Dmitry Chastuhin

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 **Description** The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Scripting, resulting in unauthorized creation, deletion, or modification access to critical data or all Oracle Scripting accessible data, as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. **Recommendations** For versions 12.1.1, 12.1.2, 12.1.3, update to a version that includes the fix for this issue. For versions 12.2.3, 12.2.4, 12.2.5, 12.2.6, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP NetWeaver versions 7.4 SAP Manufacturing Integration and Intelligence (xMII) component version 15.0 **Description** The issue is related to a directory traversal vulnerability in the SAP Manufacturing Integration and Intelligence (xMII) component. This vulnerability allows a remote attacker to read arbitrary files by exploiting weaknesses in path name restrictions. The vulnerability can be exploited through the `GetFileList` function by using a .. (dot dot) in the `Path` parameter to the "/Catalog" endpoint. **Recommendations** For SAP NetWeaver version 7.4 with the SAP Manufacturing Integration and Intelligence (xMII) component version 15.0, consider restricting access to the `GetFileList` function until a patch is available. As a temporary workaround, avoid using the `Path` parameter in the "/Catalog" endpoint to minimize the risk of exploitation.