Waleed Ezz Eldin

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.10 **Description** The issue is related to insufficient input validation in the Attachments / File Upload component of Oracle Applications Framework, allowing a low-privileged attacker with network access via HTTP to compromise the framework. Successful attacks require human interaction and may significantly impact additional products, resulting in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.3 and 12.2.3 through 12.2.10, consider disabling the Attachments / File Upload component until a patch is available to prevent exploitation. Restrict access to the Attachments / File Upload component to minimize the risk of unauthorized data modification or access. Avoid using the HTTP protocol for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle FLEXCUBE Direct Banking versions 12.0.2 through 12.0.3 **Description** The issue exists due to insufficient input validation in the Pre Login component of Oracle FLEXCUBE Direct Banking. This allows a remote attacker to modify data or gain privileged access via network packets. The exploitation is difficult and requires human interaction from someone other than the attacker, resulting in potential unauthorized access to update, insert, or delete some accessible data. **Recommendations** For versions 12.0.2 and 12.0.3, consider restricting network access via Oracle Net to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit privileged access to the Pre Login component to reduce the potential impact of the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows JET Database Engine (affected versions not specified) **Description** The issue is related to errors in object handling in memory within the JET Database Engine of the Windows operating system. It allows remote attackers to execute arbitrary code by using a specially crafted file. This can potentially affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.