CVE-2020-2600

CVE-2020-2600 affects Oracle PeopleSoft Enterprise PeopleTools (Elastic Search) with affected versions 8.56 and 8.57. The vulnerability allows an unauthenticated remote attacker, over HTTP, to access and potentially modify PeopleSoft data due to a flaw in the Elastic Search component; successful ...

CVE-2020-2602

CVE-2020-2602 affects Oracle PeopleSoft Enterprise PeopleTools Tree Manager in 8.56 and 8.57. The vulnerability allows network access via HTTP to an unauthenticated attacker who can cause unauthorized updates, inserts or deletes to sensitive data and unauthorized reads to a subset of data; the CV...

CVE-2020-2585

Vulnerability in the Java SE product of Oracle Java SE component: JavaFX. The supported version that is affected is Java SE: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this...

CVE-2020-2567

The CVE-2020-2567 entry concerns Oracle Retail Customer Management and Segmentation Foundation (Security component) with affected version 18.0. The vulnerability is described as exploitable by a high-privilege attacker who can access over the network via HTTP; successful exploitation requires use...

CVE-2020-2537

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Analytics Actions. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

Unspecified Vulnerability in Oracle Enterprise Manager Base Platform (CNVD-2020-04364)

Oracle Enterprise Manager Base Platform is a complete installer that includes OMS, agents, repositories, and management plug-ins. An unspecified vulnerability exists in Oracle Enterprise Manager Base Platform. An attacker could exploit this vulnerability to gain unauthorized access to, update,...

Unspecified Vulnerability in Oracle Enterprise Manager Base Platform (CNVD-2020-04349)

Oracle Enterprise Manager Base Platform is a complete installer that includes OMS, agents, repositories, and management plug-ins. An unspecified vulnerability exists in Oracle Enterprise Manager Base Platform. An attacker could exploit this vulnerability to gain unauthorized access to, update,...

Unspecified Vulnerability in Oracle Enterprise Manager Base Platform (CNVD-2020-04377)

Oracle Enterprise Manager Base Platform is a complete installer that includes OMS, agents, repositories, and management plug-ins. An unspecified vulnerability exists in Oracle Enterprise Manager Base Platform. An attacker could exploit this vulnerability to gain unauthorized access to, update,...

Unspecified Vulnerability in Oracle Enterprise Manager Base Platform (CNVD-2020-04370)

Oracle Enterprise Manager Base Platform is a complete installer that includes OMS, agents, repositories, and management plug-ins. An unspecified vulnerability exists in Oracle Enterprise Manager Base Platform. An attacker could use this vulnerability to gain unauthorized access to, update, insert...

Unspecified Vulnerability in Oracle Enterprise Manager Base Platform (CNVD-2020-04359)

Oracle Enterprise Manager Base Platform is a complete installer that includes OMS, agents, repositories, and management plug-ins. An unspecified vulnerability exists in Oracle Enterprise Manager Base Platform. An attacker could exploit this vulnerability to gain unauthorized access to, update,...

Oracle E-Business Suite Unauthorized Access Vulnerability (CNVD-2020-04031)

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management and so on, a collection of management software, is a seamless integration of a management suite.Oracle Email Cent...

Unspecified Vulnerability in Oracle Enterprise Manager Base Platform (CNVD-2020-04371)

Oracle Enterprise Manager Base Platform is a complete installer that includes OMS, agents, repositories, and management plug-ins. An unspecified vulnerability exists in Oracle Enterprise Manager Base Platform. An attacker could exploit this vulnerability to gain unauthorized access to, update,...

Unspecified Vulnerability in Oracle Enterprise Manager Base Platform (CNVD-2020-04381)

Oracle Enterprise Manager Base Platform is a complete installer that includes OMS, agents, repositories, and management plug-ins. An unspecified vulnerability exists in Oracle Enterprise Manager Base Platform. An attacker could exploit this vulnerability to gain unauthorized access to, update,...

Oracle E-Business Suite Unauthorized Access Vulnerability (CNVD-2020-04032)

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management and so on, a collection of management software, is a seamless integration of a management suite.Oracle Email Cent...

CVE-2020-1767

CVE-2020-1767 affects OTRS Community Edition 6.0.x (up to 6.0.24) and OTRS 7.0.x (up to 7.0.13). Description: Agent A can save a draft; Agent B can open it, modify the text, and send it as Agent A, so customers see a message sent by the original agent. Debian/Nessus advisories indicate patches: u...

Thrive Smart Home v1.1 SQL Injection Authentication Bypass

Summary As smart home technology becomes more affordable and easy to install with services offered by Thrive Smart Homes, there are some great options available to give your home a high-tech makeover. If the convenience of feeding your cat or turning on your air conditioning with a tap on your...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

New Relic: NR-wide cross account access through misconfigured CORS-policy of multiple endpoints

Hey guys, While working at 746786, I've discovered a NewRelic-wide huge CORS-policy misconfiguration leading to cross-account data stealing and modification at a huge amount of endpoints. The vulnerability itself is that origin nr3.nr-assets.net is trusted NR-widely at many different endpoints, b...

Manipulating Machine Learning Systems by Manipulating Training Data

Interesting research: "TrojDRL: Trojan Attacks on Deep Reinforcement Learning Agents": Abstract:: Recent work has identified that classification models implemented as neural networks are vulnerable to data-poisoning and Trojan attacks at training time. In this work, we show that these training-ti...

CVE-2019-8159

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection...