CVSS: 7.5EPSS: 92%CPEs: 5EXPL: 0CVE-2015-2606 – Oracle Endeca Information Discovery Integrator ETL Server RenameFile Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-2606
Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2605, and CVE-2015-4745. Vulnerabilidad no especificada en el componente Oracle Endeca Information Discovery Studio en Oracle Fusion Middleware de las versiones 2.2.2, 2.3, 2.4, 3.0 y 3.1, permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Integrator, una vulnerabilidad diferente a CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2605 y CVE-2015-4745. This vulnerability allows remote attackers the ability to execute arbitrary code on vulnerable instances of Oracle Endeca Information Discovery. Authentication is required to exploit this vulnerability but an authentication bypass is known. The specific flaw exists in the handling of the RenameFile endpoint. The issue lies in the failure to properly sanitize the path of files. • http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.securityfocus.com/bid/75758 http://www.zerodayinitiative.com/advisories/ZDI-15-352 •
CVSS: 7.5EPSS: 92%CPEs: 5EXPL: 0CVE-2015-4745 – Oracle Endeca Information Discovery Integrator ETL Server File Download Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-4745
Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2605, and CVE-2015-2606. Vulnerabilidad no especificada en el componente Oracle Endeca Information Discovery Studio en Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0 y 3.1, permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Integrator, una vulnerabilidad diferente a CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2605 y CVE-2015-2606. This vulnerability allows remote attackers to execute arbitrary code on vulnerable instances of Oracle Endeca Information Discovery. Authentication is required to exploit this vulnerability but an authentication bypass is known. The specific flaw exists within the handling of file downloads. The issue lies in the failure to sanitize the path of files to be downloaded. • http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.securityfocus.com/bid/75750 http://www.zerodayinitiative.com/advisories/ZDI-15-357 •
CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 0CVE-2015-0461
https://notcve.org/view.php?id=CVE-2015-0461
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Authentication Engine. Vulnerabilidad no especificada en el componente Oracle Access Manager en Oracle Fusion Middleware 11.1.1.5 y 11.1.1.7 permite a usuarios remotos autenticados afectar la confidencialidad y la integridad a través de vectores desconocidos relacionados con Authentication Engine. • http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html http://www.securitytracker.com/id/1032131 •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0451
https://notcve.org/view.php?id=CVE-2015-0451
Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 3.0-04 allows remote authenticated users to affect confidentiality via vectors related to OpenSSO Web Agents. Vulnerabilidad no especificada en el componente Oracle OpenSSO en Oracle Fusion Middleware 3.0-04 permite a usuarios remotos autenticados afectar la confidencialidad a través de vectores relacionados con OpenSSO Web Agents. • http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html http://www.securitytracker.com/id/1032131 •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0449
https://notcve.org/view.php?id=CVE-2015-0449
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect integrity via unknown vectors related to Console. Vulnerabilidad no especificada en el componente Oracle WebLogic Server en Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, y 12.1.2.0 permite a atacantes remotos afectar la integridad a través de vectores desconocidos relacionados con Console. • http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html http://www.securitytracker.com/id/1032131 •