Design/Logic Flaw

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Preferences. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

Code injection

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: PIA Core Technology. Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2019-2709

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite subcomponent: Security. Supported versions that are affected are 6.3.7, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2019-2709

Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite subcomponent: Security. Supported versions that are affected are 6.3.7, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2019-2684

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2019-2671

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Preferences. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2019-2637

CVE-2019-2637 affects Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology) in versions 8.55, 8.56 and 8.57. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, with successful attacks potentially enabling una...

CVE-2019-2618

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

CVE-2017-11430

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

CVE-2017-11429 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

CVE-2017-11428

CVE-2017-11428 affects OneLogin Ruby-SAML up to version 1.6.0. The issue arises from improper use of XML DOM traversal and canonicalization results, allowing manipulation of SAML data without breaking the cryptographic signature and potentially bypassing authentication to SAML service providers. ...

PT-2019-7878 · Onelogin · Pythonsaml

Name of the Vulnerable Software and Affected Versions: OneLogin PythonSAML versions 2.3.0 and earlier Description: The issue may allow an attacker to manipulate SAML data without invalidating its cryptographic signature, potentially bypassing authentication to SAML service providers. This is due ...

Oracle Fusion Middleware WebLogic Server Access Control Error Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

MGASA-2019-0144 Updated koji packages fix security vulnerability

Multiple xmlrpc call handlers in Koji’s hub code contain SQL injection bugs. By passing carefully constructed arguments to these calls, an unauthenticated user can issue arbitrary SQL commands to Koji’s database. This gives the attacker broad ability to manipulate or destroy data CVE-2018-1002161...

Magento 2.1.x < 2.1.17 / 2.2.x < 2.2.8 / 2.3.x < 2.3.1 SQL Injection

The Magento application running on the remote web server is affected by a SQL injection vulnerability due to failing to properly sanitize the user-supplied 'from' and 'to' inputs to the 'prepareSqlCondition' function of the '\Magento\Framework\DB\Adapter\Pdo\Mysql' class. An unauthenticated, remo...

CVE-2019-6538

CVE-2019-6538 concerns Medtronic Conexus radio telemetry protocol lacking authentication/authorization. Connected sources (ICS advisory and coverage) specify the affected devices include MyCareLink Monitor (versions 24950/24952), CareLink Monitor (2490C), CareLink 2090 Programmer, and multiple Me...

Joomla Geommunity3es 1.4 SQL Injection

Exploit Title : Joomla Geommunity3es Components 1.4 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : nordmograph.com Software Download Link : nordmograph.com/extensions /index.php?option=comvirtuemart&view=productdetails...

Joomla FlexiContent 3.2.1.15 SQL Injection

Exploit Title : Joomla FlexiContent Components 3.2.1.15 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : flexicontent.org Software Download Link : github.com/FLEXIcontent/flexicontent-cck/archive/v3.2.1.15.zip Software...

Ncat TLS Listener

This host seems to be running an instance of Ncat that is listening over TLS. Ncat is an open source networking tool that can be used as a backdoor to allow unauthorized entry and control of the remote host An attacker may use it to steal your passwords, modify your data, and prevent you from...

Joomla EasyBookReloaded 3.3.2 SQL Injection

Exploit Title : Joomla EasyBookReloaded Components 3.3.2 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : joomla-extensions.kubik-rubik.de Software Download Link :...