Sarath Nair

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6 **Description** The issue affects the Oracle Application Object Library component, specifically the iHelp subcomponent. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks can result in unauthorized access to critical data, complete access to all Oracle Application Object Library accessible data, as well as unauthorized update, insert, or delete access to some of Oracle Application Object Library accessible data. **Recommendations** For versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6, update to a version that includes the fix for this issue to prevent unauthorized access and data manipulation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Joomla! CMSJunkie J-ClassifiedsManager component (affected versions not specified) **Description** A SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `id` parameter in a `viewad` task to `classifieds/offerring-ads`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Joomla! CMSJunkie J-ClassifiedsManager component (affected versions not specified) **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `view` parameter to the "/classifieds" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.