Antonin B

A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This issue is due to improper validation of user-supplied command arguments. An attacker could exploit this by executing crafted commands on the CLI of an affected device, allowing them to execute arbitrary commands on the underlying operating system as the root user. The attacker must have valid administrative credentials to exploit this vulnerability.

The issue is related to insecure deserialization of Java objects by the affected software. An attacker could exploit this by persuading an authenticated, local user to open a crafted .aef file, potentially allowing the execution of arbitrary code on the host with the privileges of the user who launched the editor application.

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8 Description: The issue is related to the failure to neutralize special elements, which could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. This could potentially lead to the execution of arbitrary code. Recommendations: For IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8, consider disabling the functionality that allows remote authenticated attackers to send specially crafted requests until a patch is available. Restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8 Description: The issue concerns the presence of hard-coded credentials, such as a password or cryptographic key, used for inbound authentication, outbound communication to external components, or encryption of internal data. Recommendations: For versions 10.0.0 through 10.0.8, consider disabling the use of hard-coded credentials as a temporary workaround until a patch is available. Restrict access to the appliance to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8 Description: The issue concerns hard-coded credentials, such as a password or cryptographic key, used by the appliance for its own inbound authentication, outbound communication to external components, or encryption of internal data. This poses serious cybersecurity risks. Recommendations: For versions 10.0.0 through 10.0.8, consider disabling the use of hard-coded credentials as a temporary workaround until a patch is available. Restrict access to the appliance to minimize the risk of exploitation. Avoid using the affected appliance for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient input validation in the Approvals component of Oracle Purchasing. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. Attacks can result in unauthorized update, insert, or delete access to some of Oracle Purchasing's accessible data, as well as unauthorized read access to a subset of Oracle Purchasing's accessible data. Recommendations: For versions 12.2.3 through 12.2.13, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.10 Description: The issue is related to insufficient input validation in the Proxy User Delegation component of Oracle User Management. This allows a low-privileged attacker with network access via HTTP to compromise Oracle User Management, resulting in unauthorized read access to a subset of Oracle User Management accessible data. Recommendations: For versions 12.1.3 and 12.2.3 through 12.2.10, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Proxy User Delegation component until a patch is available. Avoid using the vulnerable component via HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the Attachments / File Upload component of the Oracle Applications Framework product. It allows a low-privileged attacker with network access via HTTP to compromise the framework, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. The vulnerability may significantly impact additional products.