Vulnerability

in

the

BI

Publisher

(formerly

XML

Publisher)

component

of

Oracle

Fusion

Middleware

(subcomponent:

BI

Publisher

Security).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

BI

Publisher

(formerly

XML

Publisher).

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

BI

Publisher

(formerly

XML

Publisher)

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

BI

Publisher

(formerly

XML

Publisher)

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

BI

Publisher

(formerly

XML

Publisher)

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

BI

Publisher

(formerly

XML

Publisher).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L).


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

WLS

Web

Services).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

WebLogic

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).

denial of service
unauthorized access
privileged network access compromise


Vulnerability

in

the

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

product

of

Oracle

Retail

Applications

(component:

Internal

Operations).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Customer

Management

and

Segmentation

Foundation.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Customer

Management

and

Segmentation

Foundation.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

denial of service
unauthorized access
privileged network access compromise
dos


Vulnerability

in

the

MySQL

Client

product

of

Oracle

MySQL

(component:

C

API).

Supported

versions

that

are

affected

are

and

prior

and

prior

and

and

prior.

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Client.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Client

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Client.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

product

of

Oracle

PeopleSoft

(component:

SQR).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

While

the

vulnerability

is

in

PeopleSoft

Enterprise

PeopleTools

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

BI

Publisher

product

of

Oracle

Fusion

Middleware

(component:

BI

Publisher

Security).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

BI

Publisher.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

BI

Publisher

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

BI

Publisher

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

BI

Publisher.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

BI

Publisher

product

of

Oracle

Fusion

Middleware

(component:

E-Business

Suite

XDO).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

BI

Publisher.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

BI

Publisher

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

BI

Publisher

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

BI

Publisher.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebLogic

Server

product

of

Oracle

Fusion

Middleware

(component:

Core

Components).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

BI

Publisher

product

of

Oracle

Fusion

Middleware

(component:

Administration).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

BI

Publisher.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

BI

Publisher

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

BI

Publisher

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

BI

Publisher.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Secure

Global

Desktop

product

of

Oracle

Virtualization

(component:

Client).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Secure

Global

Desktop.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Secure

Global

Desktop

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Secure

Global

Desktop.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L).


Vulnerability

in

the

Oracle

Applications

Manager

product

of

Oracle

E-Business

Suite

(component:

View

Reports).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Applications

Manager.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Applications

Manager

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Applications

Manager

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Applications

Manager

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Applications

Manager.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Secure

Global

Desktop

product

of

Oracle

Virtualization

(component:

Server).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Secure

Global

Desktop.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Secure

Global

Desktop

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Secure

Global

Desktop.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).


Vulnerability

in

the

MySQL

Cluster

product

of

Oracle

MySQL

(component:

Cluster:

ndbcluster/plugin

DDL).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Cluster.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Cluster.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Sales

Offline

product

of

Oracle

E-Business

Suite

(component:

Offline

Template).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Sales

Offline.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Sales

Offline.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Enterprise

Session

Border

Controller

product

of

Oracle

Communications

(component:

Log).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Enterprise

Session

Border

Controller.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Enterprise

Session

Border

Controller.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Banking

Payments

product

of

Oracle

Financial

Services

Applications

(component:

Infrastructure).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Banking

Payments.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Banking

Payments

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Banking

Payments

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Banking

Payments.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).


Vulnerability

in

the

Oracle

Banking

Trade

Finance

product

of

Oracle

Financial

Services

Applications

(component:

Infrastructure).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Banking

Trade

Finance.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Banking

Trade

Finance

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Banking

Trade

Finance

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Banking

Trade

Finance.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Universal

Banking

product

of

Oracle

Financial

Services

Applications

(component:

Infrastructure).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Universal

Banking.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

FLEXCUBE

Universal

Banking

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Universal

Banking

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Universal

Banking.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Communications

Billing

and

Revenue

Management

product

of

Oracle

Communications

Applications

(component:

Connection

Manager).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

TCP

to

compromise

Oracle

Communications

Billing

and

Revenue

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Communications

Billing

and

Revenue

Management

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Communications

Billing

and

Revenue

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Communications

Billing

and

Revenue

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).


Vulnerability

in

the

Primavera

Portfolio

Management

product

of

Oracle

Construction

and

Engineering

(component:

Web

Access).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Portfolio

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Primavera

Portfolio

Management.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Banking

Treasury

Management

product

of

Oracle

Financial

Services

Applications

(component:

Infrastructure).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Banking

Treasury

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Banking

Treasury

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Banking

Treasury

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Banking

Treasury

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management.

While

the

vulnerability

is

in

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).


Vulnerability

in

the

Oracle

FLEXCUBE

Universal

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Universal

Banking.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Universal

Banking.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

MySQL

Cluster

component

of

Oracle

MySQL

(subcomponent:

Cluster:

DD).

Supported

versions

that

are

affected

are

and

earlier

and

earlier

and

earlier

and

and

earlier.

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Cluster.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Cluster

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Cluster.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Oracle

FLEXCUBE

Private

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Miscellaneous).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Private

Banking.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Private

Banking

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Private

Banking.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebCenter

Sites

component

of

Oracle

Fusion

Middleware

(subcomponent:

Advanced

UI).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Sites.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebCenter

Sites

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebCenter

Sites

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebCenter

Sites.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

FLEXCUBE

Private

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Miscellaneous).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Private

Banking.

While

the

vulnerability

is

in

Oracle

FLEXCUBE

Private

Banking

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Private

Banking.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Security).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Hospitality

Cruise

Shipboard

Property

Management

System

component

of

Oracle

Hospitality

Applications

(subcomponent:

OHC

DRS).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Cruise

Shipboard

Property

Management

System.

While

the

vulnerability

is

in

Oracle

Hospitality

Cruise

Shipboard

Property

Management

System

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Hospitality

Cruise

Shipboard

Property

Management

System

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Cruise

Shipboard

Property

Management

System.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L).


Vulnerability

in

the

Oracle

Hospitality

component

of

Oracle

Hospitality

Applications

(subcomponent:

Leisure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

While

the

vulnerability

is

in

Oracle

Hospitality

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Hospitality

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L).


Vulnerability

in

the

Oracle

Tuxedo

component

of

Oracle

Fusion

Middleware

(subcomponent:

Core).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

Jolt

to

compromise

Oracle

Tuxedo.

While

the

vulnerability

is

in

Oracle

Tuxedo

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Tuxedo

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Tuxedo

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Tuxedo.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).


Vulnerability

in

the

Oracle

Hospitality

Cruise

Fleet

Management

component

of

Oracle

Hospitality

Applications

(subcomponent:

GangwayActivityWebApp).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Cruise

Fleet

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Cruise

Fleet

Management.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

Hospitality

component

of

Oracle

Hospitality

Applications

(subcomponent:

Leisure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Hospitality

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).


Vulnerability

in

the

Java

Advanced

Management

Console

component

of

Oracle

Java

SE

(subcomponent:

Server).

The

supported

version

that

is

affected

is

Java

Advanced

Management

Console:

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

Advanced

Management

Console.

While

the

vulnerability

is

in

Java

Advanced

Management

Console

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

Advanced

Management

Console

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Java

Advanced

Management

Console

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

Advanced

Management

Console.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Siebel

UI

Framework

component

of

Oracle

Siebel

CRM

(subcomponent:

EAI).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Siebel

UI

Framework.

While

the

vulnerability

is

in

Siebel

UI

Framework

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Siebel

UI

Framework

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Siebel

UI

Framework

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Siebel

UI

Framework.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

Advanced

Management

Console

component

of

Oracle

Java

SE

(subcomponent:

Server).

The

supported

version

that

is

affected

is

Java

Advanced

Management

Console:

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Java

Advanced

Management

Console.

While

the

vulnerability

is

in

Java

Advanced

Management

Console

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

Advanced

Management

Console

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Java

Advanced

Management

Console

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

Advanced

Management

Console.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Primavera

Enterprise

Project

Portfolio

Management

component

of

Oracle

Primavera

Products

Suite

(subcomponent:

Web

Access).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Enterprise

Project

Portfolio

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Primavera

Enterprise

Project

Portfolio

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Primavera

Enterprise

Project

Portfolio

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Primavera

Enterprise

Project

Portfolio

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Primavera

Enterprise

Project

Portfolio

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Hospitality

Hotel

Mobile

component

of

Oracle

Hospitality

Applications

(subcomponent:

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Hotel

Mobile.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Hotel

Mobile

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Hotel

Mobile.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).


Vulnerability

in

the

Hospitality

Cloud

Service

component

of

Oracle

Hospitality

Applications

(subcomponent:

General).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hospitality

Cloud

Service.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Hospitality

Cloud

Service

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Hospitality

Cloud

Service

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Hospitality

Cloud

Service.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Banking

Payments

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Payments

Core).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Banking

Payments.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Banking

Payments

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Banking

Payments.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

SMB

Server).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

SMB

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Banking

Corporate

Lending

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Core

module).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Banking

Corporate

Lending.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Banking

Corporate

Lending

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Banking

Corporate

Lending

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Banking

Corporate

Lending.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Sales

Audit

component

of

Oracle

Retail

Applications

(subcomponent:

Operational

Insights).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Sales

Audit.

While

the

vulnerability

is

in

Oracle

Retail

Sales

Audit

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Retail

Sales

Audit

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Sales

Audit

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Sales

Audit.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

Application

Testing

Suite

component

of

Oracle

Enterprise

Manager

Products

Suite

(subcomponent:

Load

Testing

for

Web

Apps).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Application

Testing

Suite.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Application

Testing

Suite

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Application

Testing

Suite

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Application

Testing

Suite.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Investor

Servicing

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Investor

Servicing.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Investor

Servicing

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Investor

Servicing

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Investor

Servicing.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MICROS

Relate

CRM

Software

component

of

Oracle

Retail

Applications

(subcomponent:

Internal

Operations).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

MICROS

Relate

CRM

Software.

While

the

vulnerability

is

in

MICROS

Relate

CRM

Software

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MICROS

Relate

CRM

Software

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MICROS

Relate

CRM

Software.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Banking

Payments

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Payments

Core).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Banking

Payments.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Banking

Payments

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Banking

Payments

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Banking

Payments.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Banking

Corporate

Lending

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Core

module).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Banking

Corporate

Lending.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Banking

Corporate

Lending

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Banking

Corporate

Lending.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Virtual

Directory

component

of

Oracle

Fusion

Middleware

(subcomponent:

Virtual

Directory

Manager).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Virtual

Directory.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Virtual

Directory

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Virtual

Directory

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Virtual

Directory.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Investor

Servicing

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Investor

Servicing.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Investor

Servicing

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Investor

Servicing.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

component

of

Oracle

Retail

Applications

(subcomponent:

Segment).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Customer

Management

and

Segmentation

Foundation.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Customer

Management

and

Segmentation

Foundation.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

component

of

Oracle

Retail

Applications

(subcomponent:

Internal

Operations).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Customer

Management

and

Segmentation

Foundation.

While

the

vulnerability

is

in

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Customer

Management

and

Segmentation

Foundation

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Customer

Management

and

Segmentation

Foundation.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Communications

Unified

Inventory

Management

component

of

Oracle

Communications

Applications

(subcomponent:

Portal).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Communications

Unified

Inventory

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Communications

Unified

Inventory

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Communications

Unified

Inventory

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Communications

Unified

Inventory

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MICROS

Retail-J

component

of

Oracle

Retail

Applications

(subcomponent:

Database).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

MICROS

Retail-J.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MICROS

Retail-J

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

MICROS

Retail-J

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MICROS

Retail-J.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Sun

ZFS

Storage

Appliance

Kit

(AK)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

API

frameworks).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

Sun

ZFS

Storage

Appliance

Kit

(AK).

While

the

vulnerability

is

in

Sun

ZFS

Storage

Appliance

Kit

(AK)

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Sun

ZFS

Storage

Appliance

Kit

(AK)

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Sun

ZFS

Storage

Appliance

Kit

(AK)

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Sun

ZFS

Storage

Appliance

Kit

(AK).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Argus

Safety

component

of

Oracle

Health

Sciences

Applications

(subcomponent:

File

Upload).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Argus

Safety.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Argus

Safety

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Argus

Safety

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Argus

Safety

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Argus

Safety.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Universal

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Universal

Banking.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Universal

Banking

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Universal

Banking.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebCenter

Content

component

of

Oracle

Fusion

Middleware

(subcomponent:

Content

Server).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Content.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

WebCenter

Content

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebCenter

Content

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebCenter

Content

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebCenter

Content.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

Hospitality

Simphony

component

of

Oracle

Hospitality

Applications

(subcomponent:

Import/Export).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Simphony.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hospitality

Simphony

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Simphony

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Simphony.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).


