Thiscodecc

An SQL injection issue exists due to insufficient neutralization of special elements used in SQL commands. The flaw affects the `/fineract-provider/api/v1/search/advance` API endpoint via the `outStandingAmountPercentageCondition` parameter.

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations (affected versions not specified) Description: The issue is related to a local privilege escalation vulnerability in VMware Aria Operations. A malicious actor with local administrative privileges can exploit this vulnerability to escalate privileges to the root user on the device running VMware Aria Operations. The vulnerability is associated with errors in privilege management. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations (affected versions not specified) Description: The issue is related to errors in privilege management in the VMware Aria Operations tool, which can be exploited to escalate privileges. A malicious actor with local administrative privileges can insert malicious commands into the properties file to gain root user access on the device running VMware Aria Operations. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue arises from the lack of validation of the sort field sent from the front-end to the back-end, which is used to generate SQL queries. This poses a risk of SQL injection, potentially leading to data leakage. An attacker must first successfully log into the system to exploit this issue. The impact is considered low since no data can be written through this vulnerability.

The issue is related to a local privilege escalation, where a malicious actor with administrative access to the local system can escalate privileges to 'root'. This is due to insufficient access control in the monitoring tool of the virtual infrastructure.

The issue is related to an Improper Input Validation vulnerability in Apache Axis, which allows users with access to the admin service to perform possible Server-Side Request Forgery (SSRF). This could potentially lead to unauthorized access to internal resources. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to incorrect handling of the `<` element in the Project Module of Apache StreamPark, allowing for remote command execution. The vulnerability can be exploited by inserting commands, such as using the `<` operator to execute arbitrary commands, for example, `< (curl http://xxx.com )`. The risk level of this vulnerability is considered low, as it requires the attacker to have system-level permissions and log in to the StreamPark system.

The vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition product is related to the CORBA component. It allows an unauthenticated attacker with network access via CORBA to compromise the system. Successful attacks can result in unauthorized update, insert, or delete access to some of the accessible data. This vulnerability can only be exploited by supplying data to APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.

The issue is related to insecure privilege management in VMware Aria Operations, allowing a malicious actor with administrative access to the local system to escalate privileges to 'root'. This could enable the execution of arbitrary code with root privileges.

The issue is related to a Local privilege escalation vulnerability in VMware Aria Operations. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system. The vulnerability is also associated with insufficient access control in the virtual infrastructure monitoring tool.

The issue is related to insufficient access control in the VMware Aria Operations tool, which can be exploited to execute arbitrary code and escalate privileges. A malicious actor with administrative access to the local system can escalate privileges to 'root'.

The issue is related to errors in handling input data in the Core component of the Oracle WebLogic Server. It allows an unauthenticated attacker with network access via T3 to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the Oracle WebLogic Server.

The issue is related to insufficient authentication of executed requests in the vRealize Operations (vROps) tool, allowing a remote attacker to perform a CSRF attack. This could enable a malicious user to execute actions on the vROps platform on behalf of an authenticated victim user.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This can be exploited by a remote attacker to disclose sensitive information. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access via IIOP.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3, IIOP to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. It is estimated that millions of servers worldwide are affected, with 166,000 in Brazil alone.

The issue is related to a broken access control vulnerability in the VMware vRealize Operations tool, which can lead to information disclosure. This vulnerability may allow a remote attacker to disclose protected information. The severity of this issue is considered moderate.

The issue is related to improper privilege management in vRealize Operations, which can lead to a privilege escalation. This allows a remote attacker to potentially elevate their privileges.

The issue is related to insufficient input validation in the Core component of Oracle Coherence, allowing an unauthenticated attacker with network access via T3 or IIOP protocols to compromise Oracle Coherence. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence.

The issue is related to insufficient input validation in the Sample apps component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle WebLogic Server's accessible data, as well as unauthorized read access to a subset of the server's accessible data.

The issue is related to insufficient input validation in the Oracle WebLogic Server Core component. This can be exploited by a remote attacker to gain unauthorized access to read, modify, or delete data, or to cause a denial of service using T3 network protocols. Successful attacks can result in unauthorized update, insert, or delete access to some of Oracle WebLogic Server's accessible data and can cause a partial denial of service.