Turki Al-Harthi

**Name of the Vulnerable Software and Affected Versions** OpenText Service Management Automation X (SMAX) versions 2020.05 through 2022.11 OpenText Asset Management X (AMX) versions 2021.08 through 2022.11 **Description** The issue is related to Insufficient Granularity of Access Control, allowing exploitation of incorrectly configured access control security levels. **Recommendations** For OpenText Service Management Automation X (SMAX) versions 2020.05 through 2022.11, update to a version that includes the fix for this issue. For OpenText Asset Management X (AMX) versions 2021.08 through 2022.11, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenText Service Management Automation X (SMAX) versions 2020.05 through 2023.05 OpenText Asset Management X (AMX) versions 2021.08 through 2023.05 OpenText Hybrid Cloud Management X (HCMX) versions 2020.05 through 2023.05 **Description** The issue is related to the misinterpretation of input data, which could allow input data manipulation. This affects OpenText Service Management Automation X (SMAX), OpenText Asset Management X (AMX), and OpenText Hybrid Cloud Management X (HCMX) products. **Recommendations** For OpenText Service Management Automation X (SMAX) versions 2020.05 through 2023.05, update to a version that includes the fix for this issue. For OpenText Asset Management X (AMX) versions 2021.08 through 2023.05, update to a version that includes the fix for this issue. For OpenText Hybrid Cloud Management X (HCMX) versions 2020.05 through 2023.05, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM Security Verify Governance, Identity Manager version 10.0.1 **Description** The issue is related to weaknesses in the authentication procedure of the Identity Manager component, which could allow an authenticated user to modify or cancel any other user's access request using man-in-the-middle techniques. This could potentially be exploited by a remote attacker. **Recommendations** For version 10.0.1, consider implementing additional authentication measures to prevent man-in-the-middle attacks, and restrict access to sensitive features that allow modification or cancellation of access requests until a patch is available. As a temporary workaround, consider disabling the vulnerable authentication procedure until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.2.3 through 12.2.11 **Description** The issue exists due to insufficient input validation in the Worklist component of the Oracle Workflow product. This allows a remote attacker to gain unauthorized access to protected information using the HTTP protocol. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data. **Recommendations** For versions 12.2.3 through 12.2.11, update to a version that includes the fix for this issue to prevent unauthorized access. As a temporary workaround, consider restricting access to the Worklist component until a patch is available. Restrict network access via HTTP to the Oracle Workflow product to minimize the risk of exploitation.