John Simpson

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.10 Description: The issue allows a low-privileged attacker with network access via HTTP to compromise Oracle Sales Offline, resulting in a partial denial of service (DOS) of Oracle Sales Offline. This can be achieved due to a vulnerability in the Oracle Sales Offline product, specifically in the Offline Template component. Recommendations: For versions 12.1.1 through 12.1.3, update to a version outside of this range to mitigate the risk. For versions 12.2.3 through 12.2.10, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the HTTP endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite Human Resources versions 12.1.1 through 12.1.3 Oracle E-Business Suite Human Resources versions 12.2.3 through 12.2.9 **Description** The issue is related to inadequate access control in the Hierarchy Diagrammers component of Oracle Human Resources, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as complete access to all accessible data. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions 12.1.1 through 12.1.3, update to a version outside of this range to mitigate the risk. For versions 12.2.3 through 12.2.9, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Hierarchy Diagrammers component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite Human Resources versions 12.1.1 through 12.1.3 Oracle E-Business Suite Human Resources versions 12.2.3 through 12.2.9 **Description** The issue is related to inadequate access control in the Hierarchy Diagrammers component of Oracle Human Resources, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as complete access to all accessible data. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions 12.1.1 through 12.1.3, update to a version outside of this range to mitigate the risk. For versions 12.2.3 through 12.2.9, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Hierarchy Diagrammers component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Windows Deployment Services TFTP Server (affected versions not specified) **Description** A remote code execution issue exists due to incorrect handling of objects in memory by the Windows Deployment Services TFTP Server. This allows an attacker to execute arbitrary code with elevated permissions on a target system by creating a specially crafted request. The issue is resolved by correcting how the server handles objects in memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.