CVE-2019-2843 | ByteOS Network

Vulnerability Details :

CVE-2019-2843

Assigner-oracle

Assigner Org ID-43595867-4340-4103-b7a2-9a5208d29a85

Published At-23 Jul, 2019 | 22:31

Updated At-01 Oct, 2024 | 16:36

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.1, 12.0.3, 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:oracle

Assigner Org ID:43595867-4340-4103-b7a2-9a5208d29a85

Published At:23 Jul, 2019 | 22:31

Updated At:01 Oct, 2024 | 16:36

▼CVE Numbering Authority (CNA)

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.1, 12.0.3, 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Affected Products

Vendor

Oracle Corporation

Product

FLEXCUBE Investor Servicing

Versions

Affected

12.0.1
12.0.3
12.0.4
12.1.0
12.3.0
12.4.0
14.0.0
14.1.0

Problem Types

Type	CWE ID	Description
text	N/A	Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data.

Type: text

CWE ID: N/A

Description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data.

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	x_refsource_MISC

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	x_refsource_MISC x_transferred

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Resource:

x_refsource_MISC

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:secalert_us@oracle.com

Published At:23 Jul, 2019 | 23:15

Updated At:24 Aug, 2020 | 17:37

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.1, 12.0.3, 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary	2.0	5.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:N

Type: Primary

Version: 3.0

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 5.5

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:N

CPE Matches

Oracle Corporation

>>flexcube_investor_servicing>>12.0.1

cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.1:*:*:*:*:*:*:*

Oracle Corporation

>>flexcube_investor_servicing>>12.0.3

cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.3:*:*:*:*:*:*:*

Oracle Corporation

>>flexcube_investor_servicing>>12.0.4

cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:*

Oracle Corporation

>>flexcube_investor_servicing>>12.1.0

cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*

Oracle Corporation

>>flexcube_investor_servicing>>12.3.0

cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*

Oracle Corporation

>>flexcube_investor_servicing>>12.4.0

cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*

Oracle Corporation

>>flexcube_investor_servicing>>14.0.0

cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:*

Oracle Corporation

>>flexcube_investor_servicing>>14.1.0

cpe:2.3:a:oracle:flexcube_investor_servicing:14.1.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	secalert_us@oracle.com	Patch Vendor Advisory

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: secalert_us@oracle.com

Resource:

Patch

Vendor Advisory

Similar CVEs

413Records found

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:05

Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Incentive Compensation. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Incentive Compensation accessible data as well as unauthorized access to critical data or complete access to all Oracle Incentive Compensation accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-incentive_compensation Incentive Compensation

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-2.46% / 84.65%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:04

Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Install and Upgrade). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Execution. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Transportation Execution accessible data as well as unauthorized access to critical data or complete access to all Oracle Transportation Execution accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-transportation_execution Transportation Execution

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:54

Updated-26 Sep, 2024 | 14:12

Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Engineering accessible data as well as unauthorized access to critical data or complete access to all Oracle Engineering accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-engineering Engineering

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:54

Updated-26 Sep, 2024 | 14:11

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Document Management). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Document Management and Collaboration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Document Management and Collaboration accessible data as well as unauthorized access to critical data or complete access to all Oracle Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-document_management_and_collaboration Document Management and Collaboration

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:54

Updated-26 Sep, 2024 | 14:09

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Profiles). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-application_object_library Application Object Library

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:06

Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (component: Compensation Workbench). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Compensation Workbench. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Compensation Workbench accessible data as well as unauthorized access to critical data or complete access to all Oracle Compensation Workbench accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-compensation_workbench Compensation Workbench

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:05

Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: DBI Setups). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Intelligence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Intelligence accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Intelligence accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-e-business_intelligence E-Business Intelligence

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:05

Vulnerability in the Oracle Cash Management product of Oracle E-Business Suite (component: Bank Account Transfer). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cash Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cash Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cash Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-cash_management Cash Management

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 14:57

Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Intelligence, RFx). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sourcing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sourcing accessible data as well as unauthorized access to critical data or complete access to all Oracle Sourcing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-sourcing Sourcing

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-1.25% / 78.53%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 14:56

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: View Reports). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-applications_manager Applications Manager

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:01

Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: India Localization, Results). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payables accessible data as well as unauthorized access to critical data or complete access to all Oracle Payables accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-payables Payroll

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.07% / 20.48%

||

7 Day CHG~0.00%

Published-09 Sep, 2022 | 16:00

Updated-17 Sep, 2024 | 00:32

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various attacks against the vulnerable system, including cache poisoning and cross-site scripting. IBM X-Force ID: 229429.

Vendor-Microsoft Corporation HP Inc.Apple Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Product-solaris linux_kernel websphere_application_server i hp-ux windows macos z\/os aix WebSphere Application Server Liberty WebSphere Application Server

CWE ID-CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:01

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: iRecruitment). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Human Resources accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-human_resources Human Resources

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.47% / 63.77%

||

7 Day CHG~0.00%

Published-19 Apr, 2018 | 02:00

Updated-03 Oct, 2024 | 20:12

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Enterprise Management Console). Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony First Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Simphony First Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Simphony First Edition accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-hospitality_simphony Hospitality Simphony First Edition

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:00

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Endeca). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-purchasing Purchasing

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:02

Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Loan Details, Loan Accounting Events). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Loans accessible data as well as unauthorized access to critical data or complete access to all Oracle Loans accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-loans Loans

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.67% / 81.37%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 14:12

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Template, GTIN search). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Hub accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-product_hub Product Hub

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:01

Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Quotes). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Lease and Finance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Lease and Finance Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Lease and Finance Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-lease_and_finance_management Lease and Finance Management

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 14:56

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Resource Exceptions). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-work_in_progress Work in Process

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:05

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Setup). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Asset Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-enterprise_asset_management Enterprise Asset Management

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.6||HIGH

EPSS-0.47% / 63.67%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:30

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Document Management and Collaboration. While the vulnerability is in Oracle Document Management and Collaboration, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Document Management and Collaboration accessible data as well as unauthorized update, insert or delete access to some of Oracle Document Management and Collaboration accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).

Vendor-Oracle Corporation

Product-document_management_and_collaboration Document Management and Collaboration

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.02% / 76.29%

||

7 Day CHG~0.00%

Published-18 Jul, 2018 | 13:00

Updated-02 Oct, 2024 | 20:10

Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications (subcomponent: Gangway Activity Web App). The supported version that is affected is 9.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management System. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Cruise Fleet Management System accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management System accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-hospitality_cruise_fleet_management Hospitality Cruise Fleet Management

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.19% / 40.70%

||

7 Day CHG~0.00%

Published-19 Apr, 2018 | 02:00

Updated-03 Oct, 2024 | 20:17

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Client Application Loader). Supported versions that are affected are 2.8 and 2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data as well as unauthorized read access to a subset of Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Vendor-Oracle Corporation

Product-hospitality_simphony Hospitality Simphony

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.1||HIGH

EPSS-0.25% / 47.84%

||

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-03 Oct, 2024 | 20:37

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Report). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

Vendor-Oracle Corporation

Product-hospitality_reporting_and_analytics Hospitality Reporting and Analytics

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.22% / 78.27%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:34

Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customers Online accessible data as well as unauthorized access to critical data or complete access to all Oracle Customers Online accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-customers_online Customers Online

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.85% / 74.03%

||

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-03 Oct, 2024 | 20:25

Vulnerability in the Oracle Financial Services Market Risk component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Market Risk. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Market Risk accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Market Risk accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-financial_services_market_risk Financial Services Market Risk

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 47.21%

||

7 Day CHG~0.00%

Published-21 Jul, 2016 | 10:00

Updated-08 May, 2025 | 18:13

Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality and integrity via vectors related to PC Core.

Vendor-n/a Oracle Corporation

Product-agile_product_lifecycle_management n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 47.21%

||

7 Day CHG~0.00%

Published-21 Jul, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to Configuration.

Vendor-n/a Oracle Corporation

Product-e-business_suite n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 33.98%

||

7 Day CHG~0.00%

Published-21 Apr, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to ePerformance.

Vendor-n/a Oracle Corporation

Product-peoplesoft_enterprise_human_capital_management_eperformance n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 42.05%

||

7 Day CHG~0.00%

Published-18 Jul, 2018 | 13:00

Updated-02 Oct, 2024 | 20:06

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Vendor-Oracle Corporation

Product-peoplesoft_enterprise_peopletools PeopleSoft Enterprise PT PeopleTools

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-1.35% / 79.34%

||

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:49

Updated-26 Sep, 2024 | 18:45

Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Report). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-hospitality_reporting_and_analytics Hospitality Reporting and Analytics

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.97% / 75.69%

||

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-03 Oct, 2024 | 20:26

Vulnerability in the Oracle Financial Services Price Creation and Discovery component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Price Creation and Discovery. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Price Creation and Discovery accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Price Creation and Discovery accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-financial_services_price_creation_and_discovery Financial Services Price Creation and Discovery

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.97% / 75.69%

||

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-03 Oct, 2024 | 20:26

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications (subcomponent: User Interface). Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Asset Liability Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Asset Liability Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Asset Liability Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-financial_services_asset_liability_management Financial Services Asset Liability Management

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.4||MEDIUM

EPSS-56.75% / 98.04%

||

7 Day CHG~0.00%

Published-22 Mar, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

Vendor-n/a OpenBSD Oracle Corporation

Product-vm_server openssh n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-3.8||LOW

EPSS-0.19% / 41.38%

||

7 Day CHG~0.00%

Published-19 Apr, 2018 | 02:00

Updated-03 Oct, 2024 | 20:18

Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcomponent: Ipmitool). The supported version that is affected is Prior to 2.4.3. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Hardware Management Pack. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hardware Management Pack accessible data as well as unauthorized read access to a subset of Hardware Management Pack accessible data. CVSS 3.0 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

Vendor-Oracle Corporation

Product-hardware_management_pack SSM - (ssm_host_apps) HMP: Hardware Management Pack

