The TeamSHATTER blog is now part of Spiderlabs – Anterior
The TeamSHATTER blog is now part of Spiderlabs – Anterior
Posted 3 years ago

Many of you are probably already aware of the acquisition of Application Security, Inc. by Trustwave. As part of the acquisition, we are pleased to announce that TeamSHATTER is combining…

TeamSHATTER’s Analysis of the October 2013 Oracle CPU
TeamSHATTER’s Analysis of the October 2013 Oracle CPU
Posted 3 years ago

It’s the second Tuesday in October, so it is Oracle Critical Patch Update (CPU) time. The October 2013 CPU contains 127 fixes across Oracle’s Database, Fusion Middleware, Enterprise Manager, E-Business…

TeamSHATTER’s Analysis of the July 2013 Oracle CPU
TeamSHATTER’s Analysis of the July 2013 Oracle CPU
Posted 4 years ago

It is Oracle Critical Patch Update (CPU) time, so lace up your patching gloves. The July 2013 CPU contains 89 fixes across Oracle’s Database, Fusion Middleware, Hyperion, Enterprise Manager, E-Business…

PreviousNext
RSS

Security Experts Urge State Governments To Up Cyber Security Measures

USA Flag2

The email sent to several thousand of state employees in early February looked official. It featured the state logo and a familiar warning that email access was about to be cut off because the employee’s inbox was too full. The email invited employees to click on a link to solve the problem. If an employee clicked, a screen popped up asking for more data, including the employee’s name, login and password. It was a classic spear-fishing exploit with the hacker’s…

Click for complete article >>

Zendesk Hack Exposes Twitter, Pinterest And Tumblr Data

social media

Customer service software provider Zendesk announced a security breach that allowed attackers into its system, where they could access data from three customers this week. Wired learned those three clients were Twitter, Pinterest and Tumblr. The San Francisco-based company announced the breach in a blog post published early Thursday night. Tumblr notified affected users in an email at approximately 6:35 p.m. PST; Twitter and Pinterest are expected to do so shortly. Zendesk declined to comment beyond its blog post, titled, appropriately,…

Click for complete article >>

Advisory: Oracle Cross-site scripting in OEM (advReplicationAdmin)Team Shatter Exclusive

Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martinez Fayo of Application Security Inc. Details: Cross-site scripting vulnerabilities occur when an attacker tricks a legitimate web application into sending malicious code, generally in the form of a script, to an unsuspecting end user. The attack usually involves crafting a hyperlink with malicious script code embedded within it. A valid user is likely to…

Click for complete article >>

Advisory: Oracle Enterprise Manager Segment Advisor Arbitrary URL redirection/phishing vulnerabilityTeam Shatter Exclusive

Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4; 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Qinglin Jiang of Application Security Inc. Details: Oracle Enterprise Manager Database Control Segment Advisor page is vulnerable to an arbitrary URL redirection/phishing vulnerability. An attacker may inject an arbitrary URL into the web application and force the application to redirect to it without any validation. This vulnerability can be used in phishing attacks…

Click for complete article >>

Advisory: Oracle SQL Injection in OEM (streams queue)Team Shatter Exclusive

Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martínez Fayó of Application Security Inc. Details: SQL Injection works by attempting to modify the parameters passed to an application to change the SQL statements that are passed to a database. SQL injection can be used to insert additional SQL statements to be executed. Some parameters of /em/console/database/dist/streams/queue are vulnerable to SQL…

Click for complete article >>

Advisory: Oracle SQL Injection in OEM (SCPLBL_COLLECTED parameters)Team Shatter Exclusive

Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martínez Fayó of Application Security Inc. Details: SQL Injection works by attempting to modify the parameters passed to an application to change the SQL statements that are passed to a database. SQL injection can be used to insert additional SQL statements to be executed. Some parameters of /em/console/ecm/config/savedConfig are vulnerable to SQL Injection attacks. This…

Click for complete article >>

Advisory: Oracle SQL Injection in OEM (Resource Manager)Team Shatter Exclusive

Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martínez Fayó of Application Security Inc. Details: SQL Injection works by attempting to modify the parameters passed to an application to change the SQL statements that are passed to a database. SQL injection can be used to insert additional SQL statements to be executed. Some parameters of /em/console/database/instance/rsrcpln are vulnerable to SQL…

Click for complete article >>

Advisory: Oracle SQL Injection in OEM (dBClone)Team Shatter Exclusive

Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martínez Fayó of Application Security Inc. Details: SQL Injection works by attempting to modify the parameters passed to an application to change the SQL statements that are passed to a database. SQL injection can be used to insert additional SQL statements to be executed. Some parameters of /em/console/database/dbclone/dBClone are vulnerable to SQL…

Click for complete article >>

Advisory: Oracle SQL Injection in OEM (advReplicationAdmin)Team Shatter Exclusive

Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martinez Fayo of Application Security Inc. Details: SQL Injection works by attempting to modify the parameters passed to an application to change the SQL statements that are passed to a database. SQL injection can be used to insert additional SQL statements to be executed. Some parameters of /em/console/database/dist/advRepl/advReplicationAdmin are vulnerable to SQL Injection attacks. This…

Click for complete article >>

Advisory: HTTP Response Splitting in Orace Enterprise Manager (policyViewSettings)Team Shatter Exclusive

Risk Level: Medium Affected versions: Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martinez Fayo of Application Security Inc. Details: HTTP Response Splitting is a web application vulnerability where input parameters are unsafely used in response headers allowing an attacker to make the server print one (or more) new line sequences in the header section which allows to set arbitrary headers, take control of the body, or break…

Click for complete article >>
Powered by