The vulnerability of the Android Mobile Authenticator App, a software solution for managing enterprise mobility, within the Oracle Mobile Security Suite, a software platform of Oracle Fusion Middleware, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Android Mobile Authenticator App, a software solution for managing enterprise mobility, within the Oracle Mobile Security Suite, a software platform from Oracle Fusion Middleware, is related to errors in processing input data. Exploiting this vulnerability can allow an...

Oracle JDeveloper Information Disclosure (July 2023 CPU)

The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by an information disclosure vulnerability as referenced in the July 2023 CPU advisory. The vulnerability is in the Oracle JDeveloper product of Oracle Fusion Middleware component...

Oracle Coherence (Jul 2023 CPU)

The 12.2.1.4.0 and 14.1.1.0.0 versions of Coherence installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Centralized Thirdparty Jars Eclipse Jetty. Supported...

Oracle Access Manager DoS (Jul 2023 CPU)

The version of Oracle Access Manager installed on the remote host is missing a security patch from the July 2023 CPU Advisory. It is, therefore, affected by denial of service vulnerability. Oracle Access Manager product of Oracle Fusion Middleware component: Centralized Thirdparty Jars...

Oracle WebCenter Sites (Jul 2023 CPU)

The 12.2.1.4.0 version of WebCenter Sites installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites XStream. The supported version...

Oracle Business Process Management Suite (Jul 2023 CPU)

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the July 2023 CPU advisory, including: - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware component:...

Oracle WebLogic Server (July 2023 CPU)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the July 2023 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...

Oracle HTTP Server (Jul 2023 CPU)

The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the Jul 2023 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: Thirdparty LibExpat. The supported version that is affected ...

Oracle Patch Tuesday, July 2023 Security Update Review

Oracle has released its third quarterly edition of Critical Patch Update, which contains a group of patches for 508 security vulnerabilities. Some of the vulnerabilities addressed this month impact more than one product. These patches address vulnerabilities in Oracle code and third-party...

Vulnerabilities fixed in Oracle Fusion Middleware

Vulnerabilities have been fixed in Oracle Fusion Middleware products. A malicious party can exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Administrator/Root rights Remote cod...

Directory Traversal

rswag-api is vulnerable to Directory Traversal. The vulnerability exists in the call function of middleware.rb, which allows an attacker to read arbitrary JSON and YAML files via directory traversal, because the library exposes a file that is not in the OpenAPI specification file...

CVE-2023-22040

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle...

CVE-2023-21994

Vulnerability in the Oracle Mobile Security Suite product of Oracle Fusion Middleware component: Android Mobile Authenticator App. Supported versions that are affected are Prior to 11.1.2.3.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communicati...

CVE-2023-22040

CVE-2023-22040 (Oracle WebLogic Server Core) affects Oracle WebLogic Server within Oracle Fusion Middleware. The publicly documented impact: on affected versions 12.2.1.4.0 and 14.1.1.0.0, a high-privileged attacker with network access via multiple protocols can compromise the server, potentially...

CVE-2023-22031

Oracle WebLogic Server (Oracle Fusion Middleware) CVE-2023-22031 affects WebLogic Server Core on versions 12.2.1.4.0 and 14.1.1.0.0. The vulnerability, exploitable over network via T3/IIOP, can cause a hang or frequent crash (complete DoS). CVSS 3.1 base score 4.4 (Medium) with Availability impac...

CVE-2023-21994

CVE-2023-21994 affects Oracle Fusion Middleware’s Oracle Mobile Security Suite (Android Mobile Authenticator App). Affected versions are prior to 11.1.2.3.1. The issue allows an unauthenticated attacker with access to the hardware’s physical communication segment to compromise the Mobile Security...

Oracle Fusion Middleware 安全漏洞

Oracle Fusion Middleware Oracle Fusion Middleware and Oracle WebLogic Server are both products of Oracle Corporation.Oracle Fusion Middleware is a business innovation platform for enterprise and cloud environments. The platform provides middleware, software collections, and more.Oracle WebLogic...

Oracle Fusion Middleware 安全漏洞

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle USA. The platform provides middleware, software collections, and other capabilities. A security vulnerability exists in the Oracle Mobile Security Suite...

Cross-Site Request Forgery (CSRF)

@vendure/core is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the defaultConfig because the cookie-session middleware is set to false which in most browsers is interpreted as the secure lax option, but in old browsers gets interpreted as the least secure option, whic...

Oracle Global Lifecycle Management (OPatch) (Jan 2023 CPU)

The installation of Oracle Global Lifecycle Management OPatch installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory. - Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware...