Vulnerability

in

the

Solaris

Cluster

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

HA

for

MySQL).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Solaris

Cluster

executes

to

compromise

Solaris

Cluster.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Solaris

Cluster

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Solaris

Cluster

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris

Cluster.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L).

denial of service
unauthenticated infrastructure logon
dos


Vulnerability

in

the

Oracle

Hospitality

OPERA

Property

Services

component

of

Oracle

Hospitality

Applications

(subcomponent:

OPERA

Printing

and

Login).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Oracle

Hospitality

OPERA

Property

Services

executes

to

compromise

Oracle

Hospitality

OPERA

Property

Services.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hospitality

OPERA

Property

Services

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

OPERA

Property

Services

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

OPERA

Property

Services.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L).


Vulnerability

in

the

Automatic

Service

Request

(ASR)

component

of

Oracle

Support

Tools

(subcomponent:

ASR

Manager).

The

supported

version

that

is

affected

is

Prior

to

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Automatic

Service

Request

(ASR)

executes

to

compromise

Automatic

Service

Request

(ASR).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Automatic

Service

Request

(ASR)

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Automatic

Service

Request

(ASR).

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Automatic

Service

Request

(ASR)

component

of

Oracle

Support

Tools

(subcomponent:

ASR

Manager).

The

supported

version

that

is

affected

is

Prior

to

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Automatic

Service

Request

(ASR)

executes

to

compromise

Automatic

Service

Request

(ASR).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Automatic

Service

Request

(ASR)

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Automatic

Service

Request

(ASR).

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Zones).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Solaris

executes

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Java

SE

Java

SE

Embedded

executes

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

SE

Java

SE

Embedded

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Java

SE

Java

SE

Embedded

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

GraalVM

(component:

LLVM

Interpreter).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Oracle

GraalVM

Enterprise

Edition

executes

to

compromise

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

GraalVM

Enterprise

Edition.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

denial of service
unauthenticated network access


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Concurrency).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

can

only

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

Untrusted

Java

Web

Start

applications

or

Untrusted

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Networking).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

component

of

Oracle

Java

SE

(subcomponent:

Deployment).

The

supported

version

that

is

affected

is

Java

SE:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

Hospitality

Simphony

component

of

Oracle

Food

and

Beverage

Applications.

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Simphony.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hospitality

Simphony

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Simphony

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

Simphony.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L).


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

Utilities).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Networking).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

JAXP).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Clusterware

component

of

Oracle

Support

Tools

(subcomponent:

Trace

File

Analyzer

(TFA)

Collector).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Clusterware.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Clusterware

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Clusterware

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Clusterware.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

WLS

Core

Components).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

to

compromise

Oracle

WebLogic

Server.

While

the

vulnerability

is

in

Oracle

WebLogic

Server

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebLogic

Server

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

WebLogic

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

While

the

vulnerability

is

in

Oracle

Outside

In

Technology

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L).


Vulnerability

in

the

Oracle

Application

Testing

Suite

component

of

Oracle

Enterprise

Manager

Products

Suite

(subcomponent:

Load

Testing

for

Web

Apps).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Application

Testing

Suite.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Application

Testing

Suite

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Application

Testing

Suite

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Application

Testing

Suite.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

product

of

Oracle

Java

SE

(component:

Supported

versions

that

are

affected

are

Java

SE:

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Point-of-Service

component

of

Oracle

Retail

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Point-of-Service.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Point-of-Service

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Point-of-Service

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Point-of-Service.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Communications

Diameter

Signaling

Router

(DSR)

component

of

Oracle

Communications

Applications

(subcomponent:

Security).

The

supported

version

that

is

affected

is

prior

to

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Communications

Diameter

Signaling

Router

(DSR).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Communications

Diameter

Signaling

Router

(DSR)

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Communications

Diameter

Signaling

Router

(DSR).

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

product

of

Oracle

Java

SE

(component:

Hotspot).

Supported

versions

that

are

affected

are

Java

SE:

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Java

SE

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).


