Quynh Le

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-822 versions 2.02KRB09 through 2.03WWb01 D-Link DIR-822-CA versions 2.02KRB09 through 2.03WWb01 **Description** The issue is related to a LAN-Side Unauthenticated Remote Code Execution (RCE) vulnerability elevated from HNAP Stack-Based Buffer Overflow. This vulnerability can be exploited by unauthenticated attackers to gain arbitrary remote code execution on the vulnerable router. **Recommendations** For D-Link DIR-822 versions 2.02KRB09 through 2.03WWb01: Replace the router immediately. For D-Link DIR-822-CA versions 2.02KRB09 through 2.03WWb01: Replace the router immediately. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle BI Publisher versions 5.5.0.0.0 through 12.2.1.4.0 **Description** The issue exists due to insufficient input validation in the Scheduler component of Oracle BI Publisher, part of the Oracle Fusion Middleware platform. This allows a remote attacker to execute arbitrary code and impact the confidentiality, integrity, and availability of protected information. Successful attacks can result in the takeover of Oracle BI Publisher. **Recommendations** For versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle BI Publisher versions 5.5.0.0.0 through 12.2.1.4.0 **Description** The issue is related to insufficient input validation in the E-Business Suite - XDO component of Oracle BI Publisher, part of the Oracle Fusion Middleware platform. This can be exploited by a remote attacker to execute arbitrary code and gain full control over the application via the HTTP protocol. The vulnerability can be easily exploited by a low-privileged attacker with network access. **Recommendations** For versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, consider disabling the `UpdateConnectionServlet` until a patch is available to prevent potential JNDI injection and remote code execution attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Platform Security for Java versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 **Description** The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java, potentially resulting in a takeover. This can be achieved due to a vulnerability in the OPSS component of Oracle Fusion Middleware. **Recommendations** For versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, update to a version that includes the fix for this issue to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 **Description** The issue exists due to insufficient input validation in the Web Services component of Oracle WebLogic Server, allowing a remote attacker to gain unauthorized access to the device via T3 and IIOP protocols. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the Oracle WebLogic Server. **Recommendations** For versions 10.3.6.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the T3 and IIOP protocols to minimize the risk of exploitation. Avoid using untrusted data in the deserialization process of the T3 protocol until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle OSS Support Tools versions prior to 2.12.41 **Description** The issue is related to the incorrect restriction of XML external entity references in the Diagnostic Assistant component of Oracle OSS Support Tools. This can allow a remote attacker to gain unauthorized access to sensitive information. Successful exploitation can result in unauthorized access to critical data or complete access to all accessible data. **Recommendations** For versions prior to 2.12.41, update to version 2.12.41 or later to resolve the issue. As a temporary workaround, consider restricting access to the Diagnostic Assistant component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. **Recommendations** For Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0, update to a version that includes the fix for this issue. For Oracle WebLogic Server version 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the IIOP and T3 protocols until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. **Recommendations** For Oracle WebLogic Server versions 12.2.1.3.0 and 12.2.1.4.0, update to a version that includes the fix for this issue. For Oracle WebLogic Server version 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the IIOP and T3 protocols until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 **Description** The issue is related to insufficient access control in the WLS Web Services component of Oracle WebLogic Server, allowing a high-privileged attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0, consider restricting access to the WLS Web Services component until a patch is available. As a temporary workaround, consider disabling the use of IIOP and T3 protocols to minimize the risk of exploitation. Restrict network access to the Oracle WebLogic Server to minimize the risk of remote attacks.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 **Description** The issue is related to the Core component of Oracle WebLogic Server and is caused by inadequate access control. It allows an unauthenticated attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. The vulnerability is easily exploitable and has been exploited in the wild. It is estimated that over 300 vulnerable servers could be exploited, leading to severe security threats. **Recommendations** For versions 10.3.6.0.0 through 12.2.1.4.0, update to a version that includes the fix for this issue, as provided in Oracle's April 2020 Critical Patch Update. As a temporary workaround, consider restricting access to the T3 protocol to minimize the risk of exploitation. Additionally, disabling the deserialization of untrusted data in the T3 protocol can help mitigate the issue until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 4.4.x through 4.4.220 Linux kernel versions 4.9.x through 4.9.220 Linux kernel versions 4.14.x through 4.14.177 Linux kernel versions 4.19.x through 4.19.118 Linux kernel versions 5.x through 5.2 **Description** A pivot root race condition in the Linux kernel's fs/namespace.c allows local users to cause a denial of service by corrupting a mountpoint reference counter, potentially leading to a system panic. This issue is related to synchronization errors when using shared resources. **Recommendations** For Linux kernel version 4.4.x, update to version 4.4.221 or later. For Linux kernel version 4.9.x, update to version 4.9.221 or later. For Linux kernel version 4.14.x, update to version 4.14.178 or later. For Linux kernel version 4.19.x, update to version 4.19.119 or later. For Linux kernel version 5.x, update to version 5.3 or later.