Alexander Kornbrust

توجد ثغرة أمنية يصعب استغلالها في برنامج Oracle Zero Data Loss Recovery Appliance، وتحديدًا في مكون الأمان. يمكن لمهاجم غير معتمد لديه وصول إلى الشبكة عبر Oracle Net اختراق البرنامج. يتطلب استغلال هذه الثغرة تفاعلًا بشريًّا من شخص آخر غير المهاجم، وقد يؤدي إلى وصول غير مصرح به للقراءة إلى مجموعة فرعية من بيانات البرنامج.

توجد ثغرة أمنية في مكون JDBC الخاص بخادم قاعدة بيانات Oracle. تسمح هذه الثغرة، التي يصعب استغلالها، لمهاجم يتمتع بامتيازات محدودة وامتيازات مستخدم نظام التشغيل المصادق عليه، باختراق مكون JDBC. يتطلب الاستغلال الناجح تدخلًا بشريًّا من قبل شخص آخر غير المهاجم. وعلى الرغم من أن الثغرة موجودة في JDBC، إلا أن الهجمات قد تؤثر على منتجات أخرى. وقد تؤدي الهجمات الناجحة إلى الوصول غير المصرح به إلى البيانات الحساسة أو الوصول الكامل إلى جميع البيانات التي يمكن الوصول إليها عبر JDBC.

The issue affects the Oracle Database - Enterprise Edition Sharding component, allowing a low-privileged attacker with local logon privilege to compromise it. Successful attacks can result in the takeover of Oracle Database - Enterprise Edition Sharding and may have a significant impact on additional products.

The issue is related to insufficient input validation in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. This easily exploitable vulnerability allows a high-privileged attacker with Create Any Procedure privilege and network access via Oracle Net to compromise Oracle Database - Enterprise Edition Sharding, potentially resulting in a takeover.

The issue is related to insufficient input validation in the Core RDBMS component of Oracle Database Server. It allows a high-privileged attacker with Create Session and Execute Catalog Role privileges and network access via Oracle Net to compromise the Core RDBMS, resulting in unauthorized read access to a subset of Core RDBMS accessible data.

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c Description: The issue exists due to insufficient input validation in the Core RDBMS component of Oracle Database Server. This can be exploited by a remote attacker to impact the integrity of protected information. A successful attack can result in unauthorized access to update, insert, or delete some Core RDBMS accessible data. Recommendations: For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle Database Server version 19c Description: The issue exists due to insufficient input validation in the RDBMS Security component of Oracle Database Server. This allows a remote attacker to gain unauthorized access to protected information using the Oracle Net protocol stack. Successful attacks can result in unauthorized access to critical data or complete access to all RDBMS Security accessible data. Recommendations: For version 19c, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the Oracle Net protocol stack to minimize the risk of exploitation.

The issue is related to the implementation of the HTTP/2 mechanism in the Apache HTTP Server, which is associated with inconsistent interpretation of HTTP requests. This can allow a remote attacker to cause a denial of service. A specially crafted value for the `Cache-Digest` header in a HTTP/2 request would result in a crash when the server tries to HTTP/2 PUSH a resource afterwards.

The issue exists due to insufficient input validation in the Discovery and collection script component of Oracle Configuration Manager. This allows a remote attacker to gain unauthorized access to protected information, or modify, add, or delete data. The vulnerability can be exploited by a low-privileged attacker with network access via HTTP, potentially resulting in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data.

The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating.

The issue is related to insufficient access control in the Application Performance Management component of Oracle Enterprise Manager, specifically in the EM Request Monitoring module. This can be exploited by a remote attacker to gain unauthorized access to sensitive information or to modify, add, or delete data using the HTTP protocol. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, or the ability to update, insert, or delete data, as well as cause a partial denial of service.

The issue is related to a vulnerability in the Core RDBMS component of Oracle Database Server, which can be exploited by a high-privileged attacker with Create Session and Execute Catalog Role privileges. The attacker must have network access via Oracle Net. Successful attacks require human interaction from a person other than the attacker and can result in the takeover of Core RDBMS. This vulnerability is difficult to exploit and can be used by an attacker to compromise the Core RDBMS component.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 13.4 iPadOS versions prior to 13.4 macOS Catalina versions prior to 10.15.4 tvOS versions prior to 13.4 watchOS versions prior to 6.2 iTunes for Windows versions prior to 12.10.5 iCloud for Windows versions prior to 10.9.3 and 7.18 Description: A buffer overflow issue was addressed with improved bounds checking. This issue may allow a remote attacker to execute arbitrary code. The issue is related to the libxml2 library. Recommendations: For iOS versions prior to 13.4, update to iOS 13.4 or later. For iPadOS versions prior to 13.4, update to iPadOS 13.4 or later. For macOS Catalina versions prior to 10.15.4, update to macOS Catalina 10.15.4 or later. For tvOS versions prior to 13.4, update to tvOS 13.4 or later. For watchOS versions prior to 6.2, update to watchOS 6.2 or later. For iTunes for Windows versions prior to 12.10.5, update to iTunes for Windows 12.10.5 or later. For iCloud for Windows versions prior to 10.9.3 and 7.18, update to iCloud for Windows 10.9.3 or 7.18 or later.

The issue is related to insufficient access control in the Oracle Management Service component of the Enterprise Manager Base Platform. It can be exploited by a remote attacker to gain unauthorized access to protected information or cause a denial of service using the HTTP protocol. Successful attacks can result in unauthorized access to critical data, modification of some accessible data, or a partial denial of service.

The issue is related to insufficient access control in the Connector Framework component of Oracle Enterprise Manager Base Platform. This can be exploited by a remote attacker to gain unauthorized access to sensitive information or cause a denial of service via the HTTP protocol. Successful attacks can result in unauthorized access to critical data, modification of some accessible data, or a partial denial of service.

The issue is related to insufficient access control in the Job System component of Oracle Enterprise Manager Base Platform. It can be exploited by a remote attacker to gain unauthorized access to protected information or cause a denial of service using the HTTP protocol. Successful attacks can result in unauthorized access to critical data, update, insert, or delete access to some data, and the ability to cause a partial denial of service.

The issue is related to inadequate access controls in the Infrastructure component of Oracle FLEXCUBE Investor Servicing, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some data, as well as unauthorized read access to a subset of data.

The issue is related to inadequate access control in the Infrastructure component of Oracle FLEXCUBE Investor Servicing, allowing an attacker to compromise the system via HTTP protocol. Successful attacks can result in unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data.

The issue is related to insufficient access control in the Application Service Level Mgmt component of Oracle Enterprise Manager. It can be exploited by a remote attacker to gain unauthorized access to protected information or cause a denial of service using the HTTP protocol. Successful attacks can result in unauthorized access to critical data, update, insert, or delete access to some data, and the ability to cause a partial denial of service.

The issue is related to a component of the Enterprise Manager Base Platform product, specifically the Connector Framework, and is associated with inadequate access control. This allows a high-privileged attacker with network access via HTTP to compromise the Enterprise Manager Base Platform, resulting in unauthorized access to critical data, complete access to all accessible data, and the ability to update, insert, or delete some accessible data. Additionally, it can cause a partial denial of service.