JD Edwards EnterpriseOne Orchestrator vulnerabilities

Vulnerability in JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security component) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with HTTP network access can take over the product, and attacks may significantly impact additional products (scope change).

Vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security component) affecting versions 9.2.0.0-9.2.26.5. A low-privileged attacker with HTTP network access can gain unauthorized access to critical data or all accessible data. CVSS 3.1 Base Score 6.5.

Vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security component) affecting versions 9.2.0.0-9.2.26.5. An easily exploitable HTTP attack allows an unauthenticated attacker to read a subset of data without authorization.

Vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security component) affecting versions 9.2.0.0-9.2.26.5. A difficult-to-exploit HTTP attack requiring user interaction may lead to access to critical or all data.

Vulnerability in JD Edwards EnterpriseOne Orchestrator (component: E1 IOT Orchestrator Security) affects versions 9.2.0.0-9.2.26.4. A low-privileged attacker with network access via HTTP can perform unauthorized modifications to critical data and gain full access to data. CVSS score is 8.1.

Vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator (component: E1 IOT Orchestrator Security). Affects versions 9.2.0.0-9.2.26.4. Difficult to exploit, allows unauthenticated attacker with network access via TLS to take over the Orchestrator.