Dylan Pindur

An issue exists in the Authentication Engine component of Oracle Access Manager. An unauthenticated attacker with network access via HTTP can compromise the system, potentially leading to unauthorized read access or the unauthorized update, insertion, and deletion of a subset of accessible data.

Name of the Vulnerable Software and Affected Versions: Apache Jackrabbit versions prior to 2.23.2 Description: The software contains Blind XXE vulnerabilities in jackrabbit-spi-commons and jackrabbit-core due to the use of an unsecured document build to load privileges. Recommendations: Upgrade to version 2.20.17 (Java 8). Upgrade to version 2.22.1 (Java 11). Upgrade to version 2.23.2 (Java 11, beta versions).

An issue in the MVC Device Simulator allows attackers to bypass authorization rules.

The issue is an authenticated remote code execution (RCE) vulnerability. It can be exploited via the component /sitecore/shell/Invoke.aspx.

The issue is related to an authenticated remote code execution via the /Applications/Content Manager/Execute.aspx component, specifically when the `cmd` parameter is set to `convert` and the `mode` parameter is set to `HTML`.

The issue is related to insufficient request checking on the server side, allowing a remote, authenticated user to perform a full read server-side request forgery via a batch endpoint. This can be exploited to conduct SSRF attacks.