Lukasz Plonka

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager versions prior to the fixed version Cisco Unified Communications Manager Session Management Edition versions prior to the fixed version Description: The issue is related to a lack of input validation in the web-based management interface, which could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This could be achieved by persuading a user to click a crafted link, potentially allowing the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. Recommendations: For Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition, upgrade to a version that includes the fix for this issue as soon as possible to mitigate the threat. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface to click on links from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An open redirect issue allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site, impacting the dashboard area of the user interface. A user would need to be logged into ePO to trigger this issue. To exploit this, the attacker must change the HTTP payload post submission, prior to it reaching the ePO server.

The issue is related to errors in the representation of information by the user interface. It allows a remote attacker to conduct spoofing attacks, affecting the system.

An issue was discovered that allows Reflected Cross-Site Scripting (XSS).

The issue allows Reflected Cross-Site Scripting (XSS).

An issue was discovered in NetScout nGeniusONE, where Open Redirection can occur. After a successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged.

An issue was discovered in NetScout nGeniusONE, where Open Redirection can occur. After a successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged.

The issue is related to improper file permissions, allowing authenticated remote users to gain permissions via a crafted payload.

An issue was discovered that allows Reflected Cross-Site Scripting (XSS).

The issue allows Reflected Cross-Site Scripting (XSS).

An issue was discovered that allows Reflected Cross-Site Scripting (XSS).

An issue was discovered that allows Reflected Cross-Site Scripting (XSS).

The issue allows a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially crafted Web site, the attacker could exploit this to spoof the URL displayed, redirecting a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. The vulnerability may also be exploited to conduct cross-site scripting (XSS) attacks using a specially crafted link.

This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. The vulnerability enables the embedding of malicious code, which can compromise the security of the application.

The issue is caused by improper handling of Administrative Console data, allowing a remote attacker to obtain sensitive information. This information could be used in further attacks against the system.

The issue allows an XML External Entity (XXE) attack. This type of attack occurs when an application parses XML input that contains an external entity, allowing an attacker to access local or remote resources.

The issue allows for Arbitrary File Upload by a privileged user.

The issue allows Java RMI code execution.

The issue concerns potential vulnerabilities that could be remotely exploited, resulting in Cross-Site Scripting (XSS).