Peterjson

The issue is related to errors in the code of the Oracle JDeveloper product, specifically the ADF Faces component. This can be exploited by a remote attacker using HTTP requests, potentially affecting the confidentiality, integrity, and availability of protected information. The vulnerability can result in the takeover of Oracle Application Development Framework (ADF). It is noted that Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product.

The issue is related to insufficient input validation in the Web Services Security component. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Web Services Manager accessible data, as well as unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data. The attacker can exploit this issue by sending specially crafted HTTP requests.

The issue is related to errors in processing HTTP requests in the Oracle Access Manager component of Oracle Fusion Middleware. This can allow a remote attacker to execute arbitrary code. Successful attacks can result in the takeover of Oracle Access Manager. The vulnerability can be easily exploited by an unauthenticated attacker with network access via HTTP.

The issue is related to insufficient input validation in the Unified Metadata Manager component. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure, resulting in unauthorized read access to a subset of accessible data.

The issue exists due to insufficient input validation in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition. This allows a remote attacker to gain full control over the application via the HTTP protocol. Successful attacks can result in the takeover of Oracle Business Intelligence Enterprise Edition.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description: The issue is related to inadequate access control in the Compensation Workbench component of Oracle E-Business Suite. It allows a low-privileged attacker with network access via HTTP to compromise the Oracle Compensation Workbench. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all accessible data, as well as unauthorized access to critical data. Recommendations: For versions 12.1.1 through 12.1.3, update to a version that includes the fix for this issue to prevent unauthorized access and data modification. At the moment, there is no information about a newer version that contains a fix for this vulnerability.