Vulnerability

in

the

Oracle

One-to-One

Fulfillment

component

of

Oracle

E-Business

Suite

(subcomponent:

Audience

workbench).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

One-to-One

Fulfillment.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

One-to-One

Fulfillment

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

One-to-One

Fulfillment

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Enterprise

Limits

and

Collateral

Management

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).


Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.2 and 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code but if data is not received over a network the CVSS score may be lower. CVSS v3.0 Base Score 9.8 (Confidentiality Integrity and Availability impacts).


Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update insert or delete access to some of Oracle Marketing accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

C

API).

Supported

versions

that

are

affected

are

and

earlier.

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Primavera

Enterprise

Project

Portfolio

Management

component

of

Oracle

Primavera

Products

Suite

(subcomponent:

Web

Access).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Enterprise

Project

Portfolio

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Primavera

Enterprise

Project

Portfolio

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Primavera

Enterprise

Project

Portfolio

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Primavera

Enterprise

Project

Portfolio

Management

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Retail

Warehouse

Management

System

component

of

Oracle

Retail

Applications

(subcomponent:

Security).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Warehouse

Management

System.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Retail

Warehouse

Management

System

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Retail

Warehouse

Management

System

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Warehouse

Management

System

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability in the Oracle Customer Intelligence component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Intelligence. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Customer Intelligence attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Customer Intelligence accessible data as well as unauthorized update insert or delete access to some of Oracle Customer Intelligence accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Resources Module). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data as well as unauthorized update insert or delete access to some of Oracle Common Applications accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

API

Gateway

component

of

Oracle

Fusion

Middleware

(subcomponent:

Oracle

API

Gateway).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

API

Gateway.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

API

Gateway

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

API

Gateway

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).


Vulnerability in the Java SE Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE Java SE Embedded attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE Java SE Embedded. Note: This vulnerability applies to Java deployments typically in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments typically in servers that load and run only trusted code (e.g. code installed by an administrator). CVSS v3.0 Base Score 9.6 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Networking).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

SMTP

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

SE

Java

SE

Embedded

JRockit

accessible

data.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).


Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: User Interface). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Customer Interaction History attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Customer Interaction History accessible data as well as unauthorized update insert or delete access to some of Oracle Customer Interaction History accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle Partner Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Partner Management attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle Partner Management accessible data. CVSS v3.0 Base Score 4.7 (Integrity impacts).


Vulnerability

in

the

Oracle

Marketing

component

of

Oracle

E-Business

Suite

(subcomponent:

User

Interface).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Marketing.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Marketing

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Marketing

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).


Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Universal Work Queue attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data as well as unauthorized update insert or delete access to some of Oracle Universal Work Queue accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 2.1.1 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 4.3 (Integrity impacts).


Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Address Book). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update insert or delete access to some of Oracle iStore accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update insert or delete access to some of Oracle iStore accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update insert or delete access to some of Oracle Marketing accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data as well as unauthorized update insert or delete access to some of Oracle iSupport accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Sun

ZFS

Storage

Appliance

Kit

(AK)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

RAS

subsystems).

The

supported

version

that

is

affected

is

AK

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Sun

ZFS

Storage

Appliance

Kit

(AK).

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Sun

ZFS

Storage

Appliance

Kit

(AK)

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Sun

ZFS

Storage

Appliance

Kit

(AK).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Trade

Management

component

of

Oracle

E-Business

Suite

(subcomponent:

User

Interface).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Trade

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Trade

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Trade

Management

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Trade

Management

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).


Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Role Summary). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data as well as unauthorized update insert or delete access to some of Oracle Common Applications accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

WebCenter

Sites

component

of

Oracle

Fusion

Middleware

(subcomponent:

Blob

Server).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Sites.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

WebCenter

Sites

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

WebCenter

Sites

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).


Vulnerability

in

the

Sun

ZFS

Storage

Appliance

Kit

(AK)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

User

Interface

subsystem).

The

supported

version

that

is

affected

is

AK

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Sun

ZFS

Storage

Appliance

Kit

(AK).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Sun

ZFS

Storage

Appliance

Kit

(AK)

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Fluid

Core).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PeopleTools

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).


Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data as well as unauthorized update insert or delete access to some of Oracle Common Applications accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

WebCenter

Sites

component

of

Oracle

Fusion

Middleware

(subcomponent:

Server).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Sites.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebCenter

Sites

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebCenter

Sites

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).


Vulnerability

in

the

Java

SE

component

of

Oracle

Java

SE

(subcomponent:

AWT).

