Khuyenn

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.8.3 WordPress versions prior to 4.1.34 **Description** WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. **Recommendations** For WordPress versions prior to 5.8.3, update to version 5.8.3 or later. For WordPress versions prior to 4.1.34, update to version 4.1.34 or later. Keep auto-updates enabled to ensure the latest security patches are applied. At the moment, there is no information about additional mitigation measures for this issue.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.8.3 WordPress versions 3.7.37 and earlier **Description** The issue is related to improper sanitization in the WP Query function of the WordPress content management system, which can lead to SQL injection through certain plugins or themes. This may allow a remote attacker to disclose stored credentials. The vulnerability has been patched in WordPress version 5.8.3 and older affected versions have also been fixed via security releases. **Recommendations** For WordPress versions prior to 5.8.3, update to version 5.8.3 or later to resolve the issue. For WordPress versions 3.7.37 and earlier, update to version 3.7.37 or later to resolve the issue. As a general mitigation measure, keep auto-updates enabled to ensure the latest security patches are applied.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.9 **Description** The issue is related to insufficient input validation in the User Interface component of Oracle Advanced Outbound Telephony. This allows an unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony, potentially resulting in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data. Successful attacks may also allow unauthorized update, insert, or delete access to some of Oracle Advanced Outbound Telephony accessible data and require human interaction from a person other than the attacker. **Recommendations** For versions 12.1.1 through 12.1.3, update to a version outside of this range to mitigate the risk. For versions 12.2.3 through 12.2.9, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the User Interface component of Oracle Advanced Outbound Telephony to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Financial Services Balance Sheet Planning version 8.0.8 **Description** The issue is related to the User Interface component of the Oracle Financial Services Balance Sheet Planning product. It allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data, as well as unauthorized read access to a subset of accessible data. The vulnerability is easily exploitable and can be used to gain access to sensitive information. **Recommendations** For version 8.0.8, consider restricting access to the User Interface component until a patch is available. As a temporary workaround, limit the use of HTTP requests to minimize the risk of exploitation. Additionally, review and restrict privileges to sensitive data to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Financial Services Asset Liability Management versions 8.0.6 through 8.0.7 **Description** The issue is related to the lack of protection for service data in the User Interface component of Oracle Financial Services Asset Liability Management. It allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data, as well as unauthorized read access to a subset of accessible data. **Recommendations** For versions 8.0.6 and 8.0.7, update to a version that includes the fix for this issue to prevent unauthorized access and data modification. As a temporary workaround, consider restricting access to the User Interface component until a patch is available. Avoid using the HTTP protocol for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Oracle Advanced Outbound Telephony versions 12.1.1 through 12.1.3 **Description** The issue is related to insufficient access controls in the Calendar component of Oracle Advanced Outbound Telephony, allowing a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks may require human interaction and can significantly impact additional products, resulting in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Calendar component until a patch is available. As a temporary workaround, limit the use of HTTP protocol for remote access to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 **Description** The issue is related to inadequate access controls in the Estimate and Actual Charges component of Oracle Depot Repair, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Estimate and Actual Charges component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for accessing Oracle Depot Repair to minimize the risk of exploitation. Additionally, ensure that all users are aware of the potential for social engineering attacks that may be used in conjunction with this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 **Description** The issue is related to inadequate access controls in the Estimate and Actual Charges component of Oracle Depot Repair. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Depot Repair, potentially leading to unauthorized access to critical data or complete access to all Oracle Depot Repair accessible data. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in unauthorized update, insert, or delete access to some of Oracle Depot Repair accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Estimate and Actual Charges component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for accessing Oracle Depot Repair to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 **Description** The issue is related to inadequate access control in the Estimate and Actual Charges component of Oracle Depot Repair, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Estimate and Actual Charges component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for accessing Oracle Depot Repair to minimize the risk of exploitation. Additionally, ensure that all users are aware of the potential for social engineering attacks that may be used in conjunction with this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Depot Repair versions 12.1.1 through 12.1.3 **Description** The issue is related to insufficient access control in the Estimate and Actual Charges component of Oracle Depot Repair, allowing a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks may significantly impact additional products and can result in unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data. These attacks require human interaction from a person other than the attacker. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Estimate and Actual Charges component until a patch is available. As a temporary workaround, limit the use of HTTP protocol for sensitive operations to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 **Description** The issue is related to inadequate access controls in the Estimate and Actual Charges component of Oracle Depot Repair. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Depot Repair, potentially leading to unauthorized access to critical data or complete access to all Oracle Depot Repair accessible data. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in unauthorized update, insert, or delete access to some of Oracle Depot Repair accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Estimate and Actual Charges component until a patch is available. As a temporary workaround, limit the use of HTTP protocol for accessing Oracle Depot Repair to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 **Description** The issue is related to inadequate access control in the Estimate and Actual Charges component of Oracle Depot Repair, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized access to critical data, complete access to all Oracle Depot Repair accessible data, as well as unauthorized update, insert, or delete access to some of Oracle Depot Repair accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Estimate and Actual Charges component until a patch is available. As a temporary workaround, limit the use of HTTP protocol for accessing Oracle Depot Repair to minimize the risk of exploitation. Additionally, ensure that all users of the system are aware of the potential for social engineering attacks that may be used in conjunction with this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 **Description** The issue is related to inadequate access control in the Estimate and Actual Charges component of Oracle Depot Repair, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Estimate and Actual Charges component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for accessing Oracle Depot Repair to minimize the risk of exploitation. Additionally, ensure that all users are aware of the potential for social engineering attacks that may be used in conjunction with this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Knowledge Management versions 12.1.1 through 12.1.3 **Description** The issue is related to insufficient access controls in the Setup and Admin components of Oracle Knowledge Management. It can be exploited by a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks may require human interaction and can significantly impact additional products, potentially resulting in unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Setup and Admin components until a fix is available. As a temporary workaround, limit the use of HTTP protocol for accessing Oracle Knowledge Management to minimize the risk of exploitation. Avoid using the vulnerable components for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Service Intelligence versions 12.1.1 through 12.1.3 **Description** The issue is related to insufficient access controls in the Internal Operations- Search component of Oracle Service Intelligence. It allows a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks require human interaction and can significantly impact additional products, resulting in unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data. **Recommendations** For versions 12.1.1 through 12.1.3, update to a version that includes the fix for this issue to prevent unauthorized access and potential data manipulation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 **Description** The issue is related to the lack of protection for service data in the Setup of Mobile Applications component of Oracle CRM Gateway for Mobile Devices. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle CRM Gateway for Mobile Devices, potentially leading to unauthorized access to critical data or complete access to all accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, update to a version that includes the fix for this issue to prevent unauthorized access to critical data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Marketing versions 12.1.1 through 12.1.3 **Description** The issue is related to insufficient access control in the Marketing Administration component of Oracle Marketing, allowing a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks may significantly impact additional products and can result in unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data. These attacks require human interaction from a person other than the attacker. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Marketing Administration component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for sensitive operations to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Marketing versions 12.1.1 through 12.1.3 **Description** The issue is related to insufficient access controls in the Marketing Administration component of Oracle Marketing. It can be exploited by a remote attacker to gain unauthorized access to sensitive information using the HTTP protocol. Successful attacks may require human interaction and can significantly impact additional products, potentially leading to unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Marketing Administration component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for sensitive operations. Additionally, ensure that all users with access to Oracle Marketing are aware of the potential risks and take necessary precautions to avoid falling victim to social engineering attacks that may exploit this issue.

**Name of the Vulnerable Software and Affected Versions** Oracle Marketing versions 12.1.1 through 12.1.3 **Description** The issue is related to insufficient access control in the Marketing Administration component of Oracle Marketing, allowing a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks may require human interaction and can significantly impact additional products, resulting in unauthorized access to critical data, as well as update, insert, or delete access to some data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Marketing Administration component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for accessing Oracle Marketing to minimize the risk of exploitation. Avoid using the Marketing Administration component for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1 through 12.1.3 **Description** The issue is related to inadequate access controls in the Print Server component of Oracle One-to-One Fulfillment. It allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.1 through 12.1.3, consider restricting access to the Print Server component until a patch is available. As a temporary workaround, limit the use of HTTP protocol for remote access to minimize the risk of exploitation. Additionally, ensure that all users are aware of the potential for social engineering attacks that may be used in conjunction with this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.