Oracle Business Intelligence Enterprise Edition (January 2024 CPU)

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory, including the following: - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of...

AI likely to boost ransomware, warns government body

The British National Cyber Security Centre NCSC says it expects Artificial Intelligence AI to heighten the global ransomware threat. In a report, the NCSC makes the assessment that AI will almost certainly increase the volume and heighten the impact of cyberattacks over the next two years. We’re...

Introducing the Cloud Threat Landscape, a new TI resource for cloud defenders

The Cloud Threat Landscape is a threat intelligence database that summarizes cloud incidents and offers insights into targeting patterns and initial access methods...

ScarCruft Unleashes Tailored Attacks on Cybersecurity Frontlines

Summary: The ScarCruft APT group is actively targeting attacks on media organizations and individuals in the realm of threat intelligence. ScarCruft employs persistent tactics, using phishing emails to deliver RokRAT, a custom-designed backdoor. Threat Level - Amber | Attack Report For a detailed...

Oracle Business Intelligence Enterprise Edition Security Component Data Compromise

The vulnerability of the BI Platform Security component of the Oracle Business Intelligence Enterprise Edition exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of data...

Oracle Business Intelligence Enterprise Edition Visual Analyzer (Snappy) DoS

The vulnerability of the Visual Analyzer Snappy component of the Oracle Business Intelligence Enterprise Edition software platform is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Oracle Business Intelligence Enterprise Edition Pod Admin Disclosure

The vulnerability of the Pod Admin component of the Oracle Business Intelligence Enterprise Edition software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information that is protected b...

Iranian Hackers Masquerade as Journalists to Spy on Israel-Hamas War Experts

High-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the U.K., and the U.S. have been targeted by an Iranian cyber espionage group called Mind Sandstorm since November 2023. The threat actor "used bespoke phishing...

Vulnerabilities fixed in Oracle Analytics

Oracle has fixed vulnerabilities in several Analytics products. A malicious party could exploit the vulnerabilities to execute attacks that could result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data Access to sensitive data Oracle has...

New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs

Since November 2023, Microsoft has observed a distinct subset of Mint Sandstorm PHOSPHORUS targeting high-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the United Kingdom, and the United States. In this campaign,...

Oracle Business Intelligence Enterprise Edition Security Vulnerability

Oracle Business Intelligence Enterprise Edition is an intelligent business analytics software from Oracle. Visualize and analyze enterprise data to aid decision-making, reduce total cost of ownership, and increase ROI across the organization. A security vulnerability exists in Oracle Business...

CVE-2024-20904

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Pod Admin. Supported versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

CVE-2024-20904

CVE-2024-20904 affects Oracle Business Intelligence Enterprise Edition (pod Admin) versions 6.4.0.0.0 and 12.2.1.4.0. The issue arises from insufficient input validation in the Pod Admin component, allowing a low-privileged attacker with network access via HTTP to read a subset of data. Attacks m...

PT-2024-1162 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 6.4.0.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Pod Admin component of Oracle Business Intelligence Enterprise Edition. This can b...

PT-2024-1222 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 Description: The issue exists due to insufficient input validation in the BI Platform Security component. This allows a remote attacker to compromise the confidentiality and...

WIC1200 Cross-Site Request Forgery Vulnerability

The Xantech WIC1200 is a Web Intelligence Controller from Xantech. A cross-site request forgery vulnerability exists in the Xantech WIC1200 version 1.1, which stems from the lack of a proper CSRF token implementation and can be exploited by an attacker to perform unwanted actions...

CVE-2024-20904: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Pod Admin. Supported versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

Oracle Business Intelligence Enterprise Edition Security Vulnerability

Oracle Business Intelligence Enterprise Edition is an intelligent business analytics software from Oracle. Visualize and analyze enterprise data to aid decision-making, reduce total cost of ownership, and increase ROI across the organization. A security vulnerability exists in Oracle Business...

Wordfence Intelligence Weekly WordPress Vulnerability Report (January 1, 2024 to January 7, 2024)

Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now! Last week, there were 85 vulnerabilities disclosed in 74 WordPress Plugins and 2 WordPress themes that have been added to the Wordfence...

WordPress POST SMTP Mailer 2.8.7 Authorization Bypass / Cross Site Scripting

Vulnerability Summary from Wordfence Intelligence Description: POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress = 2.8.7 – Authorization Bypass via type connect-app API Affected Plugin: POST SMTP Mailer – Email log, Delivery Failure Notifications and Be...