CVE-2017-10152

CVE-2017-10152 affects Oracle WebLogic Server (Web Container) with vulnerable versions 10.3.6.0.0 and 12.1.3.0.0. The issue allows a low-privileged attacker who can reach the server over HTTP to compromise the WebLogic Server and potentially access all data exposed by it. The CVSSv3 base score is...

CVE-2017-10393

CVE-2017-10393 affects Oracle GlassFish Server Web Container in Oracle Fusion Middleware (versions 3.0.1 and 3.1.2). The vulnerability permits unauthenticated, network-accessible exploitation via HTTP, with human interaction required, leading to possible unauthorized updates/deletes and reads, pl...

CVE-2017-10271

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Security. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to...

CVE-2017-10034

CVE-2017-10034 affects Oracle BI Publisher (Core Formatting API) in Oracle Fusion Middleware. Affected versions: 11.1.1.7.0 and 11.1.1.9.0. The vulnerability allows unauthenticated, network-accessible exploitation over HTTP, with user interaction required, potentially leading to unauthorized acce...

CVE-2017-10259

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware subcomponent: Web Server Plugin. The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager...

CVE-2017-10271

CVE-2017-10271 is an input validation/deserialization flaw in Oracle WebLogic Server (WLS Security) that enables unauthenticated remote code execution. Affected products/versions per entries include Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, and 12.2.1.2.0. Public writeups and adv...

CVE-2017-10393

Removed by vendor...

CVE-2017-12579

An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion 4.0.24 and earlier allows a non-root user to obtain a root shell...

Design/Logic Flaw

An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion 4.0.24 and earlier allows a non-root user to obtain a root shell...

CVE-2017-12579

An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion 4.0.24 and earlier allows a non-root user to obtain a root shell...

CVE-2017-12579

The CVE concerns the HashiCorp Vagrant VMware Fusion plugin (vagrant-vmware-fusion) up to version 4.0.24, where an insecure SUID wrapper binary allows a non-root user to obtain a root shell. The root cause is described as a design/implementation flaw in the plugin’s handling of privileged operati...

CVE-2017-12579

An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion 4.0.24 and earlier allows a non-root user to obtain a root shell...

CVE-2017-10271 - Oracle WebLogic Server AsyncResponseService Deserialization Vulnerability

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Security. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to...

Critical Code Execution Flaw Patched in PeopleSoft Core Engine

Organizations that have their PeopleSoft installations exposed to the internet should pay special attention to a remote code execution vulnerability patched on Tuesday as part of Oracle’s massive quarterly Critical Patch Update. The flaw, CVE-2017-10366, allows an attacker to gain remote code...

Unspecified Vulnerability in Oracle iPlanet Web Server (CNVD-2017-33734)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's business innovation platform for enterprise and cloud environments, which provides middleware, software collections, etc. Oracle iPlanet Web Server is one of the Web servers designed specifically for medium and large enterpris...

Unspecified Vulnerability in Oracle GlassFish Server

Oracle Fusion Middleware Oracle Fusion Middleware is the United States Oracle Oracle company's set of business innovation platform for enterprise and cloud environments. The platform provides middleware, software collection and other functions. Oracle GlassFish Server is one of the components tha...

Hashicorp vagrant-vmware-fusion 4.0.24 Local Root Privilege Escalation

I have previously disclosed a couple of bugs in Hashicorp's vagrant-vmware-fusion plugin for vagrant. Unfortunately the 4.0.23 release which was supposed to fix the previous bug I reported didn't address the issue, so Hashicorp quickly put out another release - 4.0.24 - after that but didn't upda...

Unspecified Vulnerability in Oracle WebLogic Server (CNVD-2017-31500)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platform for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. Oracle WebLogic Server is one of the application server components for cloud and traditional...

Unspecified Vulnerability in Oracle WebCenter Content

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platform for enterprise and cloud environments from Oracle. The platform provides middleware, software collections and other features. oracle WebCenter Content is one of the enterprise content management solution...

Oracle Fusion Middleware Oracle Access Manager Component Information Disclosure Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a suite of business innovation platforms for enterprise and cloud environments from Oracle Corporation that provides middleware, software collections, and other capabilities.Oracle Access Manager is one of the components that provides identity...