Alexey Tyurin

A vulnerability exists in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). This vulnerability allows an unauthenticated attacker with network access via T3 or HTTP to compromise Oracle WebLogic Server, potentially leading to a takeover of the server.

The issue is related to the Oracle Application Object Library component and affects data integrity. It may be related to Single Signon and potentially allows remote attackers to inject arbitrary web script or HTML, although the exact nature of the vulnerability is not confirmed by Oracle. The exploitation could be related to unknown vectors and may involve the Domain parameter in the CfgOCIReturn servlet. There are claims that this issue could be a cross-site scripting (XSS) vulnerability.

The issue is related to errors in the code of the Oracle iSupplier Portal component. It may allow a remote attacker to access the Oracle iSupplier Portal or execute arbitrary code. The vulnerability is reportedly related to XML input and may be an XML External Entity (XXE) vulnerability, which could enable remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request to "OA HTML/oramipp lpr".

The issue affects the confidentiality and integrity of the system, potentially allowing remote attackers to impact it via unknown vectors related to Reports Security. There are claims that this issue might be related to an XML External Entity (XXE) vulnerability, which could enable remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks by crafting a DTD in an XML request involving the OA HTML/copxml servlet. Additionally, errors in the code of the Oracle Application Object Library component, specifically the Single Signon subcomponent, may allow a remote attacker to gain unauthorized access to read data.

The issue affects the confidentiality and integrity of the system, potentially allowing remote authenticated users to execute arbitrary SQL commands via a request involving the `afamexts.sql` SQL extension. This could enable unauthorized updates, insertions, deletions of data, as well as unauthorized access to read data in Oracle Applications Manager. The exact nature of the vulnerability is related to errors in the code and is possibly a SQL injection vulnerability, although Oracle has not confirmed this.

The issue is related to errors in the code of the Oracle Application Object Library component, allowing remote attackers to affect confidentiality. It is also claimed that this issue may allow remote attackers to enumerate database users via a series of requests to `Aoljtest.js`. The vulnerability is related to Java APIs - AOL/J.

The issue affects the confidentiality, integrity, and availability of the system via unknown vectors related to Punch-in. It is reportedly related to errors in the code of the Oracle Payments component. Exploitation may allow a remote attacker to access Oracle Payments or execute arbitrary code. There are claims that this issue could be an XML External Entity (XXE) vulnerability, which might allow remote attackers to cause a denial of service or conduct SMB Relay attacks via a crafted DTD in an XML request to "OA HTML/IspPunchInServlet".