ByteOS

FLEXCUBE Investor Servicing

Product

Versions

Affected

12.0.4
12.1.0
12.3.0
12.4.0

Problem Types

Type	CWE ID	Description
text	N/A	Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Investor Servicing.

Type: text

CWE ID: N/A

Description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Investor Servicing.

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	x_refsource_CONFIRM
http://www.securitytracker.com/id/1041307	vdb-entry x_refsource_SECTRACK
http://www.securityfocus.com/bid/104793	vdb-entry x_refsource_BID

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securitytracker.com/id/1041307

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://www.securityfocus.com/bid/104793

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	x_refsource_CONFIRM x_transferred
http://www.securitytracker.com/id/1041307	vdb-entry x_refsource_SECTRACK x_transferred
http://www.securityfocus.com/bid/104793	vdb-entry x_refsource_BID x_transferred

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securitytracker.com/id/1041307

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://www.securityfocus.com/bid/104793

Resource:

vdb-entry

x_refsource_BID

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:18 Jul, 2018 | 13:29

Updated At:03 Oct, 2019 | 00:03

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary	2.0	5.5	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:P

Type: Primary

Version: 3.0

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Type: Primary

Version: 2.0

Base score: 5.5

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:N/I:P/A:P

CPE Matches

cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:*

>>flexcube_investor_servicing>>12.0.4

cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*

>>flexcube_investor_servicing>>12.1.0

cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*

>>flexcube_investor_servicing>>12.3.0

cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*

>>flexcube_investor_servicing>>12.4.0

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	secalert_us@oracle.com	Patch Vendor Advisory
http://www.securityfocus.com/bid/104793	secalert_us@oracle.com	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041307	secalert_us@oracle.com	Third Party Advisory VDB Entry

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: secalert_us@oracle.com

Resource:

Patch

Vendor Advisory

Hyperlink: http://www.securityfocus.com/bid/104793

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1041307

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

VDB Entry

Similar CVEs

59Records found

CVE-2018-3060

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.14% / 35.30%

7 Day CHG~0.00%

Published-18 Jul, 2018 | 13:00

Updated-02 Oct, 2024 | 19:54

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.22 and prior and 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H).

Vendor-MariaDB Foundation NetApp, Inc.Oracle Corporation Canonical Ltd.

Product-ubuntu_linux snapcenter mariadb storage_automation_store oncommand_workflow_automation mysql oncommand_insight MySQL Server

CVE-2018-3043

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.49% / 64.58%

7 Day CHG~0.00%

Published-18 Jul, 2018 | 13:00

Updated-02 Oct, 2024 | 20:02

Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.3.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Enterprise Limits and Collateral Management. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

Product-flexcube_enterprise_limits_and_collateral_management FLEXCUBE Enterprise Limits and Collateral Management

CVE-2018-3023

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.49% / 64.58%

7 Day CHG~0.00%

Published-18 Jul, 2018 | 13:00

Updated-02 Oct, 2024 | 20:05

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.2.0, 12.3.0, 12.4.0, 12.5.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Payments accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Payments. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

Product-banking_payments Banking Payments

CVE-2018-2980

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.49% / 64.58%

7 Day CHG~0.00%

Published-18 Jul, 2018 | 13:00

Updated-02 Oct, 2024 | 20:11

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0, 12.4.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

Product-flexcube_universal_banking FLEXCUBE Universal Banking

CVE-2014-6489

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.5||MEDIUM

EPSS-0.60% / 68.41%

7 Day CHG~0.00%

Published-15 Oct, 2014 | 22:03

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect integrity and availability via vectors related to SERVER:SP.

Vendor-n/a Oracle Corporation MariaDB Foundation

Product-mariadb mysql n/a

CVE-2018-3195

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.5||MEDIUM

EPSS-0.32% / 54.11%

7 Day CHG~0.00%

Published-17 Oct, 2018 | 01:00

Updated-02 Oct, 2024 | 19:37

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

Vendor-Microsoft Corporation NetApp, Inc.Oracle Corporation

Product-oncommand_insight windows oncommand_workflow_automation oncommand_unified_manager mysql snapcenter MySQL Server

CVE-2018-3247

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.5||MEDIUM

EPSS-0.47% / 63.80%

7 Day CHG~0.00%

Published-17 Oct, 2018 | 01:00

Updated-02 Oct, 2024 | 19:31

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Merge). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

Vendor-Microsoft Corporation NetApp, Inc.Canonical Ltd.Oracle Corporation

Product-ubuntu_linux oncommand_insight storage_automation_store windows oncommand_workflow_automation oncommand_unified_manager mysql snapcenter MySQL Server

CVE-2018-2787

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.5||MEDIUM

EPSS-0.08% / 25.51%

7 Day CHG~0.00%

Published-19 Apr, 2018 | 02:00

Updated-03 Oct, 2024 | 20:18

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

Vendor-MariaDB Foundation Oracle Corporation Canonical Ltd.

Product-ubuntu_linux mysql mariadb MySQL Server

CVE-2019-2731

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.50% / 64.99%

7 Day CHG~0.00%

Published-23 Jul, 2019 | 22:31

Updated-01 Oct, 2024 | 16:45

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).