Moritz Bechler

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing a remote attacker to gain full control over the application using T3 and IIOP network protocols. Successful attacks can result in the takeover of Oracle WebLogic Server.

The issue is related to insufficient input validation in the Oracle Java SE, Oracle GraalVM Enterprise Edition, and Oracle GraalVM for JDK products. This vulnerability can be exploited by an unauthenticated attacker with network access via multiple protocols, allowing them to compromise the affected systems. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data. The vulnerability can be exploited using APIs in the specified component, for example, through a web service that supplies data to the APIs. It also applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security.

The issue is related to insufficient input validation in the Advanced Networking Option component of Oracle Database Server. It allows an unauthenticated attacker with network access via Oracle Net to compromise the Advanced Networking Option, resulting in unauthorized update, insert, or delete access to some of the accessible data. The exploitation of this issue is considered difficult.

An issue was discovered where user authentication for accessing the CORBA back-end services can be bypassed.

An issue was discovered due to exposed CORBA management services, allowing arbitrary system commands to be executed on the server.

An issue was discovered due to an exposed internal communications interface, making it possible to execute arbitrary system commands on the server.

An issue was discovered due to improper validation, allowing arbitrary local files to be retrieved by accessing the back-end Tomcat server directly.

An issue was discovered due to an unsafe implementation of session tracking, making it possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, also known as Session Fixation.

An issue was discovered due to insecure design or lack of authentication, allowing unauthenticated attackers to complete the password-reset process for any account and set a new password.

A remote deserialization attack is possible in the Enterprise Application Beans (EJB) due to lack of validation/filtering capabilities in Wildfly. This issue allows for a potential attack.

A security issue was discovered due to improper handling of RCDATA and RAWTEXT type elements, allowing the built-in sanitization mechanism to be bypassed. This can lead to the execution of malicious script content from HTML e-mail within the application context via crafted use of elements such as NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA.

The issue is related to a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. The vulnerability is also associated with a lack of data sanitization at the management level, which could allow a remote attacker to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Apache NetBeans versions 9.0 Description: The issue is related to the Proxy Auto-Configuration (PAC) file in the Apache NetBeans development environment, which fails to neutralize script code in attributes on a web page. This can allow a remote attacker to execute arbitrary code. The vulnerability is exploited through the nashorn script engine, which leaks privileged objects that can be used to circumvent execution limits. Alternatively, using a different script engine can also lead to remote code execution, as no execution limits are in place. Recommendations: For Apache NetBeans version 9.0, consider disabling the nashorn script engine or restricting its use to minimize the risk of exploitation until a patch is available. Additionally, avoid using the Proxy Auto-Configuration (PAC) interpretation feature in the NetBeans environment until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to unescaped string injection in dojox/Grid/DataGrid, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. This is due to incorrect encoding or hiding of output data.

Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 5.1.26 ILIAS versions 5.2.x prior to 5.2.15 ILIAS versions 5.3.x prior to 5.3.4 Description: The issue arises from inconsistencies in parameter handling, leading to instances of reflected cross-site-scripting. Recommendations: For versions prior to 5.1.26, update to version 5.1.26 or later. For versions 5.2.x prior to 5.2.15, update to version 5.2.15 or later. For versions 5.3.x prior to 5.3.4, update to version 5.3.4 or later.

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins versions prior to 2.32.2 Description: The issue involves a remote code execution vulnerability through the deserialization of various types in javax.imageio in XStream-based APIs. Recommendations: For versions prior to 2.44, update to version 2.44 or later. For versions prior to 2.32.2, update to version 2.32.2 or later.

The issue allows an authenticated user to cause the JVM running Apache Brooklyn to load and run Java code without detection. This could provide access to privileges of the Java process, including opening files and network connections, and executing system commands. A proof-of-concept exploit using this issue is known to exist.

The issue allows remote attackers to execute arbitrary code via crafted serialized Java data due to the lack of restriction on the classes for which deserialization is performed by the AMF unmarshallers.

The issue concerns a Java object de-serialization vulnerability in Apache Camel's Jackson and JacksonXML unmarshalling operations, which can lead to Remote Code Execution attacks. De-serializing untrusted data can result in security flaws, as seen in similar Java de-serialization issues.

The issue is related to insufficient input validation in the YamlProvider component, which could allow an attacker to execute arbitrary code with RESTEasy application permissions by forcing the application into parsing a request with YamlProvider, resulting in the unmarshalling of potentially untrusted data.