Spyridon Chatzimichail

The issue is related to insufficient input validation in the User Management component of Oracle Communications Order and Service Management, allowing a remote attacker with low privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized read access to a subset of accessible data.

The issue exists due to insufficient input validation in the Task Automation component of Oracle Hyperion Financial Management. This allows a remote attacker to read data, modify data, cause a partial denial of service, or gain privileged access via HTTP requests. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized access to some of the application's data.

The issue is related to insufficient input validation in the Application Development Framework component. It allows a high-privileged attacker with network access via HTTP to compromise Hyperion Planning, but successful attacks require human interaction from a person other than the attacker. This can result in unauthorized creation, deletion, or modification access to critical data or all Hyperion Planning accessible data.

The issue is related to a reflected XSS risk in the admin task log filter. This suggests a potential for malicious script execution due to insufficient sanitizing of user input.

Name of the Vulnerable Software and Affected Versions: Oracle Commerce Platform versions prior to 11.3.1 Description: The issue is related to insufficient input validation in the Dynamo Application Framework component of the Oracle Commerce Platform. It allows an unauthenticated attacker with network access via HTTP to compromise the platform. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The exploitation can result in unauthorized update, insert, or delete access to some of the Oracle Commerce Platform's accessible data. Recommendations: For versions prior to 11.3.1, update to version 11.3.1 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle Commerce Platform versions prior to 11.3.1 Oracle Commerce Platform version 11.1 Oracle Commerce Platform version 11.2 Description: The issue is related to insufficient input validation in the Dynamo Application Framework component of the Oracle Commerce Platform. This allows a remote attacker with high privileges and network access via HTTP to compromise the platform. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some of the platform's accessible data, as well as unauthorized read access to a subset of the platform's accessible data. Recommendations: For Oracle Commerce Platform versions prior to 11.3.1, update to version 11.3.1 or later to resolve the issue. For Oracle Commerce Platform version 11.1, update to version 11.3.1 or later to resolve the issue. For Oracle Commerce Platform version 11.2, update to version 11.3.1 or later to resolve the issue.

The issue is related to inadequate access control in the Server: Options component of Oracle MySQL Server. It allows a highly privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete Denial of Service) of the MySQL Server.

The issue is related to the InnoDB component of Oracle MySQL Server and is associated with inadequate access control. It allows a high-privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks can result in unauthorized update, insert, or delete access to some of the MySQL Server's accessible data. The vulnerability can also cause a hang or frequently repeatable crash of the MySQL Server.

Name of the Vulnerable Software and Affected Versions: IBM MobileFirst Platform Foundation versions 6.3 through 8.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session due to cross-site scripting. Recommendations: For versions 6.3 through 8.0, update to a version that includes the fix for this issue to prevent cross-site scripting attacks.

The issue allows remote attackers to bypass authentication via unspecified vectors in the search and replay servers.

A buffer overflow in the jpeg2000 image file format parser as implemented in the OpenJpeg library causes arbitrary code execution when parsing a crafted image. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. The attack requires the target user to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents, and the OpenJpeg library is used by a number of popular PDF renderers, making PDF documents a likely attack vector.

A directory traversal issue in the replay server of IBM Tealeaf Customer Experience allows remote attackers to read arbitrary files. The attack vector is not specified.

The issue allows local users to discover credentials by leveraging privileges during an unspecified connection type.

The issue allows remote attackers to read arbitrary charts by specifying an internal chart name.