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 42.05%

||

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-03 Oct, 2024 | 20:45

Vulnerability in the Oracle Communications Unified Inventory Management component of Oracle Communications Applications (subcomponent: Portal). Supported versions that are affected are 7.2.4.2.x and 7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Unified Inventory Management accessible data as well as unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Vendor-Oracle Corporation

Product-communications_unified_inventory_management Communications Unified Inventory Management

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.97% / 75.69%

||

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-03 Oct, 2024 | 20:25

Vulnerability in the Oracle Financial Services Market Risk Measurement and Management component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Market Risk Measurement and Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Market Risk Measurement and Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Market Risk Measurement and Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-financial_services_market_risk_measurement_and_management Financial Services Market Risk Measurement and Management

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.97% / 75.69%

||

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-03 Oct, 2024 | 20:26

Vulnerability in the Oracle Financial Services Loan Loss Forecasting and Provisioning component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Loan Loss Forecasting and Provisioning. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Loan Loss Forecasting and Provisioning accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Loan Loss Forecasting and Provisioning accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-financial_services_loan_loss_forecasting_and_provisioning Financial Services Loan Loss Forecasting and Provisioning

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.47% / 63.77%

||

7 Day CHG~0.00%

Published-19 Apr, 2018 | 02:00

Updated-03 Oct, 2024 | 20:14

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Enterprise Management Console). Supported versions that are affected are 2.7, 2.8, 2.9 and 2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Simphony accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-hospitality_simphony Hospitality Simphony

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.52% / 65.98%

||

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-03 Oct, 2024 | 20:35

Vulnerability in the Oracle Hospitality Labor Management component of Oracle Hospitality Applications (subcomponent: Webservice Endpoint). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Labor Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Labor Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Labor Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-Oracle Corporation

Product-hospitality_labor_management Hospitality Labor Management

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.97% / 75.69%

||

7 Day CHG~0.00%

Published-19 Apr, 2018 | 02:00

Updated-03 Oct, 2024 | 20:11

Vulnerability in the Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach component of Oracle Financial Services Applications (subcomponent: Portfolio, Attribution). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Vendor-n/a Oracle Corporation

Product-financial_services_basel_regulatory_capital_internal_ratings_based_approach n/a

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-0.48% / 63.91%

||

7 Day CHG~0.00%

Published-18 Jan, 2017 | 22:00

Updated-20 Apr, 2025 | 01:37

RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request.

Vendor-n/a Linux Kernel Organization, Inc Oracle Corporation IBM Corporation CA Technologies (Broadcom Inc.)Microsoft Corporation

Product-solaris aix linux_kernel service_desk_manager service_desk_management windows n/a

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.77% / 72.58%

||

7 Day CHG~0.00%

Published-16 Apr, 2008 | 10:00

Updated-07 Aug, 2024 | 08:32

Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented on reliable researcher claims that APEX01 is for insufficient authorization checks for SQL commands in the run_ddl function in flows_030000.wwv_execute_immediate, allowing privilege escalation by certain non-DBA remote authenticated users.

Vendor-n/a Oracle Corporation

Product-application_express n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.5||MEDIUM

EPSS-0.16% / 37.85%

||

7 Day CHG~0.00%

Published-21 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to BI Publisher Security.

Vendor-n/a Oracle Corporation

Product-fusion_middleware n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 34.68%

||

7 Day CHG~0.00%

Published-21 Apr, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to File Processing.

Vendor-n/a Oracle Corporation

Product-peoplesoft_enterprise_peopletools n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.5||MEDIUM

EPSS-0.16% / 37.85%

||

7 Day CHG~0.00%

Published-21 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle Advanced Collections component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Administration, a different vulnerability than CVE-2016-0556.

Vendor-n/a Oracle Corporation

Product-advanced_collections n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 33.98%

||

7 Day CHG~0.00%

Published-21 Apr, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the PeopleSoft Enterprise SCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Services Procurement.

Vendor-n/a Oracle Corporation

Product-peoplesoft_supply_chain_management_eprocurement n/a

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.1||HIGH

EPSS-0.32% / 54.03%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-27 Sep, 2024 | 18:48

Vulnerability in the Oracle Financial Services Funds Transfer Pricing product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.6 and 8.0.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Funds Transfer Pricing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Funds Transfer Pricing accessible data as well as unauthorized read access to a subset of Oracle Financial Services Funds Transfer Pricing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

Vendor-Oracle Corporation

Product-financial_services_funds_transfer_pricing Financial Services Funds Transfer Pricing

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.1||HIGH

EPSS-0.32% / 54.03%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-27 Sep, 2024 | 18:48

Vulnerability in the Oracle Financial Services Profitability Management product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.6 and 8.0.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Profitability Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Profitability Management accessible data as well as unauthorized read access to a subset of Oracle Financial Services Profitability Management accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

Vendor-Oracle Corporation

Product-financial_services_profitability_management Financial Services Profitability Management

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.5||MEDIUM

EPSS-0.16% / 37.85%

||

7 Day CHG~0.00%

Published-21 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0564.

Vendor-n/a Oracle Corporation

Product-e-business_intelligence n/a