Kylinking

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 7.0 through 8.5 Description: The issue allows a remote authenticated attacker to obtain sensitive data by sending a specially crafted request, exploiting a server-side request forgery (SSRF) weakness. Recommendations: For versions 7.0 through 8.5, update to a version that includes a fix for this issue to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Oracle WebLogic Server, allowing a remote attacker to execute arbitrary code via the IIOP protocol. This can result in the takeover of the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, consider disabling the IIOP protocol until a patch is available to prevent exploitation. As a temporary workaround, restrict access to the Core component of the Oracle WebLogic Server to minimize the risk of exploitation. Avoid using the IIOP protocol in the affected Oracle WebLogic Server versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 7.0 through 9.0 **Description** The issue allows a remote attacker to expose sensitive information through an XML External Entity Injection (XXE) attack when processing XML data. **Recommendations** For versions 7.0 through 9.0, update to a version that includes a fix for this issue to prevent XXE attacks.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 **Description** The issue is related to insufficient access control in the WLS Core Components of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via the IIOP protocol to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. **Recommendations** For versions 10.3.6.0.0 through 12.2.1.4.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.