Longofo

The issue is related to insufficient input validation in the Samples component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle WebLogic Server's accessible data, as well as unauthorized read access to a subset of the server's accessible data.

The issue is related to insufficient input validation in the Samples component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized update, insert, or delete access to some of the server's accessible data, as well as unauthorized read access to a subset of the server's accessible data.

The issue is related to insufficient input validation in the Core component of Oracle Coherence, allowing an unauthenticated attacker with network access via T3 or IIOP protocols to compromise Oracle Coherence. Successful attacks can result in the takeover of Oracle Coherence. The vulnerability is difficult to exploit.

The issue is related to the Web Services component of Oracle WebLogic Server, which can be exploited by an unauthenticated attacker with network access via T3 or IIOP protocols. This can lead to a denial of service (DOS) condition, causing the server to hang or crash repeatedly. The vulnerability is due to incorrect resource cleanup or release.

The issue is related to errors in processing input data in the web component of Essbase Analytic Provider Services. It can be exploited by a remote attacker to cause a denial of service. Successful attacks can result in the ability to cause the service to hang or crash repeatedly, leading to a complete denial of service.

The issue exists due to insufficient input validation in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition. This allows a remote attacker to gain full control over the application via the HTTP protocol. Successful attacks can result in the takeover of Oracle Business Intelligence Enterprise Edition.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data.

The issue is related to insufficient input validation in the Core component of Oracle Coherence, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data.

The issue exists due to insufficient input validation in the Web Services component of Oracle WebLogic Server, allowing a remote attacker to gain unauthorized access to the device via T3 and IIOP protocols. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the Oracle WebLogic Server.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3 or IIOP to compromise the server. Successful attacks can result in unauthorized access to update, insert, or delete data, as well as cause a partial denial of service.

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 7.0 through 9.0 Description: The issue allows a remote attacker to perform an XML External Entity Injection (XXE) attack when the software processes XML data. This could lead to the exposure of sensitive information or the consumption of memory resources. Recommendations: For IBM WebSphere Application Server versions 7.0 through 9.0, update to a version that includes a fix for this issue to prevent XXE attacks. As a temporary workaround, consider restricting the processing of external XML entities to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.0 through 9.0 Description: The issue allows a remote attacker to perform an XML External Entity Injection (XXE) attack when the software processes XML data. This could lead to the exposure of sensitive information or the consumption of memory resources. Recommendations: For versions 8.0 through 9.0, update to a version that includes a fix for this issue to prevent XXE attacks. As a temporary workaround, consider restricting the processing of external XML entities to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 7.0 through 9.0 Description: The issue is related to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources. Recommendations: For versions 7.0 through 9.0, update to a version that includes a fix for the XML External Entity Injection vulnerability. As a temporary workaround, consider restricting the processing of XML data from untrusted sources to minimize the risk of exploitation.

The issue is related to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.

The issue is related to insufficient access control in the Console component of Oracle WebLogic Server, allowing a remote attacker to gain full control over the application via the HTTP protocol. This can result in the takeover of Oracle WebLogic Server. The vulnerability is easily exploitable and can be used by a high-privileged attacker with network access.

The issue is related to insufficient input validation in the Oracle WebLogic Server, allowing a remote attacker to execute arbitrary code via the IIOP protocol. This can result in the takeover of the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access.

The issue is related to insufficient input validation in the User Interface component of Oracle Advanced Outbound Telephony. This allows a low-privileged attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony, potentially leading to unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data. Successful attacks can also result in unauthorized update, insert, or delete access to some of Oracle Advanced Outbound Telephony accessible data.

The issue is related to insufficient access control in the Web Services component of Oracle WebLogic Server, allowing a remote attacker to gain full control over the application using IIOP and T3 network protocols. Successful attacks can result in the takeover of Oracle WebLogic Server.

The issue is related to insufficient access control in the WLS Web Services component of Oracle WebLogic Server, allowing a high-privileged attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server.

The issue is related to insufficient access controls in the Caching, CacheStore, and Invocation components of Oracle Coherence. This can be exploited by a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks may result in unauthorized read access to a subset of Oracle Coherence accessible data.