Vulnerability

in

the

Oracle

Retail

Convenience

Store

Back

Office

component

of

Oracle

Retail

Applications

(subcomponent:

Level

Maintenance

Functions).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Convenience

Store

Back

Office.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Convenience

Store

Back

Office

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Convenience

Store

Back

Office

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Convenience

Store

Back

Office.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MICROS

Retail-J

component

of

Oracle

Retail

Applications

(subcomponent:

Internal

Operations).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

MICROS

Retail-J.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

MICROS

Retail-J

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

MICROS

Retail-J

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MICROS

Retail-J.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).


Vulnerability

in

the

MySQL

Connectors

product

of

Oracle

MySQL

(component:

Connector/ODBC).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Connectors.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Connectors.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

JAXP).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

Utilities).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

component

of

Oracle

Fusion

Middleware

(subcomponent:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

product

of

Oracle

Java

SE

(component:

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

(in

Java

SE

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Application

Object

Library

product

of

Oracle

E-Business

Suite

(component:

Login

Help).

Supported

versions

that

are

affected

are

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Application

Object

Library.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Application

Object

Library.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).

denial of service
unauthenticated network access
dos


Vulnerability

in

the

Oracle

Applications

Framework

product

of

Oracle

E-Business

Suite

(component:

Session

Management).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Applications

Framework.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Applications

Framework.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

MySQL

Cluster

product

of

Oracle

MySQL

(component:

Cluster:

JS

module).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Cluster.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Cluster.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

PeopleSoft

Enterprise

PT

PeopleTools

product

of

Oracle

PeopleSoft

(component:

Health

Center).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PT

PeopleTools.

While

the

vulnerability

is

in

PeopleSoft

Enterprise

PT

PeopleTools

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

PT

PeopleTools

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PT

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PT

PeopleTools.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Enterprise

Manager

for

Fusion

Middleware

product

of

Oracle

Enterprise

Manager

(component:

FMW

Control

Plugin).

The

supported

version

that

is

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

for

Fusion

Middleware.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

for

Fusion

Middleware

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Enterprise

Manager

for

Fusion

Middleware

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

for

Fusion

Middleware.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

score

depend

on

the

software

that

uses

the

Outside

In

Technology

code.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

code

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebLogic

Server

product

of

Oracle

Fusion

Middleware

(component:

Core).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

IIOP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebLogic

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Oracle

Outside

In

Technology

product

of

Oracle

Fusion

Middleware

(component:

Outside

In

Filters).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Outside

In

Technology.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Outside

In

Technology

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Outside

In

Technology

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Outside

In

Technology.

Note:

Outside

In

Technology

is

a

suite

of

software

development

kits

(SDKs).

The

protocol

and

CVSS

Base

Score

depend

on

the

software

that

uses

Outside

In

Technology.

The

CVSS

score

assumes

that

the

software

passes

data

received

over

a

network

directly

to

Outside

In

Technology

but

if

data

is

not

received

over

a

network

the

CVSS

score

may

be

lower.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

product

of

Oracle

Java

SE

(component:

JNDI).

The

supported

version

that

is

affected

is

Java

SE:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Communications

Interactive

Session

Recorder

product

of

Oracle

Communications

(component:

Provision

API).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Communications

Interactive

Session

Recorder.

While

the

vulnerability

is

in

Oracle

Communications

Interactive

Session

Recorder

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Communications

Interactive

Session

Recorder

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Communications

Interactive

Session

Recorder

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Communications

Interactive

Session

Recorder.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

ImageIO).

Supported

versions

that

are

affected

are

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

Swing).

Supported

versions

that

are

affected

are

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Cluster

product

of

Oracle

MySQL

(component:

Cluster:

General).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Cluster.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Cluster.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

JSSE).

Supported

versions

that

are

affected

are

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

TLS

to

compromise

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

can

only

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

Untrusted

Java

Web

Start

applications

or

Untrusted

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

Swing).

Supported

versions

that

are

affected

are

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

Utility).

Supported

versions

that

are

affected

are

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

Hotspot).

Supported

versions

that

are

affected

are

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

WebLogic

Server

product

of

Oracle

Fusion

Middleware

(component:

Core).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebLogic

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

ImageIO).

Supported

versions

that

are

affected

are

Oracle

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

JAXP).

Supported

versions

that

are

affected

are

Oracle

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

Libraries).

Supported

versions

that

are

affected

are

Oracle

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

Libraries).

Supported

versions

that

are

affected

are

Oracle

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

Supported

versions

that

are

affected

are

Oracle

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition

product

of

Oracle

Java

SE

(component:

Serialization).

Supported

versions

that

are

affected

are

Oracle

Java

SE:

Oracle

GraalVM

Enterprise

Edition:

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Java

SE

Oracle

GraalVM

Enterprise

Edition.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

can

also

be

exploited

by

using

APIs

in

the

specified

Component

e.g.

through

a

web

service

which

supplies

data

to

the

APIs.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Service

Bus

component

of

Oracle

Fusion

Middleware

(subcomponent:

Web

Console

Design).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Service

Bus.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Service

Bus

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Service

Bus

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Service

Bus.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters ). Supported versions that are affected are 8.5.2 and 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update insert or delete access to some of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code but if data is not received over a network the CVSS score may be lower. CVSS v3.0 Base Score 8.6 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Integration

Broker).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).


Vulnerability

in

the

JD

Edwards

EnterpriseOne

Tools

component

of

Oracle

JD

Edwards

Products

(subcomponent:

Web

Runtime

SEC).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

JD

Edwards

EnterpriseOne

Tools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

JD

Edwards

EnterpriseOne

Tools

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

JD

Edwards

EnterpriseOne

Tools.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: General). Supported versions that are affected are 7.2.25 and earlier 7.3.14 and earlier and 7.4.12 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS v3.0 Base Score 3.7 (Availability impacts).


Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: NDBAPI). Supported versions that are affected are 7.2.25 and earlier 7.3.14 and earlier 7.4.12 and earlier and . Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS v3.0 Base Score 3.7 (Availability impacts).


Vulnerability

in

the

Oracle

Fusion

Middleware

MapViewer

component

of

Oracle

Fusion

Middleware

(subcomponent:

Map

Builder).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Fusion

Middleware

MapViewer.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Fusion

Middleware

MapViewer

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Fusion

Middleware

MapViewer

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Fusion

Middleware

MapViewer.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Remote

Administration

Daemon).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.2 8.3 8.4 15.1 15.2 16.1 and 16.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. While the vulnerability is in Primavera P6 Enterprise Project Portfolio Management attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation deletion or modification access to critical data or all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera P6 Enterprise Project Portfolio Management. CVSS v3.0 Base Score 10.0 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

Oracle

Communications

Security

Gateway

component

of

Oracle

Communications

Applications

(subcomponent:

Network).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

ICMP

Ping

to

compromise

Oracle

Communications

Security

Gateway.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Communications

Security

Gateway.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

WebCenter

Sites

component

of

Oracle

Fusion

Middleware

(subcomponent:

Server).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Sites.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebCenter

Sites

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebCenter

Sites

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebCenter

Sites.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).


Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

Oracle

Retail

Invoice

Matching

component

of

Oracle

Retail

Applications

(subcomponent:

Security).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Invoice

Matching.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Retail

Invoice

Matching

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Invoice

Matching

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Invoice

Matching.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Servlet

Runtime).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

While

the

vulnerability

is

in

Oracle

WebLogic

Server

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebLogic

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L).


Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

Oracle

WebCenter

Sites

component

of

Oracle

Fusion

Middleware

(subcomponent:

Server).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Sites.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebCenter

Sites

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebCenter

Sites

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebCenter

Sites.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: General). Supported versions that are affected are 7.2.19 and earlier 7.3.8 and earlier and 7.4.5 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS v3.0 Base Score 3.7 (Availability impacts).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

Libraries).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

JAX-WS).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Web

Services).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebLogic

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

WebLogic

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

JAX-WS).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Java

SE

Java

SE

Embedded

JRockit

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

GlassFish

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Web

Container).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

GlassFish

Server.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

GlassFish

Server

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

GlassFish

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

GlassFish

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Networking).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

GlassFish

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Administration).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

GlassFish

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

GlassFish

Server

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

GlassFish

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

GlassFish

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

JAXP).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

Java

SE

Embedded

JRockit.

Note:

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Serialization).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

SE

JRockit.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector: