Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname.


Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.


Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.


Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full pathname in the url parameter to AjaxProxy.php.


Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.


Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.


Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.


Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.


Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.


Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the \Upload file from url\ field in the file manager for professor.php.


Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.


Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier when the paranoid openin_any setting is omitted allows remote authenticated users to read arbitrary files via a \\include command.


Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive.


Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.


Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.


Absolute path traversal vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to browse arbitrary directories via the path parameter.


Absolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter and possibly remote files using UNC share pathnames.


Absolute path traversal vulnerability in admin/logfile.txt in Verity Ultraseek before 5.6.2 allows remote attackers to read arbitrary files via the name variable.


Absolute path traversal vulnerability in the get functionality in Anti-Spam SMTP Proxy (ASSP) allows remote authenticated users to read arbitrary files via (1) C:\\ (Windows drive letter) (2) UNC and possibly other types of paths in the file parameter.


Absolute path traversal vulnerability in includes/functions_portal.php in IntegraMOD Portal 2.x and earlier when magic_quotes_gpc is disabled allows remote attackers to read arbitrary files via an absolute pathname in the phpbb_root_path parameter.


Absolute path traversal vulnerability in abitwhizzy.php before 20061204 allows remote attackers to read arbitrary files via an absolute pathname in the Filename text window (f parameter) a variant of CVE-2006-6084.


Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php.


Absolute path traversal vulnerability in file in Enigma2 Webinterface 1.6.0 through 1.6.8 1.6rc3 and 1.7.0 allows remote attackers to read arbitrary files via a full pathname in the file parameter.


Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.


Absolute path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action.


Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with a full pathname in a PATH element of an SRS record.


Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter.


A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the dest_folder parameter.


A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter.


A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master.


A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL.


A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting.


A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file.


A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface.


Absolute path traversal vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to read arbitrary files via a full pathname in the AttachPath field of a mail message under composition.


Absolute path traversal vulnerability in front-end/dir.php in mini-pub 0.3 and earlier allows remote attackers to list arbitrary directories via a full pathname in the sDir parameter.


Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pathname in the sFileName parameter.


Absolute path traversal vulnerability in admin/fileKontrola/browser.asp in Omnicom Content Platform (OCP) 2.0 allows remote attackers to list arbitrary directories via a full pathname in the root parameter.


Absolute path traversal vulnerability in sendfile.php in web-cp 0.5.7 when register_globals is enabled allows remote attackers to read arbitrary files via a full pathname in the filelocation parameter.


Absolute path traversal vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2.0 allows remote attackers to list arbitrary directories and read arbitrary files via a full pathname in the file parameter.


Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the showtree parameter.


Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary files and list arbitrary directories via a full pathname in the name parameter.


Absolute path traversal vulnerability in index.php in Sys-Hotel on Line System allows remote attackers to read arbitrary files via an encoded \/\ (\%2F\) in the file parameter.


Absolute path traversal vulnerability in index.php in Million Dollar Script 2.0.14 allows remote attackers to read arbitrary files via encoded \/\ (%2F) sequences in the link parameter.


Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to overwrite arbitrary files via the SaveToFile method. NOTE: the victim must explicitly allow the code to run.


Absolute path traversal vulnerability in xftpd in the FTP Server component in Apple Mac OS X before 10.6.8 allows remote attackers to list arbitrary directories by using the root directory as the starting point of a recursive listing.


Absolute path traversal vulnerability in the web interface on HP StorageWorks P2000 G3 MSA array systems allows remote attackers to read arbitrary files via a pathname in the URI.


Absolute path traversal vulnerability in convert.cgi in Quirex 2.0.2 and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary code via the (1) quiz_head (2) quiz_foot and (3) template variables.

path traversal vulnerability
arbitrary code execution


Absolute path traversal vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote registered users to execute arbitrary code by uploading a malicious file to the Windows startup folder.


A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.

path traversal vulnerability
bypass authentication


A path traversal vulnerability on Pardus Software Center's \extractArchive\ function could allow anyone on the same network to do a man-in-the-middle and write files on the system.

path traversal vulnerability
man in the middle


ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL which leaks the pathname in an error message.


A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue is fixed in iOS 13. Processing a maliciously crafted file may disclose user information.


A permissions issue existed in the handling of motion and orientation data. This issue was addressed with improved restrictions. This issue is fixed in iOS 12.2. A website may be able to access sensor information without user consent.


A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in Security Update 2021-005 Catalina macOS Big Sur 11.6. A local attacker may be able to elevate their privileges.


A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue affected versions prior to macOS High Sierra 10.13.4.


A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14.


A permissions issue existed. This issue was addressed with improved permission validation. This issue affected versions prior to iOS 12.


A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to gain root privileges.

malicious app
gain root privilege
permission issue


A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in iOS 13.4 and iPadOS 13.4 macOS Catalina 10.15.4 watchOS 6.2. A malicious application may be able to elevate privileges.


MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks then third parties may discover password-reset hashes file-delete links or other sensitive information.

place sensitive information in the header


The administrative web interface (STEMWADM) for SurfControl SuperScout Email Filter allows users to obtain usernames and plaintext passwords via a request to the userlist.asp program which includes the passwords in a user editing form.


Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.

pointer dereference vulnerability
denial of service
null pointer dereference


NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.


NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthenticated connections.

pointer dereference vulnerability
null pointer dereference


Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attackers.


Null pointer dereference vulnerability in parser_ispe function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.


Null pointer dereference vulnerability in parser_unknown_property function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.


Null pointer dereference vulnerability in parser_irot function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.


Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds read by remote attackers.


Null pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.


Null pointer dereference vulnerability in parser_auxC function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.


NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption.

pointer dereference vulnerability
null pointer dereference
memory corruption


NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption.


Adobe Acrobat and Reader versions 2018.011.20038 and earlier 2017.011.30079 and earlier and 2015.006.30417 and earlier have an XFA '\\n' POST injection vulnerability. Successful exploitation could lead to a security bypass.


A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead to unauthorized elevation of privilege on the client.


A potential security vulnerability has been identified for certain HP printers and MFPs with Troy solutions. For affected printers with FutureSmart Firmware bundle version 4.9 or 4.9.0.1 the potential vulnerability may cause instability in the solution.


A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout.


A potential security vulnerability has been identified in the software solution HP Access Control versions prior to 16.7. This vulnerability could potentially grant elevation of privilege.


A potential security vulnerability has been identified in HPE Network Orchestrator (NetO) version(s): Prior to 2.5. The vulnerability could be remotely exploited with SQL injection.


A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified with early versions of the Isaac Mizrahi Smartwatch mobile app. HP has no access to customer data as a result of this issue.


A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10 10.11 10.20 10.21 10.22 10.23. These vulnerabilities could be remotely exploited to allow code execution.


A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26 9.30 9.40. The vulnerability could be remotely exploited to allow code execution.


A potential security vulnerability has been identified in HPE Device Entitlement Gateway (DEG) v3.2.4 v3.3 and v3.3.1. The vulnerability could be remotely exploited to allow local SQL injection and elevation of privilege.


A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. The vulnerability could be remotely exploited to disclose the serial number and other information.


A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a local attacker to execute arbitrary code via an HP System Event Utility system service.

potential security vulnerability
arbitrary code execution


A potential security vulnerability has been identified with HP PageWide Printers HP OfficeJet Pro Printers with firmware before 1708D. This vulnerability could potentially be exploited to execute arbitrary code.


A potential security vulnerability has been identified in the HPE StoreEver MSL2024 Tape Library and HPE StoreEver 1/8 G2 Tape Autoloaders. The vulnerability could be remotely exploited to allow Cross-site Request Forgery (CSRF).

potential security vulnerability
cross site request forgery


A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSS).

potential security vulnerability
cross site scripting


A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10 10.11 10.20 10.21 10.22 10.23. These vulnerabilities could be remotely exploited to allow cross-site scripting.


A potential security vulnerability has been identified in HPE Performance Center versions 12.20. The vulnerability could be remotely exploited to allow cross-site scripting.


A potential security vulnerability has been identified with Samsung Laser Printers. This vulnerability could potentially be exploited to create a denial of service.

potential security vulnerability
denial of service


A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). The vulnerability could allow remote Denial of Service. The vulnerability is resolved in Integrated Lights-Out 4 (iLO 4) 2.80 and later.


A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. This vulnerability could potentially be exploited to create a denial of service.


A potential security vulnerability has been identified in HPE Content Manager Workgroup Service v9.00. The vulnerability could be remotely exploited to allow Denial of Service (DoS).

potential security vulnerability
denial of service
dos


A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. The vulnerability could be remotely exploited to allow for remote directory traversal leading to arbitrary file deletion.

potential security vulnerability
directory traversal


A potential security vulnerability has been identified in HPE Connected Backup versions 8.6 and 8.8.6. The vulnerability could be exploited locally to allow escalation of privilege.

potential security vulnerability
escalated privilege


A potential security vulnerability was identified in HPE iLO Amplifier Pack. The vulnerabilities could be remotely exploited to allow remote code execution.

potential security vulnerability
remote code execution


A potential security vulnerability has been identified in HPE iLO Amplifier Pack server version 1.70. The vulnerability could be exploited to allow remote code execution.


A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerability could be exploited to allow remote code execution.


Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-38671 CVE-2021-40447.

print spooler elevation
elevated privilege vulnerability


Windows Print Spooler Elevation of Privilege Vulnerability


Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26878.


Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1640.


Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-38667 CVE-2021-38671.


Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-29104.


Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-29132.


Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21997 CVE-2022-21999 CVE-2022-22717.


Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21997 CVE-2022-21999 CVE-2022-22718.


Windows Print Spooler Elevation of Privilege Vulnerability.


Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21997 CVE-2022-22717 CVE-2022-22718.


Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21999 CVE-2022-22717 CVE-2022-22718.


Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17001.


Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17014.


A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure (PI) could allow an authenticated remote attacker to change the virtual domain configuration which could lead to privilege escalation. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by manipulating requests sent to an affected PI server. A successful exploit could allow the attacker to change the virtual domain configuration and possibly elevate privileges.


A privilege escalation vulnerability in Trend Micro Antivirus for Mac 2019 (v9.0.1379 and below) could potentially allow an attacker to create a symbolic link to a target file and modify it.


A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a malicious DLL file into the application directory and elevate privileges.


A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.


A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege via injecting specially crafted \ExportLogs\ type IPC client requests to the fctsched process.


A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10 prior to version 1.67.17.54 that could allow unauthorized access to the driver's device object.


A privilege escalation vulnerability was reported in the MM1000 device configuration web server which could allow privileged shell access and/or arbitrary privileged commands to be executed on the adapter.


The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create edit and delete maps.


A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and perform CRUD Operations.


Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.


A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to escalate privileges. Affects 8.0.0.0 through 8.1.3.1 versions of AVPU.


A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges.


A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command.


Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain administrator privileges whilst using the clients.


A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.


A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with local privileges could execute code with administrative privileges via an unquoted service path.


A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6 5.6.0 to 5.6.10 5.4 and below allows admin users to elevate their profile to super_admin via restoring modified configurations.


A privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.


Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.


A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file.


A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Protector Agent 3.4.5586.9772 which could let a local malicious user obtain privileges.


A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772 which could let a local malicious user obtain privileges.


A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.


A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authenticated user to execute code with elevated privileges.


A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version that could allow an authenticated user to execute code with elevated privileges.


A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an authenticated user to execute code with elevated privileges.


A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to execute code with elevated privileges.


A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary which could let a remote malicious user execute arbitrary code

privilege escalation vulnerability
arbitrary code execution


A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration an attacker can globally overwrite service configuration to execute arbitrary code with NT SYSTEM privileges.


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

Security:

Privileges).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Primavera

Enterprise

Project

Portfolio

Management

component

of

Oracle

Construction

and

Engineering

Suite

(subcomponent:

Web

Access).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Enterprise

Project

Portfolio

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Primavera

Enterprise

Project

Portfolio

Management

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Application

Express

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Valid

Account

privilege

with

network

access

via

HTTP

to

compromise

Application

Express.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Application

Express

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Application

Express

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Application

Express

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Session

Execute

on

privilege

with

network

access

via

OracleNet

to

compromise

Core

RDBMS.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Core

RDBMS

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

Hospitality

Reporting

and

Analytics

component

of

Oracle

Food

and

Beverage

Applications.

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

having

Admin

Configuration

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Reporting

and

Analytics.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).


Vulnerability

in

the

Oracle

Hospitality

Reporting

and

Analytics

component

of

Oracle

Food

and

Beverage

Applications.

