Oracle Contract Lifecycle Management for Public Sector vulnerabilities

Vulnerability in Oracle Contract Lifecycle Management for Public Sector (Wage Determination Online component) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain unauthorized update/insert/delete and read access to data. The attack may impact additional products (scope change).

Vulnerability in Oracle Contract Lifecycle Management for Public Sector (component: ECC For Award and IDV) version V16. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in takeover of the system.

Vulnerability in Oracle Contract Lifecycle Management for Public Sector (component: Award/PO) in versions 12.2.13-12.2.15. A low-privileged attacker can compromise the system over HTTP, leading to full takeover.

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO), affecting versions 12.2.8-12.2.15. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and unauthorized update, insert or delete access to some data.