CVE-2013-3583

Cross-site request forgery CSRF vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords...

CVE-2013-3584

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

CVE-2013-3583

The CVE-2013-3583 issue affects Corporater EPM Suite, specifically the saveProperties.html endpoint. It is a Cross-site Request Forgery (CSRF) vulnerability that enables an attacker to hijack an authenticated user’s session to perform password-change requests. The NVD entry lists a CVSS v2 base s...

CVE-2013-3584

The CVE-2013-3584 entry refers to a reflected Cross‑Site Scripting vulnerability in Corporater EPM Suite, exploitable via the vulnerable query string parameter customerId in an unspecified component. The CERT doc confirms this as part of CVE-2013-3584 and notes that injected HTML/script could be ...

PT-2013-4496

Name of the Vulnerable Software and Affected Versions Corporater EPM Suite affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the...

PT-2013-4495

Name of the Vulnerable Software and Affected Versions Corporater EPM Suite affected versions not specified Description A cross-site request forgery CSRF issue exists in the saveProperties.html file, allowing remote attackers to hijack the authentication of arbitrary users for requests that change...

CVE-2013-3583: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords...

CVE-2013-3584: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Corporater EPM Suite allows remote attackers to inject arbitrary web script or HTML via the customerId parameter to an unspecified component...

Corporater EPM Suite is vulnerable to cross-site request forgery and cross-site scripting

Overview Corporater EPM Suite contains cross-site request forgery CSRF CWE-352 and reflected cross-site scripting XSS CWE-79 vulnerabilities. Description CWE-352: Cross-Site Request Forgery CSRF- CVE-2013-3583Corporater EPM Suite contains a cross-site request forgery vulnerability on the...

Oracle Hyperion Financial Management TList6 - ActiveX Control Remote Code Execution

Oracle Hyperion Financial Management TList6 ActiveX Control Remote Code Execution Vulnerability tested against: Internet Explorer 8 Microsoft Windows Server 2003 r2 sp2 download url: http://www.oracle.com/technetwork/middleware/epm/downloads/index.html files tested: SystemInstaller-11121-win32.zi...

Oracle Hyperion Enterprise Performance Management arsqls24.dll缓冲区溢出漏洞

Oracle Hyperion Enterprise Performance Management是性能管理软件。 Oracle Hyperion Enterprise Performance Management在实现上存在安全漏洞，可被恶意用户利用控制用户系统。 在解析数据库连接字符串时，arsqls24.dll中存在边界错误。通过诱使用户打开特制的Hyperion Interactive Reporting Studio .oce文件造成栈缓冲区溢出。 Oracle Hyperion Enterprise Performance Management EPM 11.x 厂商补丁：...

Code injection

Unspecified vulnerability in the 1 PeopleSoft Enterprise FMS, 2 SCM, 3 EPM, 4 CRM, and 5 Campus Solutions components in Oracle PeopleSoft and JDEdwards Suite 8.9, 9.0, and 9.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors...

CVE-2010-3525

CVE-2010-3525 affects Oracle’s PeopleSoft and JD Edwards Suite (8.9–9.1) in the following components: FMS, SCM, EPM, CRM, and Campus Solutions. The vulnerability is described as an unspecified issue that allows a remote attacker who is authenticated to affect confidentiality and integrity via unk...