Oracle E-Business Suite vulnerabilities

Vulnerability in Oracle Mobile Field Service (Admin UI component) of Oracle E-Business Suite versions 12.2.3-12.2.15. An easily exploitable network attack via HTTP allows a low-privileged attacker to create, delete, or modify critical data and read a subset of data. CVSS 7.1.

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. CVSS 3.1 Base Score 7.5.

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. CVSS 3.1 Base Score 7.5.

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. CVSS 3.1 Base Score 7.5.

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields) affects versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. CVSS 3.1 Base Score 7.5.

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces) affects versions 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager, resulting in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5.

Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5.

Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management. CVSS 3.1 Base Score 7.0.

Vulnerability in Oracle EDI Gateway (component: All Miscellaneous EDI Issues) of Oracle E-Business Suite. A high-privileged attacker with network access via HTTP can take over Oracle EDI Gateway.

Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to compromise Workflow, potentially impacting other products.

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized creation, deletion, or modification access to critical data.

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Application Object Library.

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized access to critical data and cause a hang or frequently repeatable crash (DoS).

Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).

Vulnerability in the Workflow Notification Mailer component of Oracle E-Business Suite Workflow. A low privileged attacker can exploit it over the network via HTTP to take over Workflow; exploitation is difficult. CVSS 7.5.

Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a high-privileged attacker with network access via HTTP to compromise Order Capture.

Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to compromise Applications Platform Engineering.

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle HRMS (US) accessible data.

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTPS to gain unauthorized read access to a subset of Oracle Report Manager accessible data.

Vulnerability in Oracle HRMS (US) of Oracle E-Business Suite (component: Mobile Applications) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP, requiring user interaction, to gain unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data, with potential impact on additional products.

Vulnerability in Oracle HRMS (UK) of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP, requiring user interaction, to gain unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data, with potential impact on additional products.

Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows a low privileged attacker with network access via HTTP to compromise Sourcing.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows an unauthenticated attacker with network access via Oracle Net to modify or delete critical data and gain unauthorized access to it.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to modify or delete critical data and gain unauthorized access to it.

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to compromise the product.

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to modify or delete critical data and gain unauthorized access to it.

Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite, component Korean Payroll. Affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data.

Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite, component Indian Payroll. Affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data.

Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data.

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite, component Product Diagnostic Tools. Affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data.

Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI), affecting versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Installed Base.

Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base, requires human interaction and may significantly impact additional products (scope change).

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests) affecting versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle Concurrent Processing accessible data.

Vulnerability in the Production Scheduling product of Oracle E-Business Suite (component: Internal Operations), affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows a low privileged attacker with infrastructure logon to partially compromise confidentiality, integrity and availability of data. CVSS 3.1 Base Score 4.5.

Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO). Supported versions affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization, requires human interaction.

Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service). Supported versions affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising, may significantly impact additional products (scope change).

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution, may significantly impact additional products (scope change).

Vulnerability in the iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations), affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in iSupplier Portal.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affects versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability, resulting in unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affects versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution, potentially leading to takeover.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution, resulting in unauthorized access to critical data, unauthorized update/insert/delete access, and partial denial of service.

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools), affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in Oracle Order Management.

Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Quality, resulting in unauthorized creation, deletion, or modification access to critical data as well as unauthorized access to critical data.

Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Project Contracts, and attacks may significantly impact additional products (scope change), resulting in unauthorized access to critical data.

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affects versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server, resulting in unauthorized creation, deletion, or modification access to critical data as well as unauthorized access to critical data.