ByteOS

Enterprise Command Center Framework

Product

Versions

Affected

ECC: 8
9
10

Problem Types

Type	CWE ID	Description
N/A	N/A	Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data.

Type: N/A

CWE ID: N/A

Description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data.

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	vendor-advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	vendor-advisory x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Resource:

vendor-advisory

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:17 Oct, 2023 | 22:15

Updated At:23 Oct, 2023 | 18:21

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CPE Matches

cpe:2.3:a:oracle:enterprise_command_center_framework:8.0:*:*:*:*:*:*:*

>>enterprise_command_center_framework>>8.0

cpe:2.3:a:oracle:enterprise_command_center_framework:9.0:*:*:*:*:*:*:*

>>enterprise_command_center_framework>>9.0

cpe:2.3:a:oracle:enterprise_command_center_framework:10.0:*:*:*:*:*:*:*

>>enterprise_command_center_framework>>10.0

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	secalert_us@oracle.com	Patch Vendor Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Source: secalert_us@oracle.com

Resource:

Patch

Vendor Advisory

Similar CVEs

58Records found

CVE-2020-14744

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.57% / 68.18%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:30

Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services (component: General). Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c; Standalone ORDS: prior to 20.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Product-rest_data_services REST Data Services

CVE-2020-14887

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.40% / 60.15%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:04

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Product-flexcube_universal_banking FLEXCUBE Universal Banking

CVE-2017-10379

Matching Score-8

Assigner-Oracle

Product-enterprise_linux_desktop oncommand_unified_manager oncommand_balance enterprise_linux_server_tus enterprise_linux_eus enterprise_linux_workstation active_iq_unified_manager debian_linux enterprise_linux_server enterprise_linux_server_aus oncommand_insight openstack oncommand_performance_manager snapcenter mariadb mysql oncommand_workflow_automation n/a

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.38% / 59.05%

7 Day CHG+0.03%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Vendor-n/a Debian GNU/Linux Red Hat, Inc.MariaDB Foundation Oracle Corporation NetApp, Inc.

CWE ID-CWE-863

Incorrect Authorization

CVE-2021-29683

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.09% / 24.94%

7 Day CHG~0.00%

Published-20 May, 2021 | 15:10

Updated-17 Sep, 2024 | 00:02

IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998.

Vendor-Oracle Corporation IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-security_identity_manager solaris linux_kernel windows aix Security Identity Manager

CWE ID-CWE-312

Cleartext Storage of Sensitive Information

CVE-2022-22483

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 52.41%

7 Day CHG~0.00%

Published-13 Sep, 2022 | 20:45

Updated-16 Sep, 2024 | 17:04

IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. IBM X-Force ID: 225979.

Product-solaris linux_kernel db2 hp-ux windows aix DB2 for Linux, UNIX and Windows

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-30717

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 52.21%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-02 Jul, 2025 | 16:31

Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Diagnostics Scripts). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Teleservice. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Teleservice accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Product-teleservice Oracle Teleservice

CVE-2021-39087

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.12% / 31.72%

7 Day CHG~0.00%

Published-16 Aug, 2022 | 18:46

Updated-17 Sep, 2024 | 03:17

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an authenticated user to obtain sensitive information due to improper permission controls. IBM X-Force ID: 216109.

Product-sterling_b2b_integrator solaris linux_kernel hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2025-21552

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.15% / 35.34%

7 Day CHG~0.00%

Published-21 Jan, 2025 | 20:53

Updated-23 Jun, 2025 | 17:50

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).