0Rich1

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 7.0 through 9.0 **Description** The issue is related to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources. **Recommendations** For versions 7.0 through 9.0, update to a version that includes a fix for the XML External Entity Injection (XXE) vulnerability. As a temporary workaround, consider restricting the processing of external XML entities to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient access control in the Console component of Oracle WebLogic Server, allowing a remote attacker to gain full control over the application via the HTTP protocol. This can result in the takeover of Oracle WebLogic Server. The vulnerability is easily exploitable and can be used by a high-privileged attacker with network access. **Recommendations** For Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Apache Flink versions 1.5.1 Description: A REST handler in Apache Flink allows writing an uploaded file to any location on the local file system through a maliciously modified HTTP HEADER. This issue enables files to be written to any location accessible by the software. Recommendations: For Apache Flink version 1.5.1, upgrade to Flink 1.11.3 or 1.12.0, especially if the Flink instance is exposed.

**Name of the Vulnerable Software and Affected Versions:** Apache Flink versions 1.11.0 through 1.11.2 **Description:** A change introduced in Apache Flink allows attackers to read any file on the local filesystem of the JobManager through the REST interface. Access is restricted to files accessible by the JobManager process. The vulnerability was actively exploited between November 2020 and January 2021, and is now listed in CISA’s Known Exploited Vulnerabilities catalog. A proof-of-concept (PoC) exploit is available, demonstrating a directory traversal attack via the `/jobmanager/logs` endpoint. **Recommendations:** Upgrade to Apache Flink version 1.11.3 or 1.12.0.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Oracle WebLogic Server, allowing a remote attacker to execute arbitrary code via the IIOP protocol. This can result in the takeover of the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, consider disabling the IIOP protocol until a patch is available to prevent exploitation. As a temporary workaround, restrict access to the Core component of the Oracle WebLogic Server to minimize the risk of exploitation. Avoid using the IIOP protocol in the affected Oracle WebLogic Server versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.