CVE-2019-2550: Undefined Security Weakness

Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications subcomponent: Logoff Page. The supported version that is affected is 12.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

PT-2019-1240

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.55 through 8.57 Description The issue is related to inadequate access control in the Portal component of Oracle PeopleSoft Enterprise PeopleTools. It allows a remote attacker to gain unauthorized...

PT-2019-1241

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise SCM eProcurement version 9.2 Description The issue is related to inadequate access control in the PeopleSoft Enterprise SCM eProcurement component, specifically in the Manage Requisition Status subcomponent. This easily...

PT-2019-1242

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise CC Common Application Objects version 9.2 Description The issue is related to inadequate access control in the PeopleSoft Enterprise CC Common Application Objects component, specifically in the Form and Approval Builder...

PT-2019-1186

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8 Description The issue is related to inadequate access control in the Oracle One-to-One Fulfillment component, specifically the OCM Query subcomponent. This...

PT-2019-1254

Name of the Vulnerable Software and Affected Versions Oracle Argus Safety versions 8.1 and 8.2 Description The issue is related to inadequate access control in the Oracle Argus Safety component, specifically in the Console subcomponent. It allows an unauthenticated attacker with network access vi...

PT-2019-1252

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.3 Description The issue is related to inadequate access control in the WLS Core Components subcomponent of Oracle WebLogic Server, allowing an unauthenticated attacker with network...

PT-2019-1317

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Portal versions 11.1.1.9.0 through 12.2.1.3.0 Description The issue is related to inadequate access control in the WebCenter Spaces Application component of Oracle WebCenter Portal, allowing an unauthenticated attacker with...

The vulnerability of the Core sub-component of the Oracle VM VirtualBox allows a intruder to gain unauthorized access to protected data.

The vulnerability of the Core sub-component of the Oracle VM VirtualBox is related to insufficient access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected data...

PT-2019-1136 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue exists due to inadequate protection of the web page structure. An attacker could exploit this by sending a specially crafted request to the vulnerable server,...

CVE-2018-1000869

phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to hav...

CVE-2018-20301

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints e.g., creating, editing, updating allow users to update any coherencefields data. For example, users can automatically confirm their accounts ...

The vulnerability of the rfbProcessClientNormalMessage() function in the cross-platform library LibVNCServer allows a hacker to trigger a service denial and gain unauthorized access to confidential data.

The vulnerability of the rfbProcessClientNormalMessage function in the cross-platform library LibVNCServer is related to insufficient cleaning of input data in VNC packets. Exploiting this vulnerability can allow an attacker to cause service failures and gain unauthorized access to confidential...

PT-2018-4013 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle iStore versions 12.1.1 through 12.1.3 Oracle iStore versions 12.2.3 through 12.2.8 Description: The issue is related to the Shopping Cart component of Oracle iStore in Oracle E-Business Suite. It allows an unauthenticated attacker with...

PT-2018-3535

Name of the Vulnerable Software and Affected Versions: HAProxy versions through 1.8.14 Description: An out-of-bounds read issue in the dns validate dns response function in dns.c allows remote attackers to potentially read unauthorized data from the stack or past the end of the buffer, depending ...

PT-2019-16459

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.7.23 and prior Description The issue allows a low privileged attacker with network access via multiple protocols to compromise the MySQL Server, resulting in unauthorized update, insert, or delete access to some of the...

PT-2018-18584 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: An elevation of privilege issue exists due to improper sanitization of specially crafted web requests. This could allow an attacker to perform cross-site scripting...

OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with...

PT-2018-14523

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server version 11.1 Description The issue allows a user to bypass Fine Grained Access Control FGAC and gain access to data they should not be able to see. Recommendations For IBM DB2 for...

OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...