Patrick Star

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Oracle WebLogic Server Core component. This can be exploited by a remote attacker to gain unauthorized access to read, modify, or delete data, or to cause a denial of service using T3 network protocols. Successful attacks can result in unauthorized update, insert, or delete access to some Oracle WebLogic Server accessible data and can cause a partial denial of service of Oracle WebLogic Server. **Recommendations** For Oracle WebLogic Server versions 12.2.1.3.0 and 12.2.1.4.0, consider restricting access to the T3 protocol to minimize the risk of exploitation. For Oracle WebLogic Server version 14.1.1.0.0, consider restricting access to the T3 protocol to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MySQL Server versions 8.0.26 and prior **Description** The issue is related to insufficient input validation in the InnoDB component of MySQL Server, allowing a highly privileged attacker with network access via multiple protocols to compromise the server. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as the ability to cause a hang or frequently repeatable crash of MySQL Server, leading to a complete denial of service. **Recommendations** For versions 8.0.26 and prior, update to a version later than 8.0.26 to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, consider restricting access to the Core component until a patch is available. As a temporary workaround, consider disabling HTTP access to the server until the issue is resolved. Avoid using the vulnerable Core component in the Oracle WebLogic Server until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.