Oracle E-Business Suite vulnerabilities

In Oracle Workflow (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, a vulnerability in the Workflow Notification Mailer component. Difficult to exploit, allows a low-privileged attacker with local access to unauthorized update/insert/delete and partial denial of service. CVSS 3.6.

Vulnerability in Oracle Bills of Material (component: Bill Issues) allows a low-privileged attacker with network access via HTTP to compromise the system. No user interaction is required.

Vulnerability in Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Affected versions 12.2.3-12.2.15. A low privileged attacker with network access via HTTP can compromise all data confidentiality and integrity.

Vulnerability in Oracle Product Workbench of Oracle E-Business Suite (component: Security). Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the application, leading to unauthorized creation, deletion, or modification of critical data and access to all application data.

Difficult to exploit vulnerability in Oracle Public Sector Financials (International) (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A high-privileged attacker via HTTP can take over the system, also affecting other products.

A vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations) allows a low-privileged attacker with network access via HTTP to compromise data confidentiality and integrity. Successful attacks can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all Oracle Payroll data.

Vulnerability in Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager) in versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise and take over Oracle Payroll.

A vulnerability in Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations) allows a low-privileged attacker with network access via HTTPS to take over the system. Affected versions are 12.2.3-12.2.15 with a high CVSS score of 8.8.

Vulnerability in Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Affects versions 12.2.6-12.2.15. A low-privileged attacker with network access via HTTPS can easily exploit this flaw, leading to unauthorized access to critical data or complete access to all product data.

Vulnerability in Oracle Financials Common Modules of Oracle E-Business Suite (component: Common Components) in versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw, leading to unauthorized access to critical data or full access to all module data.

A vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events) affects versions 12.2.7-12.2.15. An easily exploitable flaw allows a high-privileged attacker with network access via HTTP to gain unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data.

In Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR) versions 12.1.1-12.1.3, an easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical data and full access to all accessible data.