SB2020071662 - Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
Published: July 16, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2020-14684)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
2) Improper input validation (CVE-ID: CVE-2020-14604)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
3) Improper input validation (CVE-ID: CVE-2020-14603)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
4) Improper input validation (CVE-ID: CVE-2020-14615)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
5) Improper input validation (CVE-ID: CVE-2020-14601)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
6) Improper input validation (CVE-ID: CVE-2020-14662)
The vulnerability allows a remote authenticated user to read and manipulate data.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote authenticated user can exploit this vulnerability to read and manipulate data.
7) Improper input validation (CVE-ID: CVE-2020-14685)
The vulnerability allows a remote authenticated user to manipulate data.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote authenticated user can exploit this vulnerability to manipulate data.
8) Improper input validation (CVE-ID: CVE-2020-14605)
The vulnerability allows a remote authenticated user to manipulate data.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote authenticated user can exploit this vulnerability to manipulate data.
9) Improper input validation (CVE-ID: CVE-2020-14602)
The vulnerability allows a remote authenticated user to read and manipulate data.
The vulnerability exists due to improper input validation within the Infrastructure component in Oracle Financial Services Analytical Applications Infrastructure. A remote authenticated user can exploit this vulnerability to read and manipulate data.
10) Incorrect default permissions (CVE-ID: CVE-2020-1945)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to Apache Ant is using a default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process. A local user with access to the system can view contents of files and directories or modify them.
Remediation
Install update from vendor's website.