Design/Logic Flaw

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: DB Privileges. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applicati...

Code injection

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Knowledge...

Design/Logic Flaw

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Engineering Change Order. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed...

Buffer overflow

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite component: CRM User Management Framework. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Buffer overflow

Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite component: Outcome-Result. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Custom...

CVE-2024-20958

CVE-2024-20958 affects Oracle E-Business Suite, specifically Oracle Installed Base (Engineering Change Order) in versions 12.2.3–12.2.13. The root cause is insufficient input validation in Engineering Change Order within Installed Base, enabling a low-privilege, network-accessible attacker to lev...

CVE-2024-20951

CVE-2024-20951 affects Oracle E-Business Suite, Oracle Customer Interaction History (component: Outcome-Result). Affected versions are 12.2.3–12.2.13. The vulnerability can be exploited by an unauthenticated attacker over HTTP with network access; however, successful exploitation requires user in...

CVE-2024-20949

CVE-2024-20949 affects Oracle E-Business Suite, Oracle Customer Interaction History (Outcome-Result) in versions 12.2.3–12.2.13. An unauthenticated attacker with network access via HTTP can exploit this after user interaction to perform unauthorized updates, inserts, deletes, and reads of data. A...

CVE-2024-20943

Affected software: Oracle E-Business Suite, Oracle Knowledge Management (Internal Operations), versions 12.2.3–12.2.13. Issue type/root cause: insufficient input validation in Oracle Knowledge Management, enabling a low-privileged attacker with network access via HTTP to compromise the system; at...

CVE-2024-20947

CVE-2024-20947 affects Oracle E-Business Suite, Oracle Common Applications (CRM User Management Framework) and impacts version 12.2.3–12.2.13. The vulnerability allows a low-privilege, network-access attacker (HTTP) to compromise Oracle Common Applications with user interaction required. Conseque...

CVE-2024-20941

The CVE-2024-20941 vulnerability affects Oracle E-Business Suite, specifically the Oracle Installed Base component (HTML UI) in versions 12.2.3–12.2.13. An unauthenticated attacker with network access over HTTP can potentially compromise Installed Base, with impacts including unauthorized update/...

CVE-2024-20939

CVE-2024-20939 affects Oracle E-Business Suite, specifically the Oracle CRM Technical Foundation Admin Console, with versions 12.2.3–12.2.13 vulnerable. The issue is an input validation/logic flaw that allows a low-privilege, network-accessible attacker via HTTP to cause a partial denial of servi...

CVE-2024-20935

CVE-2024-20935 affects Oracle E-Business Suite, specifically the Oracle Installed Base component (Engineering Change Order). Affected versions are 12.2.3–12.2.13. The vulnerability allows an unauthenticated attacker, with network access via HTTP, to compromise data and perform unauthorized update...

CVE-2024-20933

CVE-2024-20933 affects Oracle E-Business Suite – Oracle Installed Base (Engineering Change Order) with affected versions 12.2.3–12.2.13. The vulnerability allows an unauthenticated attacker over HTTP to compromise Oracle Installed Base, with attacks requiring user interaction, and potentially lea...

CVE-2024-20929

The CVE-2024-20929 entry concerns Oracle E-Business Suite’s Oracle Application Object Library (AOL) with the vulnerable DB Privileges component. Affected versions are 12.2.3–12.2.13. It is exploitable by an unauthenticated attacker over HTTP with network access, enabling unauthorized update/inser...

CVE-2024-20915

CVE-2024-20915 affects Oracle E-Business Suite’s Oracle Application Object Library (AOL), Login - SSO component. Affected: AOL in E-Business Suite versions 12.2.3–12.2.13. Issue: insufficient input validation in the Login - SSO path allows an unauthenticated, network-accessible attacker (via HTTP...

CVE-2024-20907

Oracle E-Business Suite CVE-2024-20907 affects Oracle Web Applications Desktop Integrator (component: File download) in versions 12.2.3–12.2.13. The root cause is insufficient input validation in the file download component. The vulnerability allows an unauthenticated attacker, reachable over HTT...

Security Bulletin: A vulnerability in Apache Commons FileUpload affects IBM Tivoli Application Dependency Discovery Manager.

Summary Vulnerabilitiy in Apache Commons FileUpload affects IBM Tivoli Application Dependency Discovery Manager CVE-2023-24998. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of...

CVE-2024-25618

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers CAS, SAML, OIDC to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication...

Design/Logic Flaw

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers CAS, SAML, OIDC to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication...