Vulnerability

in

the

Java

SE

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

JRockit.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

denial of service
unauthenticated network access
dos


Vulnerability

in

the

Oracle

Tuxedo

component

of

Oracle

Fusion

Middleware

(subcomponent:

Security).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

Jolt

to

compromise

Oracle

Tuxedo.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Tuxedo

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Tuxedo

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Tuxedo.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

GlassFish

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Web

Container).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

GlassFish

Server.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

GlassFish

Server

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

GlassFish

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

GlassFish

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Siebel

UI

Framework

component

of

Oracle

Siebel

CRM

(subcomponent:

UIF

Open

UI).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Siebel

UI

Framework.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Siebel

UI

Framework.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Xstore

Point

of

Service

component

of

Oracle

Retail

Applications

(subcomponent:

Point

of

Sale).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Xstore

Point

of

Service.

While

the

vulnerability

is

in

Oracle

Retail

Xstore

Point

of

Service

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Xstore

Point

of

Service

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Xstore

Point

of

Service

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Xstore

Point

of

Service.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Sawbridge).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

While

the

vulnerability

is

in

PeopleSoft

Enterprise

PeopleTools

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L).


Vulnerability

in

the

Oracle

Hospitality

Simphony

component

of

Oracle

Hospitality

Applications

(subcomponent:

Engagement).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Simphony.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Hospitality

Simphony

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Hospitality

Simphony

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Simphony.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Portal).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

While

the

vulnerability

is

in

PeopleSoft

Enterprise

PeopleTools

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).


Vulnerability

in

the

MySQL

Connectors

component

of

Oracle

MySQL

(subcomponent:

Connector/Net).

Supported

versions

that

are

affected

are

and

earlier.

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Connectors.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Connectors.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Integrated

Lights

Out

Manager

(ILOM)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

System

Management).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Integrated

Lights

Out

Manager

(ILOM).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Integrated

Lights

Out

Manager

(ILOM)

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Integrated

Lights

Out

Manager

(ILOM)

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Integrated

Lights

Out

Manager

(ILOM).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Hospitality

Simphony

component

of

Oracle

Hospitality

Applications

(subcomponent:

Utilities).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Simphony.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Simphony.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Integration

Broker).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

While

the

vulnerability

is

in

PeopleSoft

Enterprise

PeopleTools

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Tuxedo

component

of

Oracle

Fusion

Middleware

(subcomponent:

Core).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

Jolt

to

compromise

Oracle

Tuxedo.

While

the

vulnerability

is

in

Oracle

Tuxedo

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Tuxedo

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Tuxedo

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Tuxedo.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L).


Vulnerability

in

the

Oracle

Retail

Xstore

Point

of

Service

component

of

Oracle

Retail

Applications

(subcomponent:

Point

of

Sale).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Xstore

Point

of

Service.

While

the

vulnerability

is

in

Oracle

Retail

Xstore

Point

of

Service

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Xstore

Point

of

Service

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Xstore

Point

of

Service

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Xstore

Point

of

Service.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

component

of

Oracle

Java

SE

(subcomponent:

Deployment).

Supported

versions

that

are

affected

are

Java

SE:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Java

SE

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

SE

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Java

SE

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Java

Advanced

Management

Console

component

of

Oracle

Java

SE

(subcomponent:

Server).

The

supported

version

that

is

affected

is

Java

Advanced

Management

Console:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

Advanced

Management

Console.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

Advanced

Management

Console.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).


Vulnerability

in

the

Oracle

Application

Testing

Suite

component

of

Oracle

Enterprise

Manager

Products

Suite

(subcomponent:

Load

Testing

for

Web

Apps).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Application

Testing

Suite.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Application

Testing

Suite

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Application

Testing

Suite.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

RPC).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

Portmap

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

SMB

Server).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

SMB

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Hospitality

Cruise

Fleet

Management

component

of

Oracle

Hospitality

Applications

(subcomponent:

Emergency

Response

System).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Cruise

Fleet

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Hospitality

Cruise

Fleet

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Cruise

Fleet

Management.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).


Vulnerability

in

the

Oracle

Retail

Xstore

Payment

component

of

Oracle

Retail

Applications

(subcomponent:

Security).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Xstore

Payment.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Retail

Xstore

Payment

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Xstore

Payment

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Xstore

Payment.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

Retail

Xstore

Office

component

of

Oracle

Retail

Applications

(subcomponent:

Internal

Operations).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Xstore

Office.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Retail

Xstore

Office

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Xstore

Office

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Xstore

Office.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

The

supported

version

that

is

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Identity

Manager

component

of

Oracle

Fusion

Middleware

(subcomponent:

Advanced

Console).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Identity

Manager.

While

the

vulnerability

is

in

Oracle

Identity

Manager

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Identity

Manager

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Identity

Manager.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Sudo).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

JSSE).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

SSL/TLS

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

SE

Java

SE

Embedded

JRockit

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Java

SE

Java

SE

Embedded

JRockit

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Sound).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

JAXP).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

JSF).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

WebLogic

Server

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebLogic

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L).


Vulnerability

in

the

PeopleSoft

Enterprise

PT

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

SQR).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PT

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

PT

PeopleTools

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PT

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PT

PeopleTools.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

JNDI).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

SE

Java

SE

Embedded

JRockit

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Java

SE

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

JRockit.

Note:

This

vulnerability

can

only

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

Untrusted

Java

Web

Start

applications

or

Untrusted

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Integrated

Lights

Out

Manager

(ILOM)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Remote

Console

Application).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

TLS

to

compromise

Integrated

Lights

Out

Manager

(ILOM).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Integrated

Lights

Out

Manager

(ILOM)

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Integrated

Lights

Out

Manager

(ILOM)

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Integrated

Lights

Out

Manager

(ILOM).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Security).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

component

of

Oracle

Enterprise

Manager

Products

Suite

(subcomponent:

UI

Framework).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Enterprise

Manager

Base

Platform

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Xstore

Point

of

Service

component

of

Oracle

Retail

Applications

(subcomponent:

Xstore

Office).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Xstore

Point

of

Service.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Retail

Xstore

Point

of

Service

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Xstore

Point

of

Service

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Xstore

Point

of

Service.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Libraries).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

GlassFish

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Java

Server

Faces).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

GlassFish

Server.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

GlassFish

Server

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

GlassFish

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

GlassFish

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

AWT).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

HTTP

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Web

Listener).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

HTTP

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

HTTP

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Hospitality

Cruise

Fleet

Management

System

component

of

Oracle

Hospitality

Applications

(subcomponent:

Fleet

Management

System

Suite).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Hospitality

Cruise

Fleet

Management

System.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Hospitality

Cruise

Fleet

Management

System

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Hospitality

Cruise

Fleet

Management

System

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Cruise

Fleet

Management

System.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Back

Office

component

of

Oracle

Retail

Applications

(subcomponent:

Security).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Back

Office.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Back

Office

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Back

Office.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

AWT).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Concurrency).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Kernel).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

DHCP

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Sun

ZFS

Storage

Appliance

Kit

(AK)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

API

frameworks).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Sun

ZFS

Storage

Appliance

Kit

(AK).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Sun

ZFS

Storage

Appliance

Kit

(AK).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Libraries).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Concurrency).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Image

Export

SDK).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Ops

Center

component

of

Oracle

Enterprise

Manager

Products

Suite

(subcomponent:

Framework).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Ops

Center.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Ops

Center

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Enterprise

Manager

Ops

Center

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Ops

Center.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Hospitality

Simphony

component

of

Oracle

Hospitality

Applications

(subcomponent:

Enterprise

Management

Console).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Simphony.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Simphony

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Hospitality

Simphony

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Simphony.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

JNDI).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Integration

Bus

component

of

Oracle

Retail

Applications

(subcomponent:

RIB

Kernal(Apache

Commons

Collections)).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Integration

Bus.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Retail

Integration

Bus

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Integration

Bus

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Integration

Bus

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Integration

Bus.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

JMX).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

product

of

Oracle

Java

SE

(component:

ImageIO).

Supported

versions

that

are

affected

are

Java

SE:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

Business

Intelligence

Enterprise

Edition

product

of

Oracle

Fusion

Middleware

(component:

Analytics

Actions).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Business

Intelligence

Enterprise

Edition.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Business

Intelligence

Enterprise

Edition

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Business

Intelligence

Enterprise

Edition

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Business

Intelligence

Enterprise

Edition

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Business

Intelligence

Enterprise

Edition.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

Enterprise

Communications

Broker

product

of

Oracle

Communications

Applications

(component:

WebGUI).

Supported

versions

that

are

affected

are

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Enterprise

Communications

Broker.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Enterprise

Communications

Broker

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Enterprise

Communications

Broker

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Enterprise

Communications

Broker

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Enterprise

Communications

Broker.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Libraries).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebCenter

Portal

product

of

Oracle

Fusion

Middleware

(component:

Composer).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Portal.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

WebCenter

Portal

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

WebCenter

Portal

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebCenter

Portal.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).


Vulnerability

in

the

Oracle

Business

Intelligence

Enterprise

Edition

product

of

Oracle

Fusion

Middleware

(component:

Analytics

Web

Answers).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Business

Intelligence

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Business

Intelligence

Enterprise

Edition

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Business

Intelligence

Enterprise

Edition

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Business

Intelligence

Enterprise

Edition.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

iLearning

product

of

Oracle

iLearning

(component:

Assessment

Manager).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

iLearning.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

iLearning

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

iLearning.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Concurrency).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebLogic

Server

product

of

Oracle

Fusion

Middleware

(component:

Console).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Security).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

product

of

Oracle

PeopleSoft

(component:

Query).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

PeopleSoft

Enterprise

PeopleTools

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

Supported

versions

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

WebCenter

Sites

product

of

Oracle

Fusion

Middleware

(component:

Advanced

UI).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Sites.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

WebCenter

Sites

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebCenter

Sites

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

WebCenter

Sites

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebCenter

Sites.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Java

SE

product

of

Oracle

Java

SE

(component:

Libraries).

Supported

versions

that

are

affected

are

Java

SE:

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE.

Note:

This

vulnerability

can

only

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

Untrusted

Java

Web

Start

applications

or

Untrusted

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Networking).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

Supported

versions

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

HTTP

Server

product

of

Oracle

Fusion

Middleware

(component:

OSSL

Module).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTPS

to

compromise

Oracle

HTTP

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

HTTP

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Scripting).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

SMB

to

compromise

Oracle

Solaris.

While

the

vulnerability

is

in

Oracle

Solaris

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

JSSE).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTPS

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Access

Manager

product

of

Oracle

Fusion

Middleware

(component:

Federation).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Access

Manager.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Access

Manager.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Business

Intelligence

Enterprise

Edition

product

of

Oracle

Fusion

Middleware

(component:

Analytics

Actions).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Business

Intelligence

Enterprise

Edition.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Business

Intelligence

Enterprise

Edition

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Business

Intelligence

Enterprise

Edition

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Business

Intelligence

Enterprise

Edition

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Business

Intelligence

Enterprise

Edition.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Connectors

product

of

Oracle

MySQL

(component:

Connector/J).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Connectors.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Connectors

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

MySQL

Connectors

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Connectors.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

SMB

to

compromise

Oracle

Solaris.

While

the

vulnerability

is

in

Oracle

Solaris

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0 11.4.0 12.0.1 12.0.2 12.0.3 12.1.0 and 12.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS v3.0 Base Score 7.3 (Confidentiality Integrity and Availability impacts).


Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: NDBAPI). Supported versions that are affected are 7.2.26 and earlier 7.3.14 and earlier and 7.4.12 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS v3.0 Base Score 4.8 (Integrity and Availability impacts).


Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS v3.0 Base Score 6.3 (Confidentiality Integrity and Availability impacts).


Vulnerability in the Java SE Java SE Embedded JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE Java SE Embedded JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE Java SE Embedded JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets such as through a web service. CVSS v3.0 Base Score 5.3 (Availability impacts).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

Pluggable

Auth).

Supported

versions

that

are

affected

are

and

earlier

and

and

earlier.

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NOTE:

the

previous

information

is

from

the

April

CPU.

Oracle

has

not

commented

on

third-party

claims

that

this

issue

is

an

integer

overflow

in

which

allows

remote

attackers

to

cause

a

denial

of

service

via

a

crafted

authentication

packet.

denial of service
unauthenticated network access
unauthorized ability to crash
denial of service
integer overflow
dos


Vulnerability

in

the

PeopleSoft

Enterprise

FIN

Project

Costing

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Projects).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

FIN

Project

Costing.

While

the

vulnerability

is

in

PeopleSoft

Enterprise

FIN

Project

Costing

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

FIN

Project

Costing

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

FIN

Project

Costing.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L).


Vulnerability

in

the

Oracle

Application

Testing

Suite

component

of

Oracle

Enterprise

Manager

Products

Suite

(subcomponent:

Load

Testing

for

Web

Apps).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Application

Testing

Suite.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Application

Testing

Suite

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Application

Testing

Suite

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Application

Testing

Suite.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

FLEXCUBE

Universal

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Universal

Banking.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Universal

Banking.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

Replication).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

Security:

Privileges).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Investor

Servicing

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Investor

Servicing.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

FLEXCUBE

Investor

Servicing.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Agile

PLM

component

of

Oracle

Supply

Chain

Products

Suite

(subcomponent:

Folders

Files

Attachments).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Agile

PLM.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Agile

PLM

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Agile

PLM.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L).

denial of service
unauthorized access
privileged network access compromise