Ahmed Alwardani

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.2.3 through 12.2.11 **Description** The issue is related to insufficient input validation in the Access Request component of Oracle iReceivables, allowing a low-privileged attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle iReceivables accessible data. **Recommendations** For versions 12.2.3 through 12.2.11, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell BSAFE Crypto-C Micro Edition versions prior to 4.1.5 Dell BSAFE Micro Edition Suite versions prior to 4.6 **Description** The issue is related to an Observable Timing Discrepancy, which may allow attackers to exploit the vulnerability. **Recommendations** For Dell BSAFE Crypto-C Micro Edition versions prior to 4.1.5, update to version 4.1.5 or later. For Dell BSAFE Micro Edition Suite versions prior to 4.6, update to version 4.6 or later.

**Name of the Vulnerable Software and Affected Versions** Spring Framework versions 5.3.0 through 5.3.18 Spring Framework versions 5.2.0 through 5.2.20 Spring Framework older unsupported versions **Description** The patterns for disallowedFields on a DataBinder in Spring Framework are case sensitive. This means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path. **Recommendations** For Spring Framework versions 5.3.0 through 5.3.18, update to version 5.3.19 or later. For Spring Framework versions 5.2.0 through 5.2.20, update to version 5.2.21 or later. For Spring Framework older unsupported versions, there is no information about a newer version that contains a fix for this issue.