Jake Knott

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.2.3 through 12.2.14 **Description** An unauthenticated remote code execution flaw exists in the BI Publisher Integration component of the Oracle Concurrent Processing product. An attacker with network access via HTTP can send specially crafted requests to the `/OA HTML/RF.jsp` and `/OA HTML/OA.jsp` endpoints to upload a malicious XSLT template. When this template is previewed, it executes embedded commands, allowing the attacker to deploy a web shell and take full control of the system. This issue has been exploited in the wild by threat actors such as Cl0p, Scattered LAPSUS$ Hunters, and GRACEFUL SPIDER. Real-world impacts include the theft of terabytes of sensitive corporate, financial, and employee data from over 100 organizations, including Harvard University, The Washington Post, Logitech, and Korean Air, where approximately 30,000 employee records were compromised. **Recommendations** Apply Oracle security updates for versions 12.2.3 through 12.2.14 immediately. As a temporary mitigation, restrict network access to the `/OA HTML/RF.jsp` and `/OA HTML/OA.jsp` endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SysAid On-Prem versions 23.3.40 and earlier **Description** SysAid On-Prem is affected by an unauthenticated XML External Entity (XXE) issue in the Server URL processing functionality. This allows for administrator account takeover and file read operations. The issue is due to improper restriction of XML external entity references. Reports indicate active exploitation of this issue. **Recommendations** Versions prior to 23.3.40 should be updated.

**Name of the Vulnerable Software and Affected Versions** SysAid On-Prem versions 23.3.40 and earlier **Description** SysAid On-Prem software is affected by an unauthenticated XML External Entity (XXE) issue in the `lshw` processing functionality. Exploitation of this issue may allow a remote attacker to take control of administrator accounts and read files. The vulnerability resides in the `doPost` method of the `com.ilient.agentApi.LshwAgent` component when processing requests to the `/lshw` API endpoint. The issue involves improper restriction of XML references to external entities. The vulnerable parameter is not explicitly specified. **Recommendations** SysAid On-Prem versions 23.3.40 and earlier should be updated to a newer, fixed version.

**Name of the Vulnerable Software and Affected Versions** SysAid On-Prem versions 23.3.40 and earlier **Description** SysAid On-Prem is affected by an unauthenticated XML External Entity (XXE) issue in the Checkin processing functionality. This allows for administrator account takeover and file read capabilities. Multiple reports indicate this issue, identified as CVE-2025-2775, can be chained with other flaws to achieve remote code execution (RCE). The vulnerability resides in the improper restriction of XML external entity references, specifically when processing check-in requests. Exploitation involves submitting malicious XML payloads, potentially through the `/api/v1/servicenow` endpoint. The `XML` input is vulnerable. This allows attackers to potentially exfiltrate sensitive data. Several sources indicate the vulnerability is actively exploited. **Recommendations** Update SysAid On-Prem to version 24.4.60 b16 or later. As a temporary workaround, disable XXE processing. Monitor API logs for suspicious activity. Restrict access to the Checkin processing functionality.