Supported

versions

that

are

affected

are

Java

SE:

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Java

SE

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Java

SE.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: User Interface). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

Real-Time

Scheduler

component

of

Oracle

Utilities

Applications

(subcomponent:

Mobile

Communications

Platform).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Real-Time

Scheduler.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Real-Time

Scheduler

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Real-Time

Scheduler

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Real-Time

Scheduler

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).


Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Knowledge Management accessible data as well as unauthorized update insert or delete access to some of Oracle Knowledge Management accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Web

Services).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

WebLogic

Server

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebLogic

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).


Vulnerability in the Oracle XML Gateway component of Oracle E-Business Suite (subcomponent: Oracle Transport Agent). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle XML Gateway attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle XML Gateway accessible data as well as unauthorized update insert or delete access to some of Oracle XML Gateway accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

WebCenter

Content

component

of

Oracle

Fusion

Middleware

(subcomponent:

Content

Server).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Content.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

WebCenter

Content

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebCenter

Content

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebCenter

Content

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update insert or delete access to some of Oracle Marketing accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Automatic

Service

Request

(ASR)

component

of

Oracle

Support

Tools

(subcomponent:

ASR

Manager).

The

supported

version

that

is

affected

is

Prior

to

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

SFT

to

compromise

Automatic

Service

Request

(ASR).

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Automatic

Service

Request

(ASR).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).


Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Supported versions that are affected are 10.0.3.5 10.2.0.5 and 11.2.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS v3.0 Base Score 4.3 (Confidentiality impacts).


Vulnerability

in

the

Oracle

Scripting

component

of

Oracle

E-Business

Suite

(subcomponent:

Scripting

Administration).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Scripting.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Scripting

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Scripting

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

FIN

Receivables

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Receivables).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

FIN

Receivables.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

FIN

Receivables

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:


Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

JRockit

component

of

Oracle

Java

SE

(subcomponent:

Networking).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

JRockit:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

FTP

to

compromise

Java

SE

Java

SE

Embedded

JRockit.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

SE

Java

SE

Embedded

JRockit

accessible

data.

Note:

Applies

to

client

and

server

deployment

of

Java.

This

vulnerability

can

be

exploited

through

sandboxed

Java

Web

Start

applications

and

sandboxed

Java

applets.

It

can

also

be

exploited

by

supplying

data

to

APIs

in

the

specified

Component

without

using

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

such

as

through

a

web

service.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

WebCenter

Sites

component

of

Oracle

Fusion

Middleware

(subcomponent:

Catalog

Mover).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Sites.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

WebCenter

Sites

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

WebCenter

Sites

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).


Vulnerability in the Oracle Installed Base component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Installed Base attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Installed Base accessible data as well as unauthorized update insert or delete access to some of Oracle Installed Base accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS v3.0 Base Score 6.1 (Confidentiality and Integrity impacts).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

MultiChannel

Framework).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

PeopleSoft

Enterprise

PeopleTools

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

PeopleSoft

Enterprise

PeopleTools

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).


Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Customer Interaction History attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Customer Interaction History accessible data as well as unauthorized update insert or delete access to some of Oracle Customer Interaction History accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

Social

Network

component

of

Oracle

Fusion

Middleware

(subcomponent:

Android

Client).

The

supported

version

that

is

affected

is

prior

to

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTPS

to

compromise

Oracle

Social

Network.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Social

Network

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).


Vulnerability

in

the

Java

SE

component

of

Oracle

Java

SE

(subcomponent:

AWT).

Supported

versions

that

are

affected

are

Java

SE:

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Java

SE

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Java

SE.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).


Vulnerability in the Oracle Partner Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Partner Management attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle Partner Management accessible data. CVSS v3.0 Base Score 4.7 (Integrity impacts).


Vulnerability in the Oracle Email Center component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Email Center accessible data as well as unauthorized update insert or delete access to some of Oracle Email Center accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Application Testing Suite component of Oracle Enterprise Manager Grid Control (subcomponent: Test Manager for Web Apps). Supported versions that are affected are 12.5.0.3 12.5.0.2 and 12.4.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Application Testing Suite accessible data. CVSS v3.0 Base Score 5.3 (Integrity impacts).


Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Universal Work Queue attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data as well as unauthorized update insert or delete access to some of Oracle Universal Work Queue accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

Security).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

SE

Java

SE

Embedded

accessible

data.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

Marketing

component

of

Oracle

E-Business

Suite

(subcomponent:

User

Interface).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Marketing.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Marketing

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Marketing

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Service Fulfillment Manager attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data as well as unauthorized update insert or delete access to some of Oracle Service Fulfillment Manager accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

Trade

Management

component

of

Oracle

E-Business

Suite

(subcomponent:

User

Interface).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Trade

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Trade

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Trade

Management

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Trade

Management

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).


Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update insert or delete access to some of Oracle Marketing accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Primavera

Enterprise

Project

Portfolio

Management

component

of

Oracle

Primavera

Products

Suite

(subcomponent:

Web

Access).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Enterprise

Project

Portfolio

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Primavera

Enterprise

Project

Portfolio

Management

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Primavera

Enterprise

Project

Portfolio

Management

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Kernel

RPC).

For

supported

versions

that

are

affected

see

note.

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Solaris.

While

the

vulnerability

is

in

Solaris

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Solaris.

Note:

is

assigned

for

\Ebbisland\.

Solaris

systems

which

have

had

any

Kernel

patch

installed

after

or

updated

via

patching

tools

since

are

not

impacted.

Also

any

Solaris

system

installed

with

Solaris

(Solaris

Update

are

not

vulnerable.

Solaris

is

not

impacted

by

this

issue.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).


Vulnerability in the Java SE Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments typically in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments typically in servers that load and run only trusted code (e.g. code installed by an administrator). CVSS v3.0 Base Score 4.3 (Confidentiality impacts).


Vulnerability

in

the

Oracle

One-to-One

Fulfillment

component

of

Oracle

E-Business

Suite

(subcomponent:

Print

Server).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

One-to-One

Fulfillment.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

One-to-One

Fulfillment

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

One-to-One

Fulfillment

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

One-to-One

Fulfillment

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Knowledge Management accessible data as well as unauthorized update insert or delete access to some of Oracle Knowledge Management accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0 12.1.3.0 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

Oracle

FLEXCUBE

Universal

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Universal

Banking.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

FLEXCUBE

Universal

Banking

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Universal

Banking

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).


Vulnerability in the Oracle Leads Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Leads Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Leads Management attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Leads Management accessible data as well as unauthorized update insert or delete access to some of Oracle Leads Management accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

Marketing

component

of

Oracle

E-Business

Suite

(subcomponent:

User

Interface).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Marketing.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Marketing

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Marketing

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).


Vulnerability

in

the

Oracle

FLEXCUBE

Direct

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Pre-Login).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Direct

Banking.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

FLEXCUBE

Direct

Banking

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Direct

Banking

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0 11.4.0 12.0.1 12.0.2 12.0.3 12.1.0 and 12.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data. CVSS v3.0 Base Score 4.7 (Integrity impacts).


Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Resources Module). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data as well as unauthorized update insert or delete access to some of Oracle Common Applications accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

WebCenter

Sites

component

of

Oracle

Fusion

Middleware

(subcomponent:

Advanced

UI).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebCenter

Sites.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebCenter

Sites

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebCenter

Sites

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).


Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments typically in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments typically in servers that load and run only trusted code (e.g. code installed by an administrator). CVSS v3.0 Base Score 8.3 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

Oracle

Application

Object

Library

component

of

Oracle

E-Business

Suite

(subcomponent:

File

Management).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Application

Object

Library.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Application

Object

Library

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Oracle

One-to-One

Fulfillment

component

of

Oracle

E-Business

Suite

(subcomponent:

Audience

workbench).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

One-to-One

Fulfillment.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

One-to-One

Fulfillment

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

One-to-One

Fulfillment

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

One-to-One

Fulfillment

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).


Vulnerability in the Java SE Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE Java SE Embedded attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE Java SE Embedded. Note: This vulnerability applies to Java deployments typically in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments typically in servers that load and run only trusted code (e.g. code installed by an administrator). CVSS v3.0 Base Score 9.6 (Confidentiality Integrity and Availability impacts).


Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update insert or delete access to some of Oracle Marketing accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Automatic

Service

Request

(ASR)

component

of

Oracle

Support

Tools

(subcomponent:

ASR

Manager).

The

supported

version

that

is

affected

is

Prior

to

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Automatic

Service

Request

(ASR).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Automatic

Service

Request

(ASR)

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).


Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Request Confirmation). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Multichannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS v3.0 Base Score 6.1 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

FLEXCUBE

Universal

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Retail

Teller).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Universal

Banking.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

FLEXCUBE

Universal

Banking

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Universal

Banking

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

Security).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

PeopleSoft

Enterprise

PeopleTools

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).


Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

Applications

Framework

component

of

Oracle

E-Business

Suite

(subcomponent:

Popup

windows

(lists

of

values

datepicker

etc.)).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Applications

Framework.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Applications

Framework

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Applications

Framework

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

Advanced

Outbound

Telephony

component

of

Oracle

E-Business

Suite

(subcomponent:

Interaction

History).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Advanced

Outbound

Telephony.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Advanced

Outbound

Telephony

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Advanced

Outbound

Telephony

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Advanced

Outbound

Telephony

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:


Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: ADF Faces). Supported versions that are affected are 11.1.1.7.0 11.1.1.9.0 11.1.2.4.0 12.1.3.0.0 12.2.1.0.0 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. While the vulnerability is in Oracle JDeveloper attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS v3.0 Base Score 5.8 (Confidentiality impacts).


Vulnerability

in

the

Oracle

GlassFish

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

Java

Server

Faces).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Oracle

GlassFish

Server.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

GlassFish

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Primavera

Unifier

component

of

Oracle

Primavera

Products

Suite

(subcomponent:

Platform).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Primavera

Unifier.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Primavera

Unifier

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Primavera

Unifier

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Primavera

Unifier

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).


Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Knowledge Management accessible data as well as unauthorized update insert or delete access to some of Oracle Knowledge Management accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: EAI). The supported version that is affected is 16.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel UI Framework attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel UI Framework accessible data as well as unauthorized update insert or delete access to some of Siebel UI Framework accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Java SE Java SE Embedded JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE Java SE Embedded JRockit. While the vulnerability is in Java SE Java SE Embedded JRockit attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE Java SE Embedded JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality Integrity and Availability impacts).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

CDE

Calendar).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

network

access

via

TCP

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Solaris.

Note:

is

assigned

to

the

\EASYSTREET\

vulnerability.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

MySQL

Workbench

component

of

Oracle

MySQL

(subcomponent:

Workbench:

Security

Encryption).

Supported

versions

that

are

affected

are

and

earlier.

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Workbench.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

MySQL

Workbench

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

MultiChannel

Framework).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

PeopleSoft

Enterprise

PeopleTools

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PeopleTools

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).


Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Search Functionality). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS v3.0 Base Score 6.1 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 12.0.0 12.1.0 and 12.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS v3.0 Base Score 6.1 (Confidentiality and Integrity impacts).


Vulnerability

in

the

Oracle

FLEXCUBE

Universal

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Infrastructure).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Universal

Banking.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

FLEXCUBE

Universal

Banking

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

FLEXCUBE

Universal

Banking

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).


Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Customer Interaction History attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Customer Interaction History accessible data as well as unauthorized update insert or delete access to some of Oracle Customer Interaction History accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 6u131 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments typically in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments typically in servers that load and run only trusted code (e.g. code installed by an administrator). CVSS v3.0 Base Score 3.7 (Confidentiality impacts).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

C

API).

Supported

versions

that

are

affected

are

and

earlier.

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Marketing

component

of

Oracle

E-Business

Suite

(subcomponent:

User

Interface).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Marketing.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Marketing

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Marketing

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).


Vulnerability in the Oracle Partner Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Partner Management attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle Partner Management accessible data. CVSS v3.0 Base Score 4.7 (Integrity impacts).


Vulnerability

in

the

Oracle

FLEXCUBE

Private

Banking

component

of

Oracle

Financial

Services

Applications

(subcomponent:

Miscellaneous).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Private

Banking.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

FLEXCUBE

Private

Banking

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

FLEXCUBE

Private

Banking

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

User

Management

component

of

Oracle

E-Business

Suite

(subcomponent:

User

Name/Password

Management).

Supported

versions

that

are

affected

are

and

Easily

\exploitable\

vulnerability

allows

unauthenticated

attacker

with

network

access

via

HTTP

to

compromise

Oracle

User

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

User

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

User

Management

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

SE

Java

SE

Embedded

component

of

Oracle

Java

SE

(subcomponent:

Networking).

Supported

versions

that

are

affected

are

Java

SE:

and

Java

SE

Embedded:

Difficult

to

exploit

vulnerability

allows

unauthenticated

attacker

with

network

access

via

multiple

protocols

to

compromise

Java

SE

Java

SE

Embedded.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Java

SE

Java

SE

Embedded

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Java

SE

Java

SE

Embedded

accessible

data.

Note:

This

vulnerability

applies

to

Java

deployments

typically

in

clients

running

sandboxed

Java

Web

Start

applications

or

sandboxed

Java

applets

that

load

and

run

untrusted

code

(e.g.

code

that

comes

from

the

internet)

and

rely

on

the

Java

sandbox

for

security.

This

vulnerability

does

not

apply

to

Java

deployments

typically

in

servers

that

load

and

run

only

trusted

code

(e.g.

code

installed

by

an

administrator).

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).


Vulnerability in the Oracle Email Center component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1 12.1.2 12.1.3 12.2.3 12.2.4 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Email Center accessible data as well as unauthorized update insert or delete access to some of Oracle Email Center accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).


Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Pre-Login). Supported versions that are affected are 12.0.2 and 12.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Direct Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Direct Banking attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Direct Banking accessible data. CVSS v3.0 Base Score 4.7 (Confidentiality impacts).