracle WebLogic Server (WLS Core Components) and is applicable to WebLogic versions 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. The issue is a network-accessible vulnerability that allows a low-privilege, unauthenticated or low-privilege attacker with HTTP access to compromise th...

The vulnerability of the WLS Core Components of the Oracle WebLogic Server application server allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the WLS Core Components of the WebLogic Server application server is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the T3 protocol...

Oracle WebLogic remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net

2019 04 on 17 May, the National information security vulnerabilities sharing platform CNVD official released a security Bulletin called Oracle WebLogic wls9-async components deserialization of a remote command execution vulnerability, an attacker can use this vulnerability, unauthorized remote...

Security Update for Microsoft Office (Apr 2019) (macOS)

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in...

Oracle WebLogic Server high-risk security vulnerability alerts-a vulnerability alert-the black bar safety net

2019 04 May 17, 360CERT detection to the Oracle in 4 December 17 release of the security Bulletin. The security Bulletin disclosed the WebLogic Server there are multiple high-risk vulnerabilities that affect multiple WebLogic components. 360CERT it is determined that the security updates for...

Drupal Releases Core CMS Updates to Patch Several Vulnerabilities

Drupal, the popular open-source content management system, has released security updates to address multiple "moderately critical" vulnerabilities in Drupal Core that could allow remote attackers to compromise the security of hundreds of thousands of websites. According to the advisories publishe...

Oracle WebLogic Server Component Information Disclosure Vulnerability (CNVD-2019-27110)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

openSUSE Security Update : SDL (openSUSE-2019-1213)

This update for SDL fixes the following issues: Security issues fixed: - CVE-2019-7572: Fixed a buffer over-read in IMAADPCMnibble in audio/SDLwave.c.bsc1124806. - CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMAADPCM in audio/SDLwave.c bsc1125099. - CVE-2019-7576: Fixed heap-based...