Vulnerability

in

the

Sun

ZFS

Storage

Appliance

Kit

(AK)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

HTTP

data

path

subsystems).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Sun

ZFS

Storage

Appliance

Kit

(AK).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Sun

ZFS

Storage

Appliance

Kit

(AK)

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Sun

ZFS

Storage

Appliance

Kit

(AK)

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Sun

ZFS

Storage

Appliance

Kit

(AK).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Universal

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Universal

Banking.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Universal

Banking

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Universal

Banking

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Universal

Banking.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Xstore

Office

component

of

Oracle

Retail

Applications

(subcomponent:

Internal

Operations).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Xstore

Office.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Xstore

Office

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Xstore

Office

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Xstore

Office.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Financial

Services

Analytical

Applications

Infrastructure

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Core).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Financial

Services

Analytical

Applications

Infrastructure.

While

the

vulnerability

is

in

Oracle

Financial

Services

Analytical

Applications

Infrastructure

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Financial

Services

Analytical

Applications

Infrastructure

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Financial

Services

Analytical

Applications

Infrastructure

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Financial

Services

Analytical

Applications

Infrastructure.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Enterprise

Communications

Broker

product

of

Oracle

Communications

Applications

(component:

WebGUI).

Supported

versions

that

are

affected

are

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Enterprise

Communications

Broker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Enterprise

Communications

Broker

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Enterprise

Communications

Broker

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Enterprise

Communications

Broker.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

MySQL

Cluster

product

of

Oracle

MySQL

(component:

Cluster:

NDBCluster

Plugin).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Cluster.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Cluster

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Cluster.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Oracle

Communications

Session

Border

Controller

product

of

Oracle

Communications

Applications

(component:

System

Admin).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

SSH

to

compromise

Oracle

Communications

Session

Border

Controller.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Communications

Session

Border

Controller

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Communications

Session

Border

Controller

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Communications

Session

Border

Controller

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Communications

Session

Border

Controller.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L).


Vulnerability

in

the

PeopleSoft

Enterprise

HCM

Global

Payroll

Core

product

of

Oracle

PeopleSoft

(component:

Security).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

HCM

Global

Payroll

Core.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

HCM

Global

Payroll

Core

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

HCM

Global

Payroll

Core

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

HCM

Global

Payroll

Core.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Financial

Services

Analytical

Applications

Infrastructure

product

of

Oracle

Financial

Services

Applications

(component:

Infrastructure).

Supported

versions

that

are

affected

are

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Financial

Services

Analytical

Applications

Infrastructure.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Financial

Services

Analytical

Applications

Infrastructure

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Financial

Services

Analytical

Applications

Infrastructure

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Financial

Services

Analytical

Applications

Infrastructure.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Human

Resources

product

of

Oracle

E-Business

Suite

(component:

Hierarchy

Diagrammers).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTPS

to

compromise

Oracle

Human

Resources.

While

the

vulnerability

is

in

Oracle

Human

Resources

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Human

Resources

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Human

Resources

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Human

Resources.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Core

Banking

product

of

Oracle

Financial

Services

Applications

(component:

Transaction

Processing).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Core

Banking.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Core

Banking

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Core

Banking

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Core

Banking.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Enterprise

Config

Management).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Primavera

Enterprise

Project

Portfolio

Management

product

of

Oracle

Construction

and

Engineering

(component:

Project

Manager).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Enterprise

Project

Portfolio

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Primavera

Enterprise

Project

Portfolio

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Primavera

Enterprise

Project

Portfolio

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Primavera

Enterprise

Project

Portfolio

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Primavera

Enterprise

Project

Portfolio

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0 11.4.0 12.0.1 12.0.2 12.0.3 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS v3.0 Base Score 6.3 (Confidentiality Integrity and Availability impacts).


A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.


A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modify deserialized data to send custom requests that crash the server.


Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming the malware.


An access issue was addressed with improved memory management. This issue is fixed in iOS 14.5 and iPadOS 14.5. A malicious application may be able to determine kernel memory layout.


