Veronica Venturi

**Name of the Vulnerable Software and Affected Versions** IBM UrbanCode Deploy versions 6.2.0.0 through 6.2.7.18 IBM UrbanCode Deploy versions 7.0.5.0 through 7.0.5.13 IBM UrbanCode Deploy versions 7.1.0.0 through 7.1.2.9 IBM UrbanCode Deploy versions 7.2.0.0 through 7.2.3.2 IBM UrbanCode Deploy version 7.3.0.0 **Description** This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. **Recommendations** For IBM UrbanCode Deploy versions 6.2.0.0 through 6.2.7.18, update to a version outside of this range to resolve the issue. For IBM UrbanCode Deploy versions 7.0.5.0 through 7.0.5.13, update to a version outside of this range to resolve the issue. For IBM UrbanCode Deploy versions 7.1.0.0 through 7.1.2.9, update to a version outside of this range to resolve the issue. For IBM UrbanCode Deploy versions 7.2.0.0 through 7.2.3.2, update to a version outside of this range to resolve the issue. For IBM UrbanCode Deploy version 7.3.0.0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the Web UI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 **Description** The issue is related to insufficient input validation in the Analytics Web General component. It allows a high-privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition, but successful attacks require human interaction from a person other than the attacker. This can result in unauthorized update, insert, or delete access to some of Oracle Business Intelligence Enterprise Edition's accessible data, as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition's accessible data. **Recommendations** For versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, consider restricting access to the Analytics Web General component until a patch is available. As a temporary workaround, consider disabling HTTP requests to minimize the risk of exploitation. Restrict access to sensitive data to minimize the impact of potential unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.