Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Advisory: Oracle Forms 10g Unauthenticated Remote Code Execution (CVE-2014-4278)

netspi.com | vulnerability | CVE-2014-4278 | #rce | #web-security | #input-validation | #oracle | #cve-2014-4278 | #oracle-forms

Summary

Oracle Forms 10g fails to validate the ifip parameter passed to ListenerServlet, letting unauthenticated attackers execute arbitrary commands; E-Business Suite 12.0.6-12.2.4 is also affected.
CVE
CVE-2014-4278
Published
Collected

original ↗

Related coverage

blog · netspi.com
Anonymous SQL Execution in Oracle Advanced Support
An exposed JavaScript file on an Oracle Advanced Support server revealed unauthenticated REST endpoints under /rest/data/ that executed arbitrary SQL, uncovered through external pentest recon.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
vulnerability · netspi.com
Oracle WebLogic Server Proxy Plugin (CVE-2026-21962): Overview & Takeaways
CVE-2026-21962 (CVSS 10.0) lets unauthenticated attackers bypass security in Oracle HTTP Server and WebLogic proxy plugins for Apache and IIS, exposing backend WebLogic systems in the DMZ.
vulnerability · netspi.com
CVE-2024-37888 – CKEditor 4 Open Link plugin XSS
CVE-2024-37888 is an XSS in CKEditor 4's Open Link plugin that lets crafted hyperlinks execute JavaScript in a victim's browser. Found during a client engagement, it affects latest plugin versions.
vulnerability · netspi.com
Weaponizing self-xss
Demonstrates turning self-XSS into real attacks, such as payloads that fire when admins view a user's profile, and suggests logging callbacks to prove impact when reporting these findings.
vulnerability · netspi.com
SQL Injection to Help You Sleep at Night
Argues production databases deserve care during pentests and shows read-only SQL injection habits across MySQL, MSSQL, and Oracle so testers can hunt vulnerabilities without corrupting live data.
back