Amichai Shulman

A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. A person with physical access to an iOS device may be able to access contacts from the lock screen.

A logic issue was addressed with improved state management, which could allow a local user to view sensitive user information.

An information disclosure issue exists due to the Windows bowser.sys kernel-mode driver's failure to properly handle objects in memory. This could allow an attacker to access the contents of system memory, potentially obtaining sensitive information and affecting the system.

The issue is related to an elevation of privilege vulnerability in Microsoft Cortana, which allows arbitrary website browsing on the lockscreen. This is due to insufficient access restrictions in the virtual voice assistant Cortana in Windows operating systems. The exploitation of this issue may allow an attacker to elevate their privileges.

An Elevation of Privilege issue exists due to Cortana retrieving data from user input services without considering status. This allows attackers to affect the system. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue is related to an unspecified vulnerability in the Net Listener component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue is related to an unspecified vulnerability in the Query Optimizer component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue is related to an unspecified vulnerability in the Streams Capture component, potentially allowing SQL injection in the SET DIRECTORY ROOT function within the DBMS CDC PUBLISH package. Details about the vulnerability are limited due to unavailability from Oracle.

The issue is related to an unspecified vulnerability in the Upgrade & Downgrade component, potentially allowing SQL injection in the DBMS REGISTRY package. This affects certain parameters to the following functions: (1) IS COMPONENT, (2) GET COMP OPTION, (3) DISABLE DDL TRIGGERS, (4) SCRIPT EXISTS, (5) COMP PATH, (6) GATHER STATS, (7) NOTHING SCRIPT, and (8) VALIDATE COMPONENTS. The estimated number of potentially affected devices and details about real-world incidents are not available.

The issue concerns an unspecified vulnerability in the Portal component of Oracle Application Server. Details about the impact and attack vectors of this issue are not specified.

The issue concerns an unspecified vulnerability in the Oracle Reports Developer component. Details about the impact and attack vectors of this issue are not provided.

The issue affects multiple components of Oracle Collaboration Suite, including the Email Server, Oracle Collaboration Suite Wireless & Voice, Oracle Content Management SDK, and Oracle Content Services. The vulnerabilities have unspecified impact and attack vectors.

The issue affects Oracle E-Business Suite and Applications, with unspecified vulnerabilities identified in several components, including the CRM Technical Foundation, iProcurement, and Oracle Application Object Library. These vulnerabilities have unspecified impact and attack vectors.

The issue concerns multiple unspecified vulnerabilities in the Oracle iLearning component, which have unspecified impact and attack vectors.

The issue affects Oracle PeopleSoft Enterprise Portal with unspecified impact and attack vectors.

The issue affects the Reorganize Objects & Convert Tablespace component and has an unspecified impact and attack vectors.

The issue concerns multiple unspecified vulnerabilities in various Oracle products, including Database Server, Application Server, Collaboration Suite, and E-Business Suite. These vulnerabilities are identified by Oracle Vuln# (1) WF02 and (2) WF03 in the Oracle Workflow Cartridge component. The impact and attack vectors of these vulnerabilities are not specified.

The issue affects various components of Oracle E-Business Suite and Applications, including the Application Install, Oracle Applications Framework, Oracle Applications Technology Stack, Oracle Human Resources, Oracle Marketing, Marketing Encyclopedia System, Oracle Trade Management, and Oracle Web Applications Desktop Integration components. The vulnerabilities have unspecified impact and attack vectors.

The issue allows remote attackers to bypass security restrictions, execute arbitrary SQL commands, and gain access to sensitive data. The Connection Manager component is affected, but specific details about the impact and attack vectors are not provided.

The issue affects the Oracle Database server and involves multiple unspecified vulnerabilities in various components, including the Data Pump, Net Listener, and Oracle Text components. Specifically, it is claimed by a reliable independent researcher that one of the vulnerabilities, DB06, is a SQL injection issue in certain functions within the DBMS DATAPUMP module, including `GENERATE JOB NAME`, `GET WORKERSTATUSLIST1010`, `GET PARAMVALUES1010`, `GET DUMPFILESET1010`, `GET JOBSTATUS1010`, `ATTACH`, and `ESTABLISH REMOTE CONTEXT`. The exact impact and attack vectors are not specified due to unavailable details from Oracle.