Bui Duong

Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Description: The issue is related to inadequate access control in the Oracle BI Publisher product, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, including read, modify, insert, or delete access to some data, as well as partial denial of service. Recommendations: For versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Description: The issue is related to inadequate access control in the Oracle BI Publisher product, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all Oracle BI Publisher accessible data, and unauthorized update, insert, or delete access to some data. Additionally, it can cause a partial denial of service of Oracle BI Publisher. Recommendations: For versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Description: The issue is related to insufficient access control in the Administration component of Oracle BI Publisher, allowing a remote attacker to gain unauthorized access to protected information. This can result in reading, modifying, adding, or deleting data, as well as causing a denial of service via the HTTP protocol. Recommendations: For versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, consider restricting access to the Administration component until a patch is available. As a temporary workaround, limit network access via HTTP to the Oracle BI Publisher to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Description: The issue is related to insufficient access control in the BI Publisher Security component of Oracle BI Publisher, allowing a remote attacker to modify, add, or delete data, or cause a denial of service using the HTTP protocol. This can result in unauthorized access to critical data, update, insert, or delete access to some data, and a partial denial of service. Recommendations: For versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, consider restricting access to the BI Publisher Security component until a patch is available. As a temporary workaround, limit network access via HTTP to the Oracle BI Publisher to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient input validation in the E-Business Suite - XDO component of Oracle BI Publisher. This allows a low-privileged attacker with network access via HTTP to compromise BI Publisher, potentially leading to unauthorized access to critical data or complete access to all BI Publisher accessible data. Successful attacks can also result in unauthorized update, insert, or delete access to some of BI Publisher's accessible data.

The issue is related to insufficient input validation in the E-Business Suite - XDO component of Oracle BI Publisher. This allows a low-privileged attacker with network access via HTTP to compromise BI Publisher, potentially leading to unauthorized access to critical data or complete access to all BI Publisher accessible data. Successful attacks can also result in unauthorized update, insert, or delete access to some of BI Publisher's accessible data.

The issue is related to insufficient access control in the Composer component of Oracle WebCenter Portal, allowing a remote attacker to modify, add, or delete data, or cause a denial of service using the HTTP protocol. Successful attacks can result in unauthorized access to critical data, including creation, deletion, or modification of data, as well as read access to a subset of data and the ability to cause a partial denial of service.

The issue is related to the Core component of Oracle WebLogic Server and is caused by inadequate access control. It allows an unauthenticated attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. The vulnerability is easily exploitable and has been exploited in the wild. It is estimated that over 300 vulnerable servers could be exploited, leading to severe security threats.

The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server.