ByteOS

Product

MySQL Server

Versions

Affected

From 8.0.0 through 8.0.45 (custom)
From 8.4.0 through 8.4.8 (custom)
From 9.0.0 through 9.6.0 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data.

Type: N/A

CWE ID: N/A

Description: Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data.

Metrics

Version	Base score	Base severity	Vector
3.1	2.7	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 2.7

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuapr2026.html	vendor-advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2026.html

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-200	CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Type: CWE

CWE ID: CWE-200

Description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:21 Apr, 2026 | 21:16

Updated At:23 Apr, 2026 | 15:04

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	2.7	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 2.7

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CPE Matches

cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

>>mysql_server>>Versions from 8.0.0(inclusive) to 8.0.45(inclusive)

cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

>>mysql_server>>Versions from 8.4.0(inclusive) to 8.4.8(inclusive)

cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

>>mysql_server>>Versions from 9.0.0(inclusive) to 9.6.0(inclusive)

Weaknesses

CWE ID	Type	Source
CWE-200	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-200

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://www.oracle.com/security-alerts/cpuapr2026.html	secalert_us@oracle.com	Vendor Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2026.html

Source: secalert_us@oracle.com

Resource:

Vendor Advisory

Similar CVEs

251Records found

CVE-2017-10339

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.9||MEDIUM

EPSS-0.78% / 73.74%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10332

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-1.74% / 82.62%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-universal_work_queue Universal Work Queue

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10317

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4||MEDIUM

EPSS-0.18% / 38.96%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Suite8 executes to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10310

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.01% / 83.80%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). The supported version that is affected is 11.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-hyperion_financial_reporting Hyperion Financial Reporting

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10266

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.51% / 66.51%

7 Day CHG~0.00%

Published-14 Nov, 2017 | 23:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Tuxedo accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Product-tuxedo Tuxedo

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10084

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.75% / 73.30%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Report Generator). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Product-flexcube_universal_banking FLEXCUBE Universal Banking

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10093

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.42% / 61.67%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-08 May, 2025 | 18:13

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Product-agile_product_lifecycle_management Agile PLM Framework

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10262

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.9||MEDIUM

EPSS-1.32% / 79.99%

7 Day CHG~0.00%

Published-18 Jan, 2018 | 02:00

Updated-04 Oct, 2024 | 16:38

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 11.1.2.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-access_manager Access Manager

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10267

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.95% / 76.43%

7 Day CHG~0.00%

Published-14 Nov, 2017 | 23:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-tuxedo Tuxedo

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-1000029

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-68.99% / 98.65%

7 Day CHG~0.00%

Published-13 Jul, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication.

Product-glassfish_server n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10299

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.21% / 43.16%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-08 May, 2025 | 18:13

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Product-agile_product_lifecycle_management Agile PLM Framework

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10319

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.51% / 66.51%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10261

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 57.78%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with logon to the infrastructure where XML Database executes to compromise XML Database. While the vulnerability is in XML Database, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all XML Database accessible data. Note: This score is for Windows platform version 11.2.0.4 of Database. For Windows platform version 12.1.0.2 and Linux, the score is 5.5 with scope Unchanged. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Product-database Oracle Database

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10152

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-1.24% / 79.36%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Product-weblogic_server WebLogic Server

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10287

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 42.06%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Product-peoplesoft_enterprise_scm_strategic_sourcing PeopleSoft Enterprise SCM Strategic Sourcing

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10324

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.42% / 61.67%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite (subcomponent: Oracle Forms). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Technology Stack accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Product-e-business_suite_technology_stack E-Business Suite Technology Stack

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10197

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.12% / 29.88%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Folios). The supported version that is affected is 5.4.2.x through 5.5.1.x. Easily exploitable vulnerability allows physical access to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-hospitality_opera_5_property_services Hospitality OPERA 5 Property Services

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10164

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.69%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Product-peoplesoft_enterprise_fin_staffing_front_office PeopleSoft Enterprise FIN Staffing Front Office

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10194

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-2.7||LOW

EPSS-0.22% / 43.82%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management). The supported version that is affected is Prior to 3.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Integrated Lights Out Manager (ILOM). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Integrated Lights Out Manager (ILOM) accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

Product-integrated_lights_out_manager_firmware SSM - (hot-tamale) ILOM: Integrated Lights Out Manager

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2012-5615

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-5||MEDIUM

EPSS-20.66% / 95.62%

7 Day CHG~0.00%

Published-03 Dec, 2012 | 11:00

Updated-29 Apr, 2026 | 01:13

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.

Vendor-n/a Oracle Corporation MariaDB Foundation

Product-mariadb mysql n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2023-22019

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.27% / 50.23%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 21:02

Updated-13 Sep, 2024 | 17:35

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-http_server HTTP Server

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2012-4420

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-7.5||HIGH

EPSS-1.07% / 77.81%

7 Day CHG~0.00%

Published-26 Dec, 2019 | 20:46

Updated-06 Aug, 2024 | 20:35

An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.

Vendor-java-1.7.0-openjdk Oracle Corporation

Product-jdk java-1.7.0-openjdk

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-22006

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 6.52%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-23 Apr, 2026 | 15:03

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Employee Snapshot). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Human Resources, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Product-peoplesoft_enterprise_hcm_human_resources PeopleSoft Enterprise HCM Human Resources

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-21999

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.03% / 9.63%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:34

Updated-22 Apr, 2026 | 21:24

Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise XML Database. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all XML Database accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).

Product-Oracle Database Server

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-22015

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 7.89%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-23 Apr, 2026 | 15:01

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Product-mysql_server MySQL Server

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-21940

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.06% / 16.92%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 21:56

Updated-29 Jan, 2026 | 20:35

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-supply_chain_products_suite Oracle Agile PLM

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-22007

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-2.9||LOW

EPSS-0.02% / 5.79%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-27 Apr, 2026 | 12:14

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Product-graalvm_for_jdk jdk jre graalvm Oracle GraalVM for JDK Oracle GraalVM Enterprise Edition Oracle Java SE

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-22016

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.12% / 29.95%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-27 Apr, 2026 | 12:16

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-graalvm_for_jdk jdk jre graalvm Oracle GraalVM for JDK Oracle GraalVM Enterprise Edition Oracle Java SE

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2026-21974

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 11.09%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 21:56

Updated-29 Jan, 2026 | 14:47

Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences Central Designer. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Life Sciences Central Designer accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Product-life_sciences_central_designer Oracle Life Sciences Central Designer

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-21928

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 11.09%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 21:56

Updated-03 Mar, 2026 | 16:16

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Product-solaris Oracle Solaris

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2020-17527

Matching Score-6

Assigner-Apache Software Foundation

Product-debian_linux element_plug-in blockchain_platform sd-wan_edge mysql_enterprise_monitor instantis_enterprisetrack oncommand_system_manager communications_cloud_native_core_binding_support_function tomcat communications_instant_messaging_server communications_cloud_native_core_policy workload_manager Apache Tomcat

Matching Score-6

Assigner-Apache Software Foundation

CVSS Score-7.5||HIGH

EPSS-10.51% / 93.29%

7 Day CHG~0.00%

Published-03 Dec, 2020 | 18:30

Updated-13 Feb, 2025 | 16:27

Apache Tomcat: Request header mix-up between HTTP/2 streams

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

Vendor-Oracle Corporation NetApp, Inc.Debian GNU/Linux The Apache Software Foundation

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2011-3201

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.82% / 74.38%

7 Day CHG~0.00%

Published-08 Mar, 2013 | 21:00

Updated-29 Apr, 2026 | 01:13

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

Vendor-n/a The GNOME Project Red Hat, Inc.Oracle Corporation

Product-evolution enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop solaris n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2020-15250

Matching Score-6

Assigner-GitHub, Inc.

Matching Score-6

Assigner-GitHub, Inc.

CVSS Score-4.4||MEDIUM

EPSS-0.06% / 17.62%

7 Day CHG~0.00%

Published-12 Oct, 2020 | 17:55

Updated-04 Aug, 2024 | 13:08

Information disclosure in JUnit4

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.

Vendor-junit junit-team The Apache Software Foundation Debian GNU/Linux Oracle Corporation

Product-junit4 communications_cloud_native_core_policy debian_linux pluto junit4

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2011-0579

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-5||MEDIUM

EPSS-0.97% / 76.71%

7 Day CHG~0.00%

Published-13 May, 2011 | 22:00

Updated-29 Apr, 2026 | 01:13

Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to obtain sensitive information via unspecified vectors.

Vendor-n/a Apple Inc.Oracle Corporation Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x solaris windows flash_player android linux_kernel n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-8295

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.19% / 40.74%

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors.

Product-peoplesoft_enterprise_human_capital_management_time_and_labor n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2023-38729

Matching Score-6

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.10% / 26.41%

7 Day CHG~0.00%

Published-03 Apr, 2024 | 12:27

Updated-31 Jan, 2025 | 15:42

IBM Db2 information disclosure

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT.

Product-hp-ux windows solaris aix linux_on_ibm_z linux_kernel db2 Db2 for Linux, UNIX and Windows db2_connect_server db2

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10300

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.51% / 66.51%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Siebel CRM Desktop component of Oracle Siebel CRM (subcomponent: Siebel Business Service Issues). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Desktop. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Desktop accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Product-siebel_customer_relationship_management_desktop Siebel CRM Desktop

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10316

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.46% / 64.03%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10259

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.12% / 84.23%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-coreid_access n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10318

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.7||MEDIUM

EPSS-0.53% / 67.06%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Suite8, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-10037

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-2.12% / 84.23%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Service API). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Product-business_intelligence_publisher BI Publisher (formerly XML Publisher)

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-8322

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 48.04%

7 Day CHG~0.00%

Published-27 Jan, 2017 | 22:01

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 5.1.0, 5.2.0 and 11.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Core Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Core Banking accessible data. CVSS v3.0 Base Score 4.3 (Confidentiality impacts).

Product-flexcube_core_banking FLEXCUBE Core Banking

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-8286

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-3.1||LOW

EPSS-0.09% / 25.45%

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.

Product-mysql n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-8294

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.19% / 40.74%

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect confidentiality via unknown vectors.

Product-peoplesoft_enterprise_peopletools n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-5614

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 48.04%

7 Day CHG~0.00%

Published-27 Jan, 2017 | 22:01

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS v3.0 Base Score 4.3 (Confidentiality impacts).

Product-flexcube_private_banking FLEXCUBE Private Banking

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-8966

Matching Score-6

Assigner-IBM Corporation

Vendor-Linux Kernel Organization, Inc Oracle Corporation HP Inc.IBM Corporation Microsoft Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.19% / 40.69%

7 Day CHG~0.00%

Published-01 Feb, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

Product-bigfix_inventory license_metric_tool aix solaris hp-ux linux_kernel windows BigFix Inventory

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-8963

Matching Score-6

Assigner-IBM Corporation

Vendor-Linux Kernel Organization, Inc Oracle Corporation HP Inc.IBM Corporation Microsoft Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.05% / 13.90%

7 Day CHG~0.00%

Published-01 Feb, 2017 | 22:00

Updated-20 Apr, 2025 | 01:37

IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user.

Product-bigfix_inventory license_metric_tool aix solaris hp-ux linux_kernel windows BigFix Inventory

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-61764

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.03% / 9.90%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-24 Oct, 2025 | 14:27

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Product-weblogic_server Oracle WebLogic Server

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-61885

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 9.77%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-24 Oct, 2025 | 13:20

Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Product-life_sciences_inform Oracle Life Sciences InForm

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2008-5460

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-2.6||LOW

EPSS-0.29% / 52.65%

7 Day CHG~0.00%

Published-14 Jan, 2009 | 02:00

Updated-23 Apr, 2026 | 00:35

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote attackers to affect confidentiality via unknown vectors.