CVE Vulnerability Catalog

Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or potentially execute arbitrary code on the system.

A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by EdgeConnect SD-WAN Orchestrator.

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information beyond what is authorized by the user's existing privilege level.

Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct denial-of-service attacks. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.

A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system compromise.

Buffer overflow vulnerability in the underlying operating system of EdgeConnect SD-WAN Gateways. An unauthenticated adjacent attacker could execute arbitrary code if certain preconditions outside the attacker's control are met. Successful exploitation could lead to complete system compromise.

A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. An authenticated remote attacker with high privileges can execute arbitrary commands on the underlying operating system, leading to complete system compromise.

Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. An unauthenticated remote attacker can execute arbitrary code, leading to complete system compromise.

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator allow an unauthenticated remote attacker to bypass authentication controls. Successful exploitation could lead to gaining administrative privileges and complete compromise of the Orchestrator host.

A vulnerability in the SD-WAN Orchestrator may lead to exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this by sending a specially crafted request to the cache synchronization endpoint, resulting in disclosure of third-party API tokens and credentials.

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. A remote low-privileged authenticated user can escalate privileges to administrative level, leading to complete system compromise.

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. A remote low-privileged authenticated user can escalate privileges to administrative level, leading to complete system compromise.

Vulnerability in Siebel Apps - Marketing product of Oracle Siebel CRM. A high privileged attacker with network access via HTTP can compromise Siebel Apps - Marketing. Successful attacks can result in takeover of the component.

Vulnerability in Oracle Siebel CRM Deployment (component: Cloud Gateway) affecting versions 17.0-26.7. A low privileged attacker with network access via HTTP can exploit it, resulting in unauthorized creation, deletion or modification of data as well as unauthorized access to critical data.

Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.

Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTPS can easily exploit it, potentially impacting additional products (scope change). It results in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.6.

Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle JDeveloper. CVSS 3.1 Base Score: 9.8.