Oracle E-Business Suite vulnerabilities

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server), affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in Oracle Mobile Application Server.

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture, resulting in unauthorized creation, deletion, or modification access to critical data, unauthorized access to critical data, and partial denial of service.

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture, potentially leading to takeover.

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture, potentially leading to takeover.

Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments) affects versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Document Management and Collaboration, requiring human interaction, and may significantly impact additional products (scope change), resulting in unauthorized creation, deletion, or modification access to critical data as well as unauthorized access to critical data.

Vulnerability in Oracle Bills of Material (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to take over Oracle Bills of Material.

Vulnerability in Oracle Bills of Material (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a high-privileged attacker with network access via HTTP to compromise Oracle Bills of Material and potentially other products (scope change).

Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (component: Total Compensation Statement), affecting versions 12.2.3-12.2.15. An easily exploitable flaw requires user interaction and may impact additional products (scope change), allowing unauthorized modification or read access to some Compensation Workbench data.

Vulnerability in Oracle General Ledger (component: ADADMIN) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to take over Oracle General Ledger.

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations), affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in Oracle General Ledger.

Vulnerability in Oracle Product Hub (component: Item Catalog) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to access data and impact other products (scope change).

Vulnerability in Oracle Product Hub (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a high-privileged attacker with network access via HTTP to take over Oracle Product Hub.

Vulnerability in the Assets product (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to hang or repeatedly crash the module and to modify and read some data.

Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management), affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of data accessible in Oracle Engineering.

Vulnerability in Oracle Engineering (component: Change Management) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to take over Oracle Engineering.

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: LOV), affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data and unauthorized access to all data accessible in the product.

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics) affecting versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows a high privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data and cause a partial denial of service of Oracle Applications Manager.

Vulnerability in Oracle Applications Manager of Oracle E-Business Suite (component Oracle Diagnostics Interfaces) affects versions 12.2.3-12.2.15. An easily exploitable HTTP attack by a low-privileged user can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data.

Vulnerability in Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues) affects versions 12.2.3-12.2.15. A difficult to exploit attack via HTTP by a low privileged attacker can lead to takeover of the product. CVSS 3.1 Base Score 7.5.

Vulnerability in Oracle One-to-One Fulfillment (component: Documents) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data and to cause a hang or frequently repeatable crash (complete DoS).

Vulnerability in Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI) affects versions 12.2.3-12.2.15. An easily exploitable attack via HTTPS by a high privileged attacker can lead to takeover of the product. CVSS 3.1 Base Score 7.2.

Vulnerability in Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI) affects versions 12.2.3-12.2.15. An easily exploitable attack via HTTP by a low privileged attacker can lead to takeover of the product. CVSS 3.1 Base Score 8.8.

Vulnerability in Oracle E-Business Suite Integrated SOA Gateway (component: SOA Provider) affects versions 12.2.3-12.2.15. An easily exploitable attack via HTTP by an unauthenticated attacker can result in unauthorized access to critical data and unauthorized update, insert, or delete access. CVSS 3.1 Base Score 8.2.

Vulnerability in Oracle E-Business Suite Integrated SOA Gateway (component: SOA Provider) affects versions 12.2.3-12.2.15. An easily exploitable attack via HTTP by a low privileged attacker can result in unauthorized access to critical data; attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 7.7.

Vulnerability in Oracle E-Business Suite Integrated SOA Gateway (component: SOA Provider) affects versions 12.2.3-12.2.15. An easily exploitable attack via HTTP by an unauthenticated attacker can result in unauthorized access to critical data; attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 8.6.

Vulnerability in Oracle E-Business Suite Integrated SOA Gateway (component: SOA Provider) affects versions 12.2.3-12.2.15. A difficult to exploit attack via HTTP by a low privileged attacker can result in takeover of the SOA Gateway. CVSS 3.1 Base Score 7.5.

Vulnerability in Oracle E-Business Suite Integrated SOA Gateway (component: SOA Provider) affects versions 12.2.3-12.2.15. An easily exploitable attack via HTTP by a low privileged attacker can result in takeover of the SOA Gateway. CVSS 3.1 Base Score 8.8.

Vulnerability in Oracle E-Business Suite Integrated SOA Gateway (component: SOA Provider) affects versions 12.2.3-12.2.15. An easily exploitable attack via HTTP by a low privileged attacker can result in takeover of the SOA Gateway. CVSS 3.1 Base Score 8.8.

Vulnerability in Oracle E-Business Suite Integrated SOA Gateway (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable attack via HTTP by a low privileged attacker can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to critical data, and partial denial of service. CVSS 3.1 Base Score 8.3.

Vulnerability in the Applications DBA product (AD Utilities component) of Oracle E-Business Suite versions 12.2.3-12.2.15. A difficult-to-exploit attack allows a low-privileged attacker with logon to the infrastructure to compromise Applications DBA. CVSS 7.0.

Vulnerability in the Applications DBA product (AD Utilities component) of Oracle E-Business Suite versions 12.2.3-12.2.15. An easily exploitable attack allows an unauthenticated attacker with logon to the infrastructure to compromise Applications DBA, requiring user interaction. CVSS 7.8.

Vulnerability in the Applications DBA product (AD Utilities component) of Oracle E-Business Suite versions 12.2.3-12.2.15. A difficult-to-exploit attack allows a low-privileged attacker with logon to the infrastructure to compromise Applications DBA. CVSS 7.0.

Vulnerability in Oracle Concurrent Processing (Other Issues component) of Oracle E-Business Suite versions 12.2.3-12.2.15. An easily exploitable attack allows a low-privileged attacker with logon to the infrastructure to compromise Oracle Concurrent Processing. CVSS 7.8.

Vulnerability in Oracle Mobile Field Service (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a high-privileged attacker with logon to the infrastructure where Oracle Mobile Field Service executes to take over the product.

Vulnerability in Oracle Mobile Field Service (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a high-privileged attacker with logon to the infrastructure where Oracle Mobile Field Service executes to take over the product.

Vulnerability in Oracle US Federal Human Resources (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in Oracle US Federal Human Resources.

Vulnerability in Oracle Call Center Technology (Internal Operations component) of Oracle E-Business Suite versions 12.2.3-12.2.15. A difficult-to-exploit network attack via RMI allows an unauthenticated attacker to compromise Oracle Call Center Technology. CVSS 8.1.

Vulnerability in Oracle Email Center (component: Message Component) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data, requiring human interaction and potentially impacting additional products (scope change).

Vulnerability in Oracle Email Center (component: Message Component) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in Oracle Email Center.

Vulnerability in Oracle Public Sector Human Resources (component: Regression Testing) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data and unauthorized access to critical data or all data accessible in the product.

Vulnerability in Oracle Customer Care (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data, requiring human interaction and potentially impacting additional products (scope change).

Vulnerability in Oracle Mobile Field Service (Admin UI component) of Oracle E-Business Suite versions 12.2.3-12.2.15. An easily exploitable network attack via HTTP allows a low-privileged attacker to create, delete, or modify critical data and access it. CVSS 8.1.

Vulnerability in Oracle Mobile Field Service (Internal Operations component) of Oracle E-Business Suite versions 12.2.3-12.2.15. An easily exploitable network attack via HTTP allows a low-privileged attacker to compromise Oracle Mobile Field Service. CVSS 8.8.

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. CVSS 3.1 Base Score 8.8.

Vulnerability in Oracle Demand Signal Repository (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.3-12.2.15. A low-privileged authenticated attacker with HTTP network access can gain unauthorized access to data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.

Vulnerability in Oracle Complex Maintenance, Repair and Overhaul (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.12-12.2.15. A low-privileged authenticated attacker with HTTP network access can access critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.5.

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization) affecting versions 12.2.3-12.2.15. Easily exploitable by a low privileged attacker with network access via HTTP. Successful attacks can result in takeover of the component.

Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. Difficult to exploit, but allows a low privileged attacker with network access via HTTP to take over the product.

Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: ADPatch) affecting versions 12.2.3-12.2.15. An authenticated attacker with local logon can exploit it if another person performs a specific action, leading to takeover of Applications DBA.

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone) affecting versions 12.2.3-12.2.15. A low-privileged attacker with local logon can gain unauthorized access to critical data and create, delete, or modify data.