Matthias Kaiser

The issue exists due to insufficient input validation in the Policy Framework component of the Enterprise Manager Base Platform. This allows a remote attacker to execute arbitrary code via HTTP requests. Successful attacks can result in the takeover of the Enterprise Manager Base Platform. The vulnerability is difficult to exploit and can be used by an unauthenticated attacker with network access via HTTP.

The issue exists due to insufficient input validation in the Enterprise Manager Install component of the Enterprise Manager Base Platform. This allows a remote attacker to gain read, modify, add, or delete access to data, or cause a partial denial of service using HTTP requests. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data.

A vulnerability in the Policy Framework component of Oracle Enterprise Manager's Enterprise Manager Base Platform allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in the takeover of the Enterprise Manager Base Platform.

The issue exists due to insufficient input validation in the Core component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This allows a remote attacker to execute arbitrary code and impact the confidentiality, integrity, and availability of protected information. Successful attacks can result in the takeover of Oracle WebLogic Server. The vulnerability can be exploited by an unauthenticated attacker with network access via T3 or IIOP.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3 or IIOP to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server, impacting confidentiality, integrity, and availability.

The issue exists due to insufficient input validation in the Coherence Container component of Oracle WebLogic Server, allowing a remote attacker to compromise the server's confidentiality, integrity, and availability via T3 and IIOP protocols. Successful attacks can result in the takeover of Oracle WebLogic Server.

Name of the Vulnerable Software and Affected Versions: Python versions 3.x through 3.9.1 Description: The issue is related to a buffer overflow in the PyCArg repr function in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input. This occurs because sprintf is used unsafely. The vulnerability can be exploited when handling untrusted floating-point numbers in handlers that call C functions using the ctypes mechanism. Recommendations: For Python versions 3.x through 3.9.1, update to a newer version that contains a fix for this issue, such as Python 3.7.10 or 3.6.13. For Python 3.8 and 3.9, wait for the release of the updated versions, which are currently in the release candidate stage. As a temporary workaround, consider restricting the use of the ctypes mechanism to minimize the risk of exploitation. Avoid using the `c double.from param` function with untrusted input until the issue is resolved.

The issue is related to the improper validation of the content of an OK packet received from a server in the libmariadb/mariadb lib.c file. This problem does not affect any MySQL components supported by Oracle, despite the code originally being based on MySQL.

The issue is related to a heap out-of-bounds write in the netfilter subsystem of the Linux kernel, specifically in the `nf dup netdev.c` file. This can allow local users to gain privileges or cause a denial of service. The problem is related to `nf tables offload`. A researcher managed to hijack the kernel control flow, and an example exploit allows a local user to elevate their privileges in Ubuntu 21.10 with the KASLR protection mechanism disabled.

The issue is related to insufficient access control in the Application Container - JavaEE component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via the T3 protocol to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server.

The issue is caused by an unbounded memory allocation in the systemd-journald and systemd-journal-remote binary system, which can lead to a stack clash with another memory region. This can be exploited by a local or remote attacker to crash systemd-journald or execute code with journald privileges.

The issue allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code.

The issue is related to insufficient input validation in the org.springframework.core.serializer.DefaultDeserializer component of the Spring AMQP application for RabbitMQ message exchange. This allows a remote attacker to execute arbitrary code.

The issue allows a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath, as the JMS client provides classes that deserialize objects from untrusted sources.

The issue allows remote attackers to execute arbitrary code via a crafted serialized Java object. This object triggers an LDAP query to a third-party server.

The JMS Client in IBM MessageSight allows remote authenticated users to obtain administrator privileges for executing arbitrary commands via unspecified vectors.

The issue is related to insufficient access control in Adobe PDF viewer and editor software, allowing a remote attacker to bypass JavaScript API execution restrictions.

The issue is related to insufficient access control in Adobe PDF viewer and editor software. It allows a remote attacker to bypass JavaScript API restrictions.

The issue is related to insufficient access control in Adobe Reader and Adobe Acrobat, allowing a remote attacker to bypass JavaScript API execution restrictions. This can be exploited through the JavaScript API.

The issue is related to insufficient access control in Adobe PDF viewer and editor software. It allows a remote attacker to bypass JavaScript API restrictions.