Przemysław Mazurek

**Name of the Vulnerable Software and Affected Versions** Oracle WebCenter Portal version 12.2.1.4.0 **Description** The vulnerability in the Oracle WebCenter Portal product is related to insufficient protection of internal data. It allows a remote attacker to gain unauthorized access to read, add, modify, or delete protected information via the HTTP protocol. Successful attacks require human interaction and may significantly impact additional products. The vulnerability can result in unauthorized update, insert, or delete access to some Oracle WebCenter Portal accessible data, as well as unauthorized read access to a subset of Oracle WebCenter Portal accessible data. **Recommendations** For version 12.2.1.4.0, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** StrangeBee TheHive versions 4.1.21 through 5.0.8 Cortex version 3.1.6 **Description** An issue in the software allows a remote attacker to gain privileges via the Active Directory authentication mechanism. **Recommendations** For StrangeBee TheHive versions 4.1.21 through 5.0.8, consider disabling the Active Directory authentication mechanism until a patch is available. For Cortex version 3.1.6, restrict access to the Active Directory authentication mechanism to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Hyperion Financial Reporting version 11.2.13.0.000 **Description** The issue is related to insecure privilege management in the Repository component of Oracle Hyperion Financial Reporting. It allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, or a partial denial of service. The vulnerability may significantly impact additional products due to scope change. **Recommendations** For version 11.2.13.0.000, consider restricting access to the Repository component until a patch is available. As a temporary workaround, limit the use of HTTP network access to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Hyperion Workspace version 11.2.13.0.000 **Description** The issue is related to insecure privilege management in the UI and Visualization component of Oracle Hyperion Workspace. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Hyperion Workspace. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized creation, deletion, or modification access to critical data, as well as unauthorized access to critical data and the ability to cause a partial denial of service. **Recommendations** For Oracle Hyperion Workspace version 11.2.13.0.000, consider applying security patches or updates to fix the vulnerability, as no specific workaround is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.