Haoran Zhao

An issue exists that allows an unauthorized actor to perform a job discard. This primarily impacts services directly exposed to public networks, while in-house deployments are generally not affected.

Improper authorization occurs during job information retrieval, allowing an attacker to gain access to unauthorized jobs belonging to other projects.

An issue in Erick xmall allows a remote attacker to escalate privileges via the `updateAddress` method of the `Address Controller` class.

The issue allows a remote attacker to escalate privileges via the `editSave` method, which does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings.

The issue allows a remote attacker to escalate privileges via the `changeStatus` method.

The issue allows a remote attacker to escalate privileges via the `jobLogId` parameter.

The issue allows a remote attacker to escalate privileges via the edit method of the "/edit/{dictId}" endpoint, which does not properly validate whether the requesting user has permission to modify the specified `dictId`.

The issue allows a remote attacker to escalate privileges via the `editSave` method in the "/tool/gen/editSave" API endpoint.

The issue allows a remote attacker to escalate privileges via the "API Endpoint: /editSave" method in `SysNoticeController`.

The issue allows a remote attacker to escalate privileges via the SysDictTypeController component.

The issue allows a remote attacker to escalate privileges. This is achieved via the `selectDeptTree` method of the "/selectDeptTree/{deptId}" endpoint, which does not properly validate the `deptId` parameter.

The issue allows a remote attacker to escalate privileges via the `postID` parameter in the `edit` method.

The issue allows a remote attacker to escalate privileges via the `jobId` parameter.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can result in the ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.