Tomasz Wisniewski

**Name of the Vulnerable Software and Affected Versions** Oracle Financial Services Analytical Applications Infrastructure versions 8.0.6 through 8.0.9 **Description** The issue is related to inadequate access control in the Infrastructure component of Oracle Financial Services Analytical Applications Infrastructure, part of the Oracle Financial Services Applications. This can be exploited by a remote attacker to gain unauthorized access to modify, add, or delete data, or to access protected information using the HTTP protocol. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to a subset of the data. **Recommendations** For versions 8.0.6 through 8.0.9, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Financial Services Analytical Applications Infrastructure versions 8.0.4 through 8.0.8 **Description** The issue is related to a lack of protection for internal data in the Object Migration component of Oracle Financial Services Analytical Applications Infrastructure. This allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 8.0.4 through 8.0.8, consider restricting access to the Object Migration component to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.