Oracle E-Business Suite vulnerabilities

Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).

Vulnerability in Oracle Demand Signal Repository (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.3-12.2.15. A low-privileged authenticated attacker with HTTP network access can gain unauthorized access to data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.

Vulnerability in Oracle Complex Maintenance, Repair and Overhaul (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.12-12.2.15. A low-privileged authenticated attacker with HTTP network access can access critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.5.

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization) affecting versions 12.2.3-12.2.15. Easily exploitable by a low privileged attacker with network access via HTTP. Successful attacks can result in takeover of the component.

Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. Difficult to exploit, but allows a low privileged attacker with network access via HTTP to take over the product.

Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: ADPatch) affecting versions 12.2.3-12.2.15. An authenticated attacker with local logon can exploit it if another person performs a specific action, leading to takeover of Applications DBA.

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone) affecting versions 12.2.3-12.2.15. A low-privileged attacker with local logon can gain unauthorized access to critical data and create, delete, or modify data.

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone) affecting versions 12.2.3-12.2.15. A high-privileged attacker with network access via HTTP can take over Oracle Applications Manager, potentially impacting other products.

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and create, delete, or modify data.

Vulnerability in Oracle E-Business Suite Oracle Proposals product (Internal Operations component). Affects versions 12.2.3-12.2.15. Easily exploitable, requires low privileges and network access via HTTP. Attacks may impact additional products (scope change) and lead to unauthorized access to critical data.

Vulnerability in Oracle E-Business Suite Oracle Field Service product (Internal Operations component). Affects versions 12.2.3-12.2.15. Easily exploitable, requires low privileges and network access via HTTP. Attacks may impact additional products (scope change) and lead to unauthorized access to critical data.

Vulnerability in Oracle E-Business Suite Oracle Spares Management product (Internal Operations component). Affects versions 12.2.3-12.2.15. Difficult to exploit, requires high privileges and network access via HTTP. Attacks may impact additional products (scope change) and lead to takeover of Oracle Spares Management.

Vulnerability in Oracle E-Business Suite Oracle Spares Management product (Internal Operations component). Affects versions 12.2.3-12.2.15. Easily exploitable, requires low privileges and network access via HTTP. Attacks may lead to takeover of Oracle Spares Management.

Vulnerability in Oracle E-Business Suite Oracle Spares Management product (Internal Operations component). Affects versions 12.2.3-12.2.15. Easily exploitable, requires low privileges and network access via HTTP. Attacks may lead to takeover of Oracle Spares Management.

Vulnerability in Oracle E-Business Suite Oracle iStore product (Shopping Cart component). Affects versions 12.2.3-12.2.15. Easily exploitable, requires low privileges, network access via HTTP, and user interaction. Attacks may impact additional products (scope change) and lead to unauthorized creation, deletion, modification, or access to data.

Vulnerability in Oracle Purchasing (component: Other issue). Affects versions 12.2.3-12.2.15. Easily exploitable by low-privileged attacker via HTTP, allowing takeover. CVSS 8.8.

Vulnerability in Oracle Purchasing (component: Other issue). Affects versions 12.2.3-12.2.15. Easily exploitable by unauthenticated attacker via HTTP, allowing unauthorized access to critical data. CVSS 7.5.

Vulnerability in Oracle Payroll (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low-privileged attacker via HTTP, allowing unauthorized access to critical data. Scope change. CVSS 7.7.

Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5-12.2.15 have a vulnerability in the Internal Operations component. A low-privileged authenticated attacker with network access via HTTP can exploit it, requiring human interaction, leading to unauthorized read and write access to some data and affecting other products.

Vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 6.5 (Confidentiality).

A vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. A low privileged attacker with local access can easily exploit this vulnerability to compromise Oracle HRMS (US). Successful attacks can result in takeover of Oracle HRMS (US) (CVSS 7.8).

Vulnerability in Oracle HRMS (Norway) product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all Oracