Peterjson

**Name of the Vulnerable Software and Affected Versions** Oracle JDeveloper versions 12.2.1.3.0 through 12.2.1.4.0 **Description** The issue is related to errors in the code of the Oracle JDeveloper product, specifically the ADF Faces component. This can be exploited by a remote attacker using HTTP requests, potentially affecting the confidentiality, integrity, and availability of protected information. The vulnerability can result in the takeover of Oracle Application Development Framework (ADF). It is noted that Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. **Recommendations** For versions 12.2.1.3.0 and 12.2.1.4.0, refer to the Fusion Middleware Patch Advisor for more details on obtaining a patch to resolve the issue. As a temporary workaround, consider restricting access to the ADF Faces component until a patch is available. Additionally, ensure that systems are kept updated to prevent exploitation of this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability, so it is crucial to follow the guidance from the Fusion Middleware Patch Advisor.

**Name of the Vulnerable Software and Affected Versions** Oracle Web Services Manager versions 12.2.1.3.0 through 12.2.1.4.0 **Description** The issue is related to insufficient input validation in the Web Services Security component. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Web Services Manager accessible data, as well as unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data. The attacker can exploit this issue by sending specially crafted HTTP requests. **Recommendations** For versions 12.2.1.3.0 and 12.2.1.4.0, consider restricting access to the Web Services Security component until a patch is available. As a temporary workaround, limit the use of HTTP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Access Manager versions 11.1.2.3.0 through 12.2.1.4.0 **Description** The issue is related to errors in processing HTTP requests in the Oracle Access Manager component of Oracle Fusion Middleware. This can allow a remote attacker to execute arbitrary code. Successful attacks can result in the takeover of Oracle Access Manager. The vulnerability can be easily exploited by an unauthenticated attacker with network access via HTTP. **Recommendations** For versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7 through 8.1.1 **Description** The issue is related to insufficient input validation in the Unified Metadata Manager component. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure, resulting in unauthorized read access to a subset of accessible data. **Recommendations** For versions 8.0.7 through 8.1.1, update to a version that includes the fix for this issue to prevent unauthorized access. As a temporary workaround, consider restricting access to the Unified Metadata Manager component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 **Description** The issue exists due to insufficient input validation in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition. This allows a remote attacker to gain full control over the application via the HTTP protocol. Successful attacks can result in the takeover of Oracle Business Intelligence Enterprise Edition. **Recommendations** For version 12.2.1.4.0, consider disabling the BIRemotingServlet to prevent deserialization of untrusted data until a patch is available. Restrict access to the Analytics Web General component to minimize the risk of exploitation. Avoid using the HTTP protocol to access the vulnerable component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description: The issue is related to inadequate access control in the Compensation Workbench component of Oracle E-Business Suite. It allows a low-privileged attacker with network access via HTTP to compromise the Oracle Compensation Workbench. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all accessible data, as well as unauthorized access to critical data. Recommendations: For versions 12.1.1 through 12.1.3, update to a version that includes the fix for this issue to prevent unauthorized access and data modification. At the moment, there is no information about a newer version that contains a fix for this vulnerability.