Bartłomiej Stasiek

The issue is related to insufficient input validation in the Manage Requisition Status component. It allows a low-privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement, resulting in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data.

The issue is related to insufficient input validation in the Health Center component of Oracle PeopleSoft Enterprise PT PeopleTools. This can be exploited by a remote attacker using the HTTP protocol, potentially impacting the confidentiality, integrity, and availability of protected information. Successful attacks may result in unauthorized access to update, insert, or delete data, as well as read access to a subset of data. Additionally, attacks may cause a partial denial of service.

The issue is related to insufficient input validation in the SQR component of PeopleSoft Enterprise PeopleTools. This allows a low-privileged attacker with network access via HTTP to compromise the application. Successful attacks can result in unauthorized access to data, including update, insert, or delete access to some data, as well as unauthorized read access to a subset of data. Additionally, it can cause a partial denial of service (DOS) of PeopleSoft Enterprise PeopleTools.

The issue is related to information disclosure in PAN-OS, which may allow an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API, possibly escalating privileges granted to them. This is due to a lack of protection for service data.