CVE-2013-5636

The CVE-2013-5636 issue affects Check Point Endpoint Security (E80.50) with Media Encryption EPM Explorer’s Unlock.exe. The root cause is that password failure events are not associated with a device ID, enabling physically proximate attackers to bypass device-lock protection by overwriting DVREM...

CVE-2013-5636: Undefined Security Weakness

Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of...

CVE-2013-5635: Undefined Security Weakness

Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.e...

Check Point response to Media Encryption EPM Explorer lockout bypass (CVE-2013-5635 and CVE-2013-5636)

...

CVE-2013-3583

Cross-site request forgery CSRF vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords...

CVE-2013-3584

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

CVE-2013-3584

The CVE-2013-3584 entry refers to a reflected Cross‑Site Scripting vulnerability in Corporater EPM Suite, exploitable via the vulnerable query string parameter customerId in an unspecified component. The CERT doc confirms this as part of CVE-2013-3584 and notes that injected HTML/script could be ...

CVE-2013-3583

Cross-site request forgery CSRF vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords...

CVE-2013-3584

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

CVE-2013-3583

The CVE-2013-3583 issue affects Corporater EPM Suite, specifically the saveProperties.html endpoint. It is a Cross-site Request Forgery (CSRF) vulnerability that enables an attacker to hijack an authenticated user’s session to perform password-change requests. The NVD entry lists a CVSS v2 base s...

CVE-2013-3583: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords...

CVE-2013-3584: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

Corporater EPM Suite is vulnerable to cross-site request forgery and cross-site scripting

Overview Corporater EPM Suite contains cross-site request forgery CSRF CWE-352 and reflected cross-site scripting XSS CWE-79 vulnerabilities. Description CWE-352: Cross-Site Request Forgery CSRF- CVE-2013-3583Corporater EPM Suite contains a cross-site request forgery vulnerability on the...

Oracle Hyperion Financial Management TList6 - ActiveX Control Remote Code Execution

Oracle Hyperion Financial Management TList6 ActiveX Control Remote Code Execution Vulnerability tested against: Internet Explorer 8 Microsoft Windows Server 2003 r2 sp2 download url: http://www.oracle.com/technetwork/middleware/epm/downloads/index.html files tested: SystemInstaller-11121-win32.zi...

Oracle Hyperion Enterprise Performance Management arsqls24.dll缓冲区溢出漏洞

Oracle Hyperion Enterprise Performance Management是性能管理软件。 Oracle Hyperion Enterprise Performance Management在实现上存在安全漏洞，可被恶意用户利用控制用户系统。 在解析数据库连接字符串时，arsqls24.dll中存在边界错误。通过诱使用户打开特制的Hyperion Interactive Reporting Studio .oce文件造成栈缓冲区溢出。 Oracle Hyperion Enterprise Performance Management EPM 11.x 厂商补丁：...

Code injection

Unspecified vulnerability in the 1 PeopleSoft Enterprise FMS, 2 SCM, 3 EPM, 4 CRM, and 5 Campus Solutions components in Oracle PeopleSoft and JDEdwards Suite 8.9, 9.0, and 9.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors...

CVE-2010-3525

CVE-2010-3525 affects Oracle’s PeopleSoft and JD Edwards Suite (8.9–9.1) in the following components: FMS, SCM, EPM, CRM, and Campus Solutions. The vulnerability is described as an unspecified issue that allows a remote attacker who is authenticated to affect confidentiality and integrity via unk...