Esteban Montes Morales

Name of the Vulnerable Software and Affected Versions: myCred versions through 2.9.4.3 Description: A Time-of-check Time-of-use (TOCTOU) race condition exists in myCred. This issue allows leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. Recommendations: Update myCred to a version later than 2.9.4.3.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.10 **Description** The issue is related to insufficient input validation in the Attachments component of Oracle Document Management and Collaboration. It allows a high-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.3, update to a version that includes the fix for this issue. For versions 12.2.3 through 12.2.10, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Attachments component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.10 **Description** The issue is related to insufficient access control in the Runtime Catalog component of Oracle iStore, allowing an unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products, resulting in unauthorized access to critical data or complete access to all Oracle iStore accessible data, as well as unauthorized update, insert, or delete access to some of Oracle iStore accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, update to a version that includes the fix for this issue. For versions 12.2.3 through 12.2.10, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Runtime Catalog component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle Email Center versions 12.1.1 through 12.1.3 Oracle Email Center versions 12.2.3 through 12.2.9 **Description** The issue is related to inadequate access control in the KB Search component of Oracle Email Center, part of the Oracle E-Business Suite. This can be exploited by a remote attacker to gain unauthorized access to protected information or to modify, add, or delete data using the HTTP protocol. Successful attacks may require interaction from someone other than the attacker and can significantly impact additional products, potentially leading to unauthorized access to critical data or complete access to all accessible data in Oracle Email Center. **Recommendations** For Oracle Email Center versions 12.1.1 through 12.1.3, update to a version that includes the necessary security patches to address the inadequate access control issue. For Oracle Email Center versions 12.2.3 through 12.2.9, apply the recommended security fixes to mitigate the vulnerability and ensure proper access control. As a temporary workaround, consider restricting access to the KB Search component until a patch is available.