Maurizio Gatti

The issue is related to the lack of protection against malicious SQL commands. If exploited, it could allow a remote attacker to execute arbitrary code under the privileges of an interactive Historian REST Interface user, provided the user opens a specially crafted URL. This could potentially be achieved through social engineering tactics.

The issue is related to insufficient input validation in the System Management component of Oracle Integrated Lights Out Manager (ILOM). This easily exploitable vulnerability allows a high-privileged attacker with network access via ICMP to compromise ILOM, potentially impacting additional products. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some of ILOM's accessible data, as well as unauthorized read access to a subset of ILOM's accessible data.