An access issue was addressed with improved memory management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. A malicious application may be able to determine kernel memory layout.


In Hiawatha before 10.8.4 a remote attacker is able to do directory traversal if AllowDotFiles is enabled.


In LightDM through 1.22.0 a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out.


In Webgalamb through 7.0 a system/ajax.php \wgmfile restore\ directory traversal vulnerability could lead to arbitrary code execution by authenticated administrator users because PHP files are restored under the document root directory.


In SonicWall SMA100 an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.


In Mahara before 20.04.5 20.10.3 21.04.2 and 21.10.0 adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character.


IBM Case Manager 5.2.0.0 5.2.0.4 5.2.1.0 5.2.1.7 5.3.0.0 and 5.3.3.0 is vulnerable to a \zip slip\ vulnerability which could allow a remote attacker to execute code using directory traversal techniques. IBM X-Force ID: 151970.


In MyBB before 1.8.11 the smilie module allows Directory Traversal via the pathfolder parameter.


The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.


GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.


doorGets

allows

remote

attackers

to

write

to

arbitrary

files

via

directory

traversal

as

demonstrated

by

a

dg-user/?controller=theme&action=edit&name=doorgets&file=../../1.txt%00

URI

with

content

in

the

parameter.


OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.


An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26 9.30 and 9.40 allows remote users to delete arbitrary files via servlet directory traversal.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.


Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\\ (dot dot backslash) in the config parameter.


GitLab Community and Enterprise Edition before 11.3.14 11.4.x before 11.4.12 and 11.5.x before 11.5.5 allows Directory Traversal.


A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated local attacker to access sensitive information stored in an AP. The vulnerability is due to improper sanitization of user-supplied input in specific CLI commands. An attacker could exploit this vulnerability by accessing the CLI of an affected AP with administrator privileges and issuing crafted commands that result in directory traversal. A successful exploit could allow the attacker to view system files on the affected device which could contain sensitive information. Software versions 8.8 and 8.9 are affected.


Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3 2.22.0 to 2.22.2 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.


Directory Traversal vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated privileges via specially crafted input.


Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain a Directory Traversal Vulnerability. A remote authenticated malicious user with admin privileges could potentially exploit this vulnerability to gain unauthorized access to the file system by exploiting insufficient sanitization of input parameters.


permission and access control vulnerability which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can construct a URL for directory traversal and access to other unauthorized files or resources.


Spring Cloud Config versions 2.1.x prior to 2.1.2 versions 2.0.x prior to 2.0.4 and versions 1.4.x prior to 1.4.6 and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafted URL that can lead a directory traversal attack.


MikroTik RouterOS versions Stable 6.43.12 and below Long-term 6.42.12 and below and Testing 6.44beta75 and below are vulnerable to an authenticated remote directory traversal via the HTTP or Winbox interfaces. An authenticated remote attack can use this vulnerability to read and write files outside of the sandbox directory (/rw/disk).


OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.


Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.


In OpenEMR 5.0.1 and earlier the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.


TVT NVMS-1000 devices allow GET /.. Directory Traversal


The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command because a Content-Disposition header can have ../ in a filename as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.


An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device.


Linear eMerge E3-Series devices allow Directory Traversal.


An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request.


PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory.


idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php.


PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2016/08 directory.


PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory.


An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloaded via an admincp.php?app=apps&do=pack request.


SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside the web directories.


Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interface as demonstrated by reading /etc/shadow. NOTE: this product is discontinued and its final firmware version has this vulnerability (4.x versions exist only for other Genie Access products).


A directory traversal vulnerability has been found in the Avaya Equinox Management(iView)versions R9.1.9.0 and earlier. Successful exploitation could potentially allow an unauthenticated attacker to access files that are outside the restricted directory on the remote server.


An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal.


An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=browse ..\\ Directory Traversal.


PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory.


A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains a directory traversal vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote attacker with network access to the CCS server could exploit this vulnerability to list arbitrary directories or read files outside of the CCS application context.


An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.


SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files.


PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory aka a directory traversal vulnerability.


A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 1.00.047 allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product.


XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1 as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products allows a remote attacker to write to arbitrary files via Directory Traversal.


Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ (and variations) it is possible to list all the directories and check if a particular file exists.