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Admin

Configuration

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Reporting

and

Analytics.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).


Vulnerability

in

the

Java

VM

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

having

Create

Session

Create

Procedure

privilege

with

network

access

via

multiple

protocols

to

compromise

Java

VM.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Java

VM.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Hospitality

Reporting

and

Analytics

component

of

Oracle

Food

and

Beverage

Applications.

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Inventory

Integration

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Reporting

and

Analytics.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Hospitality

Reporting

and

Analytics

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

XML

Publisher).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Health

Sciences

Data

Management

Workbench

component

of

Oracle

Health

Sciences

Applications

(subcomponent:

User

Interface).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Health

Sciences

Data

Management

Workbench.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Health

Sciences

Data

Management

Workbench

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Health

Sciences

Data

Management

Workbench

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

WLS

Core

Components).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebLogic

Server

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebLogic

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

OracleNet

to

compromise

Core

RDBMS.

While

the

vulnerability

is

in

Core

RDBMS

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Core

RDBMS

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).


Vulnerability

in

the

Siebel

Core

Common

Components

component

of

Oracle

Siebel

CRM

(subcomponent:

Email).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Siebel

Core

Common

Components.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Siebel

Core

Common

Components

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

SQR).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

While

the

vulnerability

is

in

PeopleSoft

Enterprise

PeopleTools

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

PeopleTools

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

PeopleTools

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).


Vulnerability

in

the

Hyperion

BI+

component

of

Oracle

Hyperion

(subcomponent:

Foundation

UI

Servlets).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

BI+.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Hyperion

BI+

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Hyperion

BI+

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Hyperion

BI+.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Information

Schema).

Supported

versions

that

are

affected

are

and

prior

and

prior

and

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

privilege

with

network

access

via

Oracle

Net

to

compromise

Core

RDBMS.

While

the

vulnerability

is

in

Core

RDBMS

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Core

RDBMS.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Hospitality

Reporting

and

Analytics

component

of

Oracle

Food

and

Beverage

Applications.

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Admin

Configuration

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Reporting

and

Analytics.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Hyperion

Planning

component

of

Oracle

Hyperion

(subcomponent:

Security).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hyperion

Planning.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hyperion

Planning

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

WLS

Core

Components).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebLogic

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).


Vulnerability

in

the

BI

Publisher

(formerly

XML

Publisher)

component

of

Oracle

Fusion

Middleware

(subcomponent:

BI

Publisher

Security).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

BI

Publisher

(formerly

XML

Publisher).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

BI

Publisher

(formerly

XML

Publisher)

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebLogic

Server

product

of

Oracle

Fusion

Middleware

(component:

Web

Services).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Hospitality

Reporting

and

Analytics

component

of

Oracle

Food

and

Beverage

Applications.

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Admin

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Reporting

and

Analytics.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Reporting

and

Analytics

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebLogic

Server

product

of

Oracle

Fusion

Middleware

(component:

Console).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebLogic

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).


Vulnerability

in

the

RDBMS

Scheduler

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Export

Full

Database

privilege

with

network

access

via

Oracle

Net

to

compromise

RDBMS

Scheduler.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

RDBMS

Scheduler.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Unified

Audit

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

SYS

Account

privilege

with

network

access

via

Oracle

Net

to

compromise

Unified

Audit.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Unified

Audit

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

Document

Management

and

Collaboration

product

of

Oracle

E-Business

Suite

(component:

Attachments).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Document

Management

and

Collaboration.

While

the

vulnerability

is

in

Oracle

Document

Management

and

Collaboration

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Document

Management

and

Collaboration

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Document

Management

and

Collaboration

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).


Vulnerability

in

the

Oracle

Storage

Cloud

Software

Appliance

product

of

Oracle

Storage

Gateway

(component:

Management

Console).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Storage

Cloud

Software

Appliance.

While

the

vulnerability

is

in

Oracle

Storage

Cloud

Software

Appliance

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Storage

Cloud

Software

Appliance

accessible

data.

Note:

Updating

the

Oracle

Storage

Cloud

Software

Appliance

to

version

or

later

will

address

these

vulnerabilities.

Download

the

latest

version

of

Oracle

Storage

Cloud

Software

Appliance

from

<a

href=\

Refer

to

Document

<a

for

more

details.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).


Vulnerability

in

the

Oracle

XML

DB

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Alter

User

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

XML

DB.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

XML

DB

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).


Vulnerability

in

the

Oracle

FLEXCUBE

Direct

Banking

product

of

Oracle

Financial

Services

Applications

(component:

Pre

Login).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

Oracle

Net

to

compromise

Oracle

FLEXCUBE

Direct

Banking.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Direct

Banking

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

XML

DB

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Any

Procedure

Create

Public

Synonym

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

XML

DB.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

XML

DB.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Application

Express

Opportunity

Tracker

component

of

Oracle

Database

Server.

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Valid

User

Account

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Application

Express

Opportunity

Tracker.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Application

Express

Opportunity

Tracker

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Application

Express

Opportunity

Tracker

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Application

Express

Opportunity

Tracker

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).


Vulnerability

in

the

OSS

Support

Tools

product

of

Oracle

Support

Tools

(component:

Diagnostic

Assistant).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

OSS

Support

Tools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

OSS

Support

Tools

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

VM

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

Oracle

Net

to

compromise

Java

VM.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Java

VM

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).


Vulnerability

in

the

Oracle

Database

Enterprise

Edition

Data

Redaction

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

Database

Enterprise

Edition

Data

Redaction.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Database

Enterprise

Edition

Data

Redaction

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

Application

Express

Survey

Builder

component

of

Oracle

Database

Server.

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Valid

User

Account

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Application

Express

Survey

Builder.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Application

Express

Survey

Builder

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Application

Express

Survey

Builder

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Application

Express

Survey

Builder

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Parser).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

MySQL

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Database

Vault

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Any

View

Select

Any

View

privilege

with

network

access

via

Oracle

Net

to

compromise

Database

Vault.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Database

Vault

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Oracle

Access

Manager

product

of

Oracle

Fusion

Middleware

(component:

Rest

interfaces

for

Access

Mgr).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTPS

to

compromise

Oracle

Access

Manager.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Access

Manager

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Communications

Session

Border

Controller

product

of

Oracle

Communications

(component:

Routing).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Communications

Session

Border

Controller.

While

the

vulnerability

is

in

Oracle

Communications

Session

Border

Controller

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Communications

Session

Border

Controller

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).


Vulnerability

in

the

Database

Vault

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

DBA

privilege

with

network

access

via

Oracle

Net

to

compromise

Database

Vault.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Database

Vault

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Security:

Privileges).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Information

Schema).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Recovery

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

DBA

Level

Account

privilege

with

network

access

via

Oracle

Net

to

compromise

Recovery.

While

the

vulnerability

is

in

Recovery

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Recovery

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Cloud

Infrastructure

Storage

Gateway

product

of

Oracle

Storage

Gateway

(component:

Management

Console).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Cloud

Infrastructure

Storage

Gateway.

While

the

vulnerability

is

in

Oracle

Cloud

Infrastructure

Storage

Gateway

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

Cloud

Infrastructure

Storage

Gateway.

Note:

Updating

the

Oracle

Cloud

Infrastructure

Storage

Gateway

to

version

or

later

will

address

these

vulnerabilities.

Download

the

latest

version

of

Oracle

Cloud

Infrastructure

Storage

Gateway

from

<a

href=\

Refer

to

Document

<a

for

more

details.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Text

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Any

Procedure

Alter

Any

Table

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

Text.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

Text.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

PeopleSoft

Enterprise

HCM

Shared

Components

product

of

Oracle

PeopleSoft

(component:

Person

Search).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

HCM

Shared

Components.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

HCM

Shared

Components

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

HCM

Shared

Components

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).


Vulnerability

in

the

Oracle

WebLogic

Server

product

of

Oracle

Fusion

Middleware

(component:

Console).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Database

Enterprise

Edition

Data

Redaction

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

Database

Enterprise

Edition

Data

Redaction.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Database

Enterprise

Edition

Data

Redaction

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Application

Express

Data

Reporter

component

of

Oracle

Database

Server.

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Valid

User

Account

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Application

Express

Data

Reporter.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Application

Express

Data

Reporter

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Application

Express

Data

Reporter

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Application

Express

Data

Reporter

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

RDBMS

Sharding

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Any

Procedure

Create

Any

View

Create

Any

Trigger

privilege

with

network

access

via

Oracle

Net

to

compromise

RDBMS

Sharding.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

RDBMS

Sharding.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Applications

Manager

product

of

Oracle

E-Business

Suite

(component:

View

Reports).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Applications

Manager.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Applications

Manager

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Applications

Manager

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Cloud

Infrastructure

Storage

Gateway

product

of

Oracle

Storage

Gateway

(component:

Management

Console).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Cloud

Infrastructure

Storage

Gateway.

While

the

vulnerability

is

in

Oracle

Cloud

Infrastructure

Storage

Gateway

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

Cloud

Infrastructure

Storage

Gateway.

Note:

Updating

the

Oracle

Cloud

Infrastructure

Storage

Gateway

to

version

or

later

will

address

these

vulnerabilities.

Download

the

latest

version

of

Oracle

Cloud

Infrastructure

Storage

Gateway

from

<a

href=\

Refer

to

Document

<a

for

more

details.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Information

Schema).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Hyperion

Infrastructure

Technology

product

of

Oracle

Hyperion

(component:

Lifecycle

Management).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

Infrastructure

Technology.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Hyperion

Infrastructure

Technology

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Hyperion

Infrastructure

Technology

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N).


Vulnerability

in

the

Oracle

Business

Intelligence

Enterprise

Edition

product

of

Oracle

Fusion

Middleware

(component:

Analytics

Web

General).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Business

Intelligence

Enterprise

Edition.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Business

Intelligence

Enterprise

Edition

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Business

Intelligence

Enterprise

Edition

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Business

Intelligence

Enterprise

Edition

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N).


Vulnerability

in

the

Oracle

Database

Enterprise

Edition

Unified

Audit

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Audit

Policy

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

Database

Enterprise

Edition

Unified

Audit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Database

Enterprise

Edition

Unified

Audit

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Hyperion

Infrastructure

Technology

product

of

Oracle

Hyperion

(component:

Lifecycle

Management).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

Infrastructure

Technology.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Hyperion

Infrastructure

Technology

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Hyperion

Infrastructure

Technology

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N).


Vulnerability

in

the

Oracle

XML

DB

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Any

Procedure

Create

Public

Synonym

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

XML

DB.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

XML

DB.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

VM

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

Oracle

Net

to

compromise

Java

VM.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Java

VM

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).


Vulnerability

in

the

Oracle

WebLogic

Server

product

of

Oracle

Fusion

Middleware

(component:

Web

Services).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

WebLogic

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

DDL).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Security:

Roles).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Database

Enterprise

Edition

Unified

Audit

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Local

Logon

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

Database

Enterprise

Edition

Unified

Audit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Database

Enterprise

Edition

Unified

Audit

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Security:

Privileges).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

VM

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

having

Create

Procedure

privilege

with

network

access

via

Oracle

Net

to

compromise

Java

VM.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Java

VM.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Options).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

MySQL

Server

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).


Vulnerability

in

the

Oracle

Applications

Manager

product

of

Oracle

E-Business

Suite

(component:

Diagnostics).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Applications

Manager.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Applications

Manager

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Security:

Privileges).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

MySQL

Server

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Primavera

Portfolio

Management

product

of

Oracle

Construction

and

Engineering

(component:

Web

Access).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Portfolio

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Primavera

Portfolio

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Primavera

Portfolio

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Primavera

Portfolio

Management

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).


Vulnerability

in

the

Java

VM

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Procedure

privilege

with

network

access

via

multiple

protocols

to

compromise

Java

VM.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Java

VM

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).


Vulnerability

in

the

MySQL

Connectors

product

of

Oracle

MySQL

(component:

Connector/J).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Connectors.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

MySQL

Connectors.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Communications

Operations

Monitor

product

of

Oracle

Communications

(component:

Mediation

Engine).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Communications

Operations

Monitor.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Communications

Operations

Monitor

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Communications

Operations

Monitor

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Communications

Operations

Monitor

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Logging).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).


Vulnerability

in

the

Oracle

Database

Enterprise

Edition

Sharding

component

of

Oracle

Database

Server.

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Any

Procedure

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

Database

Enterprise

Edition

Sharding.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

Database

Enterprise

Edition

Sharding.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Communications

Operations

Monitor

product

of

Oracle

Communications

(component:

Mediation

Engine).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Communications

Operations

Monitor.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

Communications

Operations

Monitor.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Session

Execute

Catalog

Role

privilege

with

network

access

via

Oracle

Net

to

compromise

Core

RDBMS.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Core

RDBMS

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

RDBMS

Gateway

Generic

ODBC

Connectivity

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

Oracle

Net

to

compromise

RDBMS

Gateway

Generic

ODBC

Connectivity.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

RDBMS

Gateway

Generic

ODBC

Connectivity

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

RDBMS

Gateway

Generic

ODBC

Connectivity

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).


Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS v3.0 Base Score 8.4 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

PeopleSoft

Enterprise

SCM

eBill

Payment

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Security).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

SCM

eBill

Payment.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

SCM

eBill

Payment

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

SCM

eBill

Payment

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

SCM

eSupplier

Connection

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Vendor).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

SCM

eSupplier

Connection.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

SCM

eSupplier

Connection

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

SCM

eSupplier

Connection

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Client

mysqldump).

Supported

versions

that

are

affected

are

and

earlier

and

earlier

and

and

earlier.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

MySQL

Server.

Note:

is

equivalent

to

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).


Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: OAM Client). Supported versions that are affected are 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS v3.0 Base Score 4.9 (Confidentiality impacts).


Vulnerability

in

the

PeopleSoft

Enterprise

FSCM

component

of

Oracle

PeopleSoft

Products

(subcomponent:

eSettlements).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

FSCM.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

FSCM

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

FSCM

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

PeopleSoft

Enterprise

SCM

Service

Procurement

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Usability).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

SCM

Service

Procurement.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

SCM

Service

Procurement

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

SCM

Service

Procurement

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Primavera

Gateway

component

of

Oracle

Primavera

Products

Suite

(subcomponent:

Primavera

Desktop

Integration).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Gateway.

While

the

vulnerability

is

in

Primavera

Gateway

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Primavera

Gateway.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).


Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.7.16 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS v3.0 Base Score 2.4 (Confidentiality impacts).


Vulnerability

in

the

PeopleSoft

Enterprise

SCM

Purchasing

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Supplier

Registration).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

SCM

Purchasing.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

SCM

Purchasing

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

SCM

Purchasing

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Applications

DBA

component

of

Oracle

E-Business

Suite

(subcomponent:

AD

Utilities).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Applications

DBA.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Applications

DBA

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Applications

DBA

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Payables

component

of

Oracle

E-Business

Suite

(subcomponent:

Self

Service

Manager).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Payables.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Payables

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Payables

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Transportation

Manager

component

of

Oracle

Supply

Chain

Products

Suite

(subcomponent:

Security).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Transportation

Manager.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Transportation

Manager

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Transportation

Manager

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

CS

Campus

Community

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Frameworks).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

CS

Campus

Community.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

CS

Campus

Community

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

CS

Campus

Community

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

PeopleSoft

Enterprise

SCM

Strategic

Sourcing

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Bidder

Registration).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

SCM

Strategic

Sourcing.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

SCM

Strategic

Sourcing

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

SCM

Strategic

Sourcing

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create Session Create Procedure privilege with network access via multiple protocols to compromise OJVM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in OJVM attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of OJVM. CVSS v3.0 Base Score 9.0 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

Oracle

Integrated

Lights

Out

Manager

(ILOM)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

System

Management).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Integrated

Lights

Out

Manager

(ILOM).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Integrated

Lights

Out

Manager

(ILOM)

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Session

Execute

Catalog

Role

privilege

with

network

access

via

Oracle

Net

to

compromise

Core

RDBMS.

While

the

vulnerability

is

in

Core

RDBMS

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Core

RDBMS.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Primavera

Unifier

component

of

Oracle

Primavera

Products

Suite

(subcomponent:

Platform).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Unifier.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Primavera

Unifier

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Primavera

Unifier

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Primavera

Unifier

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).


Vulnerability

in

the

Oracle

Hospitality

Guest

Access

component

of

Oracle

Hospitality

Applications

(subcomponent:

Base).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Guest

Access.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Hospitality

Guest

Access

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Guest

Access

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Hospitality

Guest

Access

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

FSCM

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Staffing

Front

Office).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

FSCM.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

FSCM

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector: