Maciej Grabiec

A binary in the BoKS Server Agent component allows low privilege local users to dump data from the cache.

The issue is related to a command injection vulnerability due to improper neutralization of special elements.

The issue allows a remote attacker to expose sensitive information or consume memory resources through an XML External Entity Injection (XXE) attack when processing XML data.

The issue is caused by improper bounds checking, leading to a stack-based buffer overflow. A local attacker could exploit this to gain lower level privileges, potentially impacting the confidentiality, integrity, and availability of protected information.

The issue exists due to insufficient input validation in the EAS Console component of Oracle Hyperion Essbase Administration Services. This allows a remote attacker to gain unauthorized access to protected information via HTTP requests. Successful attacks can result in unauthorized access to critical data or complete access to all Hyperion Essbase Administration Services accessible data.

Name of the Vulnerable Software and Affected Versions: IBM Security Identity Manager Adapters versions 6.0 through 7.0 Description: The issue is caused by improper bounds, leading to a heap-based buffer overflow. An authenticated user could overflow the buffer, causing the service to crash. Recommendations: For versions 6.0 and 7.0, update to a version that fixes the heap-based buffer overflow issue to prevent the service from crashing due to buffer overflow by an authenticated user. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient validation of incoming requests, which could allow a remote authenticated attacker to obtain sensitive data by sending specially crafted requests. This can lead to unauthorized access to protected information.

The issue is related to insufficient access controls in the Password Synchronization Plug-in of IBM Security Identity Manager, which could allow a remote attacker to gain unauthorized access to protected information. Specifically, an authenticated malicious user could change the passwords of other users in the Windows AD environment when the IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured.

The issue is related to insufficient access control in the Portal component of Oracle PeopleSoft Enterprise PeopleTools, allowing an unauthenticated attacker with logon to the infrastructure to compromise PeopleSoft Enterprise PeopleTools, potentially resulting in a takeover of the application.

The issue allows a remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data. An attacker could exploit this by persuading a victim to visit a specially crafted Web site, resulting in the execution of arbitrary code on the system.

The issue is related to the deserialization of untrusted data, which could allow a remote attacker to execute arbitrary code on the system. This can be achieved by persuading a victim to visit a specially crafted Web site. The vulnerability is associated with deficiencies in the deserialization mechanism.

The issue is caused by insecure deserialization of a specially crafted serialized object, which allows attackers to potentially execute arbitrary code. This can be exploited by a remote attacker using a specially formed serialized object, potentially leading to the execution of arbitrary code.

The issue allows remote attackers to execute arbitrary code via a crafted request to "index.plx".