CVE-2022-29936

CVE-2022-29936 concerns USU Oracle Optimization prior to 5.17. The vulnerability arises from Java deserialization of the file path /v2/quantum/save-data-upload-big-file, enabling remote code execution. Public descriptions specify that authenticated users (described as quantum users in some source...

CVE-2022-29934

Summary (CVE-2022-29934) : USU Oracle Optimization (pre-5.17.5) lacks Polkit authentication, enabling smartcollector users to gain root access via pkexec. This affects versions prior to 5.17.5 and is not an Oracle Corporation product. Impact (as documented) : local privilege escalation to root wi...

CVE-2022-29935

CVE-2022-29935 concerns USU Oracle Optimization before 5.17.5. Multiple sources describe an information-disclosure vulnerability where an attacker could discover quantum credentials via an agent-installer/download mechanism. Affected software: USU Oracle Optimization versions prior to 5.17.5. Roo...

CVE-2022-29937

CVE-2022-29937 affects USU Oracle Optimization before 5.17.5. Affected component: the Oracle Optimization agent. Root cause: authenticated DataCollection users can exploit command injection because some OS commands are blocked while commands like base64 decoding are not blocked, enabling shell ac...