Sean Yeoh

The issue is related to a .NET deserialization vulnerability in the Ad Hoc Transfer module of WS FTP Server. This vulnerability can be exploited by a pre-authenticated attacker to execute remote commands on the underlying WS FTP Server operating system. The vulnerability has been observed being actively exploited in the wild, and it is estimated that a significant number of devices may be affected.

The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products.