CVE-2016-5504

The CVE-2016-5504 entry affects Oracle’s Agile Product Lifecycle Management for Process (PLM for Process) as part of Oracle Supply Chain Products Suite, specifically versions 6.1.0.4, 6.1.1.6, and 6.2.0.0. The vulnerability relates to the Supplier Portal component and enables local users to compr...

PT-2016-6492 · Oracle · Oracle Agile Product Lifecycle Management For Process

Name of the Vulnerable Software and Affected Versions: Oracle Agile Product Lifecycle Management for Process versions 6.1.0.4 through 6.2.0.0 Description: The issue affects confidentiality and is related to the Supplier Portal in the Oracle Agile Product Lifecycle Management for Process component...

Unspecified Vulnerability in Oracle Supply Chain Products Suite Oracle Agile Product Lifecycle Management for Process Component

Oracle Supply Chain is a suite of supply chain solutions from Oracle that provides value chain planning, value chain execution, product lifecycle management, and other functions.Oracle Agile Product Lifecycle Management PLM for Process is one of the A lifecycle management component. A local...

Shopify: XSS in SHOPIFY: Unsanitized Supplier Name can lead to XSS in Transfers Timeline

Hello I would like to report an XSS happening in Transfer Timeline because the Supplier Name input is not sanitized as it should! POC Set Supplier Name to " Create a Transfer with multiple items and cancel on of the items. Review the timeline In the timeline you will see You canceled items in a...

supplier.buncombecounty.org XSS vulnerability

Vulnerable URL: https://supplier.buncombecounty.org/sso/SSOServlet?locale=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown ...

Unspecified Vulnerability in Oracle PeopleSoft SCM Purchasing Supplier Change Component

Oracle PeopleSoft is a suite of enterprise human capital management solutions. An unspecified security vulnerability exists in the Oracle PeopleSoft SCM Purchasing Supplier Change component, which allows remote attackers to exploit the vulnerability to access data and modify it...

CVE-2016-0591

Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supplier Change...

CVE-2016-0591

Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supplier Change...

Code injection

Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supplier Change...

CVE-2016-0591

Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supplier Change...

tel-supplier-china.com XSS vulnerability

Open Bug Bounty ID: OBB-101358 Description| Value ---|--- Affected Website:| tel-supplier-china.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management Cross-Site Scripting Vulnerabilities

IBM Emptoris Supplier Lifecycle Management is a suite of supply chain lifecycle management programs from IBM in the United States. A cross-site scripting vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management allows remote attackers to inject arbitrary web...

IBM Emptoris Sourcing Information Disclosure Vulnerability

IBM Emptoris Sourcing is a suite of platforms from IBM USA for supplier sourcing decisions, examining cost, risk and performance, helping organizations get affordable prices and greater value from their suppliers. An information disclosure vulnerability exists in IBM Emptoris Sourcing that allows...

CVE-2015-5024

IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote authenticated users to obtain sensitive supplier-bid information via unspecified vectors...

Code injection

IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote authenticated users to obtain sensitive supplier-bid information via unspecified vectors...

CVE-2015-5024

IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote authenticated users to obtain sensitive supplier-bid information via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4iFix3, 10.0.2.x before 10.0.2.7iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0iFix1 allows remote attackers to inject arbitrary web script or HTML...

CVE-2015-4939

CVE-2015-4939 is an XSS vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management. Affected are IBM Emptoris products on 10.x releases prior to: 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1. The flaw...

CVE-2015-4939

Cross-site scripting XSS vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4iFix3, 10.0.2.x before 10.0.2.7iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0iFix1 allows remote attackers to inject arbitrary web script or HTML...

一采通电子采购系统任意文件上传Getshell #2

简要描述： 一采通电子采购系统任意文件上传Getshell 2 详细说明： 上传点 /Supplier/UploadFile.aspx 以吉利采购平台为例 http://.../Supplier/UploadFile.aspx 上传时抓包，修改两处 1.filename前面加\ 2.hidTrueName的值 shell：http://.../d.asp 漏洞证明： 其他例子还有 http://.../Supplier/UploadFile.aspx http://.../Supplier/UploadFile.aspx .../Supplier/UploadFile.aspx...