Oracle E-Business Suite vulnerabilities

Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.

Vulnerability in Oracle Purchasing (component: Other issue). Affects versions 12.2.3-12.2.15. Easily exploitable by low-privileged attacker via HTTP, allowing takeover. CVSS 8.8.

Vulnerability in Oracle Purchasing (component: Other issue). Affects versions 12.2.3-12.2.15. Easily exploitable by unauthenticated attacker via HTTP, allowing unauthorized access to critical data. CVSS 7.5.

Vulnerability in Oracle Payroll (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low-privileged attacker via HTTP, allowing unauthorized access to critical data. Scope change. CVSS 7.7.

Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5-12.2.15 have a vulnerability in the Internal Operations component. A low-privileged authenticated attacker with network access via HTTP can exploit it, requiring human interaction, leading to unauthorized read and write access to some data and affecting other products.

Vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 6.5 (Confidentiality).

A vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. A low privileged attacker with local access can easily exploit this vulnerability to compromise Oracle HRMS (US). Successful attacks can result in takeover of Oracle HRMS (US) (CVSS 7.8).

Vulnerability in Oracle HRMS (Norway) product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all Oracle HRMS (Norway) data. Attacks may significantly impact additional products (scope change).

A vulnerability in Oracle HRMS (US) of Oracle E-Business Suite allows a high-privileged attacker to access critical data. The vulnerability has a scope change, affecting other products.

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK).

Vulnerability in Oracle HRMS (US) of Oracle E-Business Suite, Internal Operations component. A low-privileged attacker via HTTP can gain unauthorized access to critical data or all Oracle HRMS (US) data.

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).

Vulnerability in Oracle HRMS (France) product of Oracle E-Business Suite, component French HR. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Vulnerability in Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks can result in unauthorized update, insert or delete access to some data, unauthorized read access, and partial denial of service. CVSS 6.3.

Vulnerability in Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks can result in unauthorized update, insert or delete access to some data, unauthorized read access, and partial denial of service. CVSS 6.3.

Vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite, component US Payroll - General. Affects versions 12.2.7-12.2.15. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.

Vulnerability in Oracle Succession planning of Oracle E-Business Suite, Succession plan component. A low-privileged attacker via HTTP can modify, read data, and cause partial denial of service.

Vulnerability in Oracle Time and Labor product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).

Vulnerability in Oracle Flow Manufacturing product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.13-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Oracle Process Manufacturing Process Execution (part of Oracle E-Business Suite) version 12.2.15 has a difficult-to-exploit vulnerability that allows a low-privileged attacker with network access via HTTP to take over the component.

Vulnerability in Oracle Time and Labor product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Oracle Purchasing (part of Oracle E-Business Suite) versions 12.2.11-12.2.15 have a difficult-to-exploit vulnerability that allows a low-privileged attacker with network access via HTTP to take over the component.

A vulnerability in Oracle Contracts Integration of Oracle E-Business Suite allows an unauthenticated attacker to modify critical data. Exploitation is difficult (high AC).

Vulnerability in Oracle Public Sector Financials (Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized read and write access to some data.

Vulnerability in Oracle Public Sector Financials (Oracle E-Business Suite) versions 12.2.3-12.2.15. Easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all Oracle Public Sector Financials data.

Vulnerability in Oracle Public Sector Financials (Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can perform unauthorized update, insert, delete or read access. Requires user interaction.

Vulnerability in Oracle Human Resources (part of Oracle E-Business Suite, component: Enterprise Command Center). A low-privileged attacker with local access can gain unauthorized access to critical data and modify it. CVSS 7.1.

Vulnerability in Oracle Human Resources (Oracle E-Business Suite) component Enterprise Command Center. Versions 12.2.14-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

In Oracle Human Resources in Oracle E-Business Suite (Data Removal Tool component) versions 12.2.3-12.2.15, a vulnerability exists. An authenticated attacker with high privileges can remotely take over Oracle Human Resources via HTTP.

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle HRMS (UK).

Vulnerability in Oracle Order Management (Oracle E-Business Suite) component Product Diagnostic Tools. Versions 12.2.4-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

In Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, an easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP, requiring human interaction. Successful attacks can result in unauthorized creation, deletion, or modification of critical data and partial denial of service.

Vulnerability in Oracle Contracts Integration (Oracle E-Business Suite) component Internal Operations. Versions 12.2.3-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

Vulnerability in Oracle Lease and Finance Management (part of Oracle E-Business Suite) versions 12.2.11-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to take over the component. CVSS 7.5.

In Oracle Lease and Finance Management in Oracle E-Business Suite (Internal Operations component) versions 12.2.14-12.2.15, a vulnerability exists. An authenticated attacker with high privileges can remotely take over Oracle Lease and Finance Management via HTTP.

Vulnerability in Oracle Product Workbench (Oracle E-Business Suite) component Internal Operations. Versions 12.2.3-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

Vulnerability in Oracle Product Workbench (Oracle E-Business Suite) component Internal Operations. Versions 12.2.3-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

Vulnerability in Oracle Price Protection (Oracle E-Business Suite) component Internal Operations. Versions 12.2.3-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

Vulnerability in Oracle Cost Management (Oracle E-Business Suite) versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows a high-privileged attacker with network access via HTTP to take over Oracle Cost Management.

Vulnerability in Oracle Bills of Material (Oracle E-Business Suite) component Internal Operations. Versions 12.2.13-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

Vulnerability in Oracle Advanced Benefits (Oracle E-Business Suite) version 12.2.15. Easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all Oracle Advanced Benefits data.

Vulnerability in Oracle Product Hub (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to take over the component, with impact on other products (scope change). CVSS 8.5.

Vulnerability in Oracle Product Hub (Oracle E-Business Suite) component Internal Operations. Versions 12.2.3-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

Vulnerability in Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.

Vulnerability in Oracle Price Protection of Oracle E-Business Suite, Internal Operations component. A low-privileged attacker via HTTP can modify, read data, and cause partial denial of service.

Vulnerability in Oracle Process Manufacturing Financials (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity of critical data.

Vulnerability in Oracle Customers Online (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity of critical data.

Vulnerability in Oracle Process Manufacturing Systems (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity of critical data.