Oracle Life Sciences InForm vulnerabilities

A vulnerability in Oracle Life Sciences InForm (App Server component) versions 7.0.1.0 and 7.0.1.1 allows an unauthenticated attacker with network access via HTTP to partially update, insert, or delete data and to gain unauthorized read access to a subset of data. CVSS 3.1 Base Score 6.5 (confidentiality and integrity impacts).

Vulnerability in Oracle Life Sciences InForm (component: IDM Authentication) affecting versions 7.0.1.0 and 7.0.1.1. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product with human interaction, resulting in unauthorized update, insert or delete access, unauthorized read access, and partial denial of service.

Vulnerability in Oracle Life Sciences InForm (component: Web Server) version 7.0.1.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring user interaction. The attack may impact additional products (scope change) and result in unauthorized access to some InForm data (read, update, insert, delete). CVSS 6.1.

Vulnerability in Oracle Life Sciences InForm (Web Server component) version 7.0.1.0. A low-privileged attacker with network access via HTTP can compromise the product, resulting in unauthorized read access to a subset of data. CVSS 4.3 (Confidentiality impact).