Antonin B

قد تسمح ثغرة أمنية في واجهة سطر الأوامر (CLI) للعديد من منتجات Cisco Unified Communications لمهاجم محلي معتمد بتنفيذ أوامر تعسفية على نظام التشغيل الأساسي لجهاز متأثر بصفته المستخدم الجذر (root). تحدث هذه المشكلة بسبب التحقق غير الكافي من صحة معلمات الأوامر التي يقدمها المستخدم. يمكن للمهاجم استغلال هذه الثغرة الأمنية عن طريق تنفيذ أوامر مصممة خصيصًا في واجهة سطر الأوامر (CLI) لجهاز متأثر، مما يتيح له تنفيذ أوامر تعسفية في نظام التشغيل الأساسي بصفته المستخدم «root». يجب أن يمتلك المهاجم بيانات اعتماد إدارية صالحة لاستغلال هذه الثغرة الأمنية.

تتعلق المشكلة بإلغاء تسلسل كائنات Java بشكل غير آمن بواسطة البرنامج المتأثر. يمكن للمهاجم استغلال هذه الثغرة عن طريق إقناع مستخدم محلي معتمد بفتح ملف .aef تم التلاعب به، مما قد يسمح بتنفيذ تعليمات برمجية عشوائية على المضيف باستخدام امتيازات المستخدم الذي قام بتشغيل تطبيق المحرر.

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8 Description: The issue is related to the failure to neutralize special elements, which could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. This could potentially lead to the execution of arbitrary code. Recommendations: For IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8, consider disabling the functionality that allows remote authenticated attackers to send specially crafted requests until a patch is available. Restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8 Description: The issue concerns the presence of hard-coded credentials, such as a password or cryptographic key, used for inbound authentication, outbound communication to external components, or encryption of internal data. Recommendations: For versions 10.0.0 through 10.0.8, consider disabling the use of hard-coded credentials as a temporary workaround until a patch is available. Restrict access to the appliance to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8 Description: The issue concerns hard-coded credentials, such as a password or cryptographic key, used by the appliance for its own inbound authentication, outbound communication to external components, or encryption of internal data. This poses serious cybersecurity risks. Recommendations: For versions 10.0.0 through 10.0.8, consider disabling the use of hard-coded credentials as a temporary workaround until a patch is available. Restrict access to the appliance to minimize the risk of exploitation. Avoid using the affected appliance for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient input validation in the Approvals component of Oracle Purchasing. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. Attacks can result in unauthorized update, insert, or delete access to some of Oracle Purchasing's accessible data, as well as unauthorized read access to a subset of Oracle Purchasing's accessible data. Recommendations: For versions 12.2.3 through 12.2.13, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.10 Description: The issue is related to insufficient input validation in the Proxy User Delegation component of Oracle User Management. This allows a low-privileged attacker with network access via HTTP to compromise Oracle User Management, resulting in unauthorized read access to a subset of Oracle User Management accessible data. Recommendations: For versions 12.1.3 and 12.2.3 through 12.2.10, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Proxy User Delegation component until a patch is available. Avoid using the vulnerable component via HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the Attachments / File Upload component of the Oracle Applications Framework product. It allows a low-privileged attacker with network access via HTTP to compromise the framework, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. The vulnerability may significantly impact additional products.