Louis Wolfers

Name of the Vulnerable Software and Affected Versions: Oracle Retail Xstore Office versions 19.0.5, 20.0.3, 20.0.4, 22.0.0, and 23.0.1 Description: The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office, potentially resulting in unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products. Recommendations: For versions 19.0.5, 20.0.3, 20.0.4, 22.0.0, and 23.0.1, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse BIRT versions 2.6.2 through 4.12 **Description** The issue is related to insufficient input validation when processing host headers with the ` report` parameter. This could allow a remote attacker to gain unauthorized access to protected information or execute arbitrary code. The vulnerability is exploited by tampering with the Host header in certain configurations, such as when no virtual hosts are in place or when the default host points to the BIRT server. **Recommendations** For Eclipse BIRT versions 2.6.2 through 4.12, update to Eclipse BIRT 4.13 to resolve the issue. As a temporary workaround, consider restricting access to the ` report` parameter to minimize the risk of exploitation.