Stephen Kost

**Name of the Vulnerable Software and Affected Versions** Oracle Applications versions 11.0 Oracle E-Business Suite versions 11.5.1 through 11.5.8 **Description** The issue allows remote attackers to execute arbitrary SQL procedures and queries due to multiple SQL injection vulnerabilities. **Recommendations** For Oracle Applications version 11.0, update to a version that contains a fix for this issue. For Oracle E-Business Suite versions 11.5.1 through 11.5.8, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 10.7, 11.0, 11.5.1 through 11.5.8 **Description** The issue allows remote attackers to bypass authentication and obtain sensitive information from the Oracle Applications Concurrent Manager by spoofing requests to the TNS Listener. This is due to a flaw in the communications protocol for the Report Review Agent (RRA), also known as the FND File Server (FNDFS) program. **Recommendations** For Oracle E-Business Suite versions 10.7, 11.0, and 11.5.1 through 11.5.8, consider restricting access to the TNS Listener to minimize the risk of exploitation. As a temporary workaround, restrict the use of the RRA protocol until a patch is available. Avoid using the vulnerable protocol to access sensitive information from the Oracle Applications Concurrent Manager until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 11.0 and 11.5.1 through 11.5.8 Description: A buffer overflow issue in the Oracle Applications Web Report Review (FNDWRR) CGI program may allow remote attackers to execute arbitrary code via a long URL. Recommendations: For Oracle E-Business Suite versions 11.0 and 11.5.1 through 11.5.8, update to a version that includes the fix for this issue to prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 11.5.1 through 11.5.8 Description: The issue allows a remote attacker to obtain sensitive information without authentication, including the GUEST user password and the application server security key, due to multiple vulnerabilities in the aoljtest.jsp of Oracle Applications AOL/J Setup Test Suite. Recommendations: For Oracle E-Business Suite versions 11.5.1 through 11.5.8, consider restricting access to the aoljtest.jsp page until a fix is available. As a temporary workaround, limit the exposure of sensitive information by implementing additional authentication measures for accessing the GUEST user password and the application server security key. At the moment, there is no information about a newer version that contains a fix for this vulnerability.