Le Xuan Tuyen

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** The issue is an information disclosure affecting Microsoft Exchange Server. It involves an authentication bypass, specifically through a flaw related to delegated authentication and the handling of the `SecurityToken` cookie. An unauthenticated attacker can leverage this to gain access to mailbox configuration parameters, potentially altering email forwarding rules and modifying the Exchange Control Panel (ECP) configuration. This allows for the mirroring of email traffic and access to sensitive information. The vulnerability, known as ProxyToken, is based on a combination of the `SecurityToken` cookie and an HTTP 500 error containing a valid string. The issue could reveal personal information and sensitive company data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Oracle WebLogic Server, allowing a remote attacker to execute arbitrary code via the IIOP protocol. This can result in the takeover of the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, consider disabling the IIOP protocol until a patch is available to prevent exploitation. As a temporary workaround, restrict access to the Core component of the Oracle WebLogic Server to minimize the risk of exploitation. Avoid using the IIOP protocol in the affected Oracle WebLogic Server versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Oracle WebLogic Server Core component. This can be exploited by a remote attacker to execute arbitrary code using IIOP, T3 protocols. Successful attacks can result in the takeover of the Oracle WebLogic Server. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the IIOP and T3 protocols until a patch is available. Avoid using the T3 protocol for deserialization of untrusted data in the affected Oracle WebLogic Server versions until the issue is resolved.