CVE-2018-3250

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services. The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Serve...

CVE-2018-3153

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: PIA Core Technology. Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2018-2911

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Java Server Faces. The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server...

PT-2018-16046

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Cruise Fleet Management version 9.0 Description The issue allows a low-privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management, resulting in unauthorized access to critical...

PT-2018-16047

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Cruise Fleet Management version 9.0 Description The issue allows a low-privileged attacker with logon access to the infrastructure to compromise Oracle Hospitality Cruise Fleet Management, resulting in unauthorized access to...

CVE-2018-3159: Undefined Security Weakness

Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications subcomponent: Sender and Receiver. The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where...

CVE-2018-3158: Undefined Security Weakness

Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications subcomponent: Emergency Response System. The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2018-3131: Undefined Security Weakness

Vulnerability in the Oracle Hospitality Gift and Loyalty component of Oracle Food and Beverage Applications. The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker having Report privilege with logon to the infrastructure where Oracle...

Anthem, Apple and the Pentagon: A Data-Breach Cornucopia

Like pumpkin spice and turning leaves, data breaches have become a theme for the fall. This season is shaping up to be no exception, with Anthem, Apple and, worryingly, the Pentagon all making headlines in the last few days. It is, of course, part of the “new normal” as cyberattackers continue to...

PT-2018-2259

Name of the Vulnerable Software and Affected Versions Oracle Identity Analytics version 11.1.1.5.8 Description The issue is related to insufficient access control in the Core Components subcomponent of Oracle Identity Analytics, allowing a low-privileged attacker with network access via HTTP to...

PT-2018-2234

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description The issue is related to inadequate access control in the Oracle Customer Interaction History component, specifically the Outcome-Result subcomponent. This allows an...

PT-2018-2365

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.55 through 8.56 Description The issue is related to inadequate access control in the Activity Guide component of Oracle PeopleSoft Enterprise PeopleTools. This can be exploited by a remote attacker ...

PT-2018-2232

Name of the Vulnerable Software and Affected Versions Oracle iLearning versions 6.1 through 6.2 Description The issue is related to inadequate access control in the Learner Administration component of Oracle iLearning, allowing an unauthenticated attacker with network access via HTTP to compromis...

PT-2018-2253

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11.3 Description The issue is related to insufficient access control in the LibKMIP component of Oracle Solaris, allowing an unauthenticated attacker with network access via multiple protocols to compromise the system...

CVE-2018-3180

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with...

CVE-2018-3883

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...

CVE-2018-3885

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The orderby parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger thes...

CVE-2018-3885

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The orderby parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger thes...

CVE-2018-3882

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger...

CVE-2018-3883

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...