CVE Vulnerability Catalog

Vulnerability in the Java plugin component of Oracle Java SE (versions 8u503 and 8u503-perf). A low privileged attacker with local logon can gain unauthorized creation, deletion or modification access to critical data and full access to Java SE data; exploitation is difficult and impact may extend beyond Java SE (scope change). Applies to clients running untrusted code in the sandbox (e.g., applets, Web Start). CVSS 7.5.

Vulnerability in Oracle Outside In Technology (Outside In Core component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.

Vulnerability in the Bidder Registration component of PeopleSoft Enterprise SCM Strategic Sourcing (Oracle PeopleSoft) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in the application.

Vulnerability in the Supplier Registration component of PeopleSoft Enterprise SCM Purchasing (Oracle PeopleSoft) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some data and unauthorized read access to a subset of data; the attack requires user interaction and may impact additional products (scope change).

Vulnerability in the Strategic Sourcing component of PeopleSoft Enterprise SCM Strategic Sourcing (Oracle PeopleSoft) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in the application.

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. An easily exploitable flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running RDBMS to cause a hang or frequently repeatable crash (complete DOS).

Vulnerability in PeopleSoft Enterprise SCM Strategic Sourcing (Strategic Sourcing component) version 9.2. A low-privileged attacker with network access via HTTP can take over the application. CVSS 8.8.

Vulnerability in Oracle JavaFX (component: JavaFX) affecting versions 25.0.4 and 27. A difficult to exploit flaw allows an unauthenticated network attacker to read a subset of data, requiring user interaction; applies to clients running sandboxed Java Web Start/applets.

Vulnerability in the eProcurement component of PeopleSoft Enterprise FIN Common Objects Brazil (Oracle PeopleSoft) affecting version 9.1. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of data accessible in the application.

Vulnerability in the Outside In Clean Content SDK component of Oracle Outside In Technology (Oracle Fusion Middleware) affecting version 8.5.8. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to perform unauthorized creation, deletion, or modification of critical data, unauthorized read access to a subset of data, and cause a partial denial of service.

Vulnerability in Oracle PeopleSoft Enterprise FIN Common Objects Brazil (component eProcurement) version 9.1. A high-privileged attacker with access to the physical communication segment can create, delete, or modify critical data and gain full access to it without authorization.

Vulnerability in Oracle HTTP Server (Web Listener component) version 12.2.1.4.0. A low-privileged attacker with local access can take over the server. CVSS 7.8.

Vulnerability in PeopleSoft Enterprise CC Common Application Objects (component: BAM Framework) version 9.2. A difficult to exploit flaw allows an unauthenticated network attacker via HTTP to perform unauthorized update, insert or delete of data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component QAS) versions 8.61-8.63. An unauthenticated attacker with network access via HTTP can perform unauthorized updates, inserts, or deletes and cause a partial denial of service (partial DoS).

Vulnerability in Oracle Fusion Middleware Control (component Framework) versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with physical access can, with user interaction, take over Oracle Fusion Middleware Control.

Vulnerability in Oracle PeopleSoft Enterprise FIN Common Objects Argentina (component Asset Management) version 9.1. A high-privileged attacker with network access via HTTP can, with user interaction, create, delete, or modify critical data, gain full access to it, and cause a partial denial of service.

Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (Integration component) version 9.1. An unauthenticated attacker with network access via Oracle Net can gain unauthorized access to critical data. CVSS 7.5.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component JGSS). A difficult-to-exploit unauthenticated attacker with network access can, with user interaction, gain unauthorized access to critical data. Applies to clients running sandboxed Java Web Start applications or applets.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component JGSS). A difficult-to-exploit unauthenticated attacker with network access can, with user interaction, gain unauthorized access to critical data. Applies to clients running sandboxed Java Web Start applications or applets.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component JGSS). A difficult-to-exploit unauthenticated attacker with network access can perform unauthorized creation, deletion, or modification of critical data. Exploitable only by supplying data to APIs in the component, e.g., via a web service.