An issue was discovered in TYPO3 before 8.7.30 9.x before 9.5.12 and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later System Maintainer privileges are also required.)


admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal.


An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5 11.1 12.0 12.1 and 13.0. They allow Directory Traversal.


SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.


An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to sensitive information outside the working directory via Directory Traversal attacks against AprolSqlServer a different vulnerability than CVE-2019-16357.


Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script->exec with ../../../bin/sh as the parameter.


An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.


In Axway File Transfer Direct 2.7.1 an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.


An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution.


Directory traversal vulnerability on ONKYO TX-NR686 1030-5000-1040-0010 A/V Receiver devices allows remote attackers to read arbitrary files via a .. (dot dot) and %2f to the default URI.


An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file the input parameters are not checked resulting in input mishandling by the rmdir method. Attackers can delete arbitrary files by using \../\ directory traversal.


An log-management directory traversal issue was discovered in OverIT Geocall 6.3 before build 2:346977.


nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.


FlightCrew v0.9.2 and older are vulnerable to a directory traversal allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.


FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.


Within Sahi Pro 8.0.0 an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e. being able to pull any file from the remote victim application). This can be used to steal and obtain sensitive config and other files. This can result in complete compromise of the application. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.


The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request.


Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API.


An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter to cause local file inclusion resulting in code execution.


MacDown 0.7.1 allows directory traversal for execution of arbitrary programs via a file:/// or ../ substring in a shared note.


IceWarp

Mail

Server

through

is

prone

to

a

local

file

inclusion

vulnerability

via

webmail/calendar/minimizer/index.php?style=..%5c

directory

traversal.


A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory.


ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability which allows remote attackers to view and retrieve verbose logging information. Files within this directory were observed to contain sensitive run-time information including Base64 encoded 'support' credentials leading to administrative access of the device.


Typora 0.9.9.24.6 on macOS allows directory traversal for execution of arbitrary programs via a file:/// or ../ substring in a shared note.


MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues with which authenticated users could add remove or potentially read files in arbitrary folders accessible by the IIS user. This could lead to reading other users' credentials including those of SYSADMIN accounts reading other users' emails or adding emails or files to other users' accounts.


BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.


Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation) to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java sources from /WEB-INF/classes/*.class


A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \\..\\..\\ technique arbitrary files can be loaded in the server response outside the root directory.


LINAGORA

hublin

latest

(commit

is

affected

by:

Directory

Traversal.

The

impact

is:

The

vulnerability

allows

an

attacker

to

access

any

file

(with

a

fixed

extension)

on

the

server.

The

component

is:

A

web-view

renderer;

details

here:

The

attack

vector

is:

Attacker

sends

a

specially

crafted

HTTP

request.


The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal which allows attackers to bypass a deserialization protection mechanism as demonstrated by a phar:///path/bad.phar/../good.phar URL.


Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on the remote server.


The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter with resultant local file inclusion via directory traversal because there can be a discrepancy between the $_POST'action' value and the $_GET'action' value and the latter is unsanitized.


A

security

vulnerability

has

been

identified

in

HPE

SimpliVity

Gen

HPE

SimpliVity

Gen

HPE

SimpliVity

Gen

G

HPE

SimpliVity

Gen

SimpliVity

OmniCube

SimpliVity

OmniStack

for

Cisco

SimpliVity

OmniStack

for

Lenovo

and

SimpliVity

OmniStack

for

Dell

nodes.

An

API

is

used

to

execute

a

command

manifest

file

during

upgrade

does

not

correctly

prevent

directory

traversal

and

so

can

be

used

to

execute

manifest

files

in

arbitrary

locations

on

the

node.

The

API

does

not

require

user

authentication

and

is

accessible

over

the

management

network

resulting

in

the

potential

for

unauthenticated

remote

execution

of

manifest

files.

For

all

customers

running

HPE

OmniStack

version

and

earlier.

HPE

recommends

upgrading

the

OmniStack

software

to

version

or

later

which

contains

a

permanent

resolution.

Customers

and

partners

who

can

upgrade

to

should

upgrade

at

the

earliest

convenience.

For

all

customers

and

partners

unable

to

upgrade

their

environments

to

the

recommended

version

HPE

has

created

a

Temporary

Workaround

for

you

to

implement.

All

customer

should

upgrade

to

the

recommended

or

later

version

at

the

earliest

convenience.


Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe leading to Directory Traversal. An attacker could use ..\\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups Web.config files etc. and might cause a serious impact on confidentiality.


The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter with resultant local file inclusion via directory traversal because there can be a discrepancy between the $_POST'action' value and the $_GET'action' value and the latter is unsanitized.


** DISPUTED ** The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server and therefore it is \not a problem.\


An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database delete arbitrary files access user passwords or run arbitrary code.


The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter with resultant local file inclusion via directory traversal because there can be a discrepancy between the $_POST'action' value and the $_GET'action' value and the latter is unsanitized.


in

the

Dataset

API

in

DKPro

Core

through

allows

Directory

Traversal

resulting

in

the

overwrite

of

local

files

with

the

contents

of

an

archive.


Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.


Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory published simultaneously with this one.


comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.


cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \\ in command names which might allow a directory traversal attack in unusual situations.


Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.


Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.


The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.


Intesync Solismed 3.3sp allows Directory Traversal a different vulnerability than CVE-2019-16246.


A vulnerability in the CLI of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated local attacker to view system files that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in command-line parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files that may contain sensitive information.


jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.


Directory Traversal in APIkit HTTP connector and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019 MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019 and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.


The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.


Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value.


WCMS v0.3.2 has a CSRF vulnerability with resultant directory traversal to modify index.html via the /wex/html.php?finish=../index.html URI.


NLTK Downloader before 3.4.5 is vulnerable to a directory traversal allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.


An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method leading to an arbitrary file read and deletion via Directory Traversal.


An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existing files to take control of the VRP virtual machine.


The

Photo

Gallery

plugin

before

for

WordPress

has

Authenticated

Local

File

Inclusion

via

directory

traversal

in

the

wp-admin/admin-ajax.php?action=shortcode_bwg

tagtext

parameter.


Sigil before 0.9.16 is vulnerable to a directory traversal allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.


wp-admin/admin-ajax.php?action=newsletters_exportmultiple

in

the

Tribulant

Newsletters

plugin

before

for

WordPress

allows

directory

traversal

with

resultant

remote

PHP

code

execution

via

the

parameter

in

conjunction

with

an

exportfile=../

value.


An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \\..\\..\\ substring allowing an attacker to enumerate file existence based on the returned information.


An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access to arbitrary files.


PHP Scripts Mall Cab Booking Script 1.0.3 allows Directory Traversal into the parent directory of a jpg or png file.


eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter as demonstrated by reading the user-data/save/backup.sql file.


LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python user/Scripts/python sub-directories of the LibreOffice install. Protection was added to address CVE-2018-16858 to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.


An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command a remote attacker can use a directory traversal technique (..\\..\\) to browse outside the root directory to determine the existence of a file on the operating system and its last modified date.


An

issue

was

discovered

in

OFCMS

before

It

has

admin/cms/template/getTemplates.html?res_path=res&up_dir=../

directory

traversal

related

to

the

getTemplates

function

in

TemplateController.java.


In Vanilla before 2.6.4 a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server.


The Cprime Power Scripts app before 4.0.14 for Atlassian Jira allows Directory Traversal.


An

issue

was

discovered

in

OFCMS

before

It

allows

admin/cms/template/getTemplates.html?res_path=res

directory

traversal

with

in

the

dir

parameter

to

write

arbitrary

content

(in

the

parameter)

into

an

arbitrary

file

(specified

by

the

parameter).

This

is

related

to

the

save

function

in

TemplateController.java.


LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python user/Scripts/python sub-directories of the LibreOffice install. Protection was added to address CVE-2019-9852 to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.


Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.


pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL \pacman -U <url>\ due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However pacman did not sanitize this name which may contain slashes before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem potentially leading to arbitrary root code execution. Notably this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c.


Portainer before 1.22.1 allows Directory Traversal.


Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead.


Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal leading to Local File Inclusion.


An

issue

was

discovered

in

DTF

in

FireGiant

WiX

Toolset

before

Microsoft.Deployment.Compression.Cab.dll

and

Microsoft.Deployment.Compression.Zip.dll

allow

directory

traversal

during

CAB

or

ZIP

archive

extraction

because

the

full

name

of

an

archive

file

(even

with

a

sequence)

is

concatenated

with

the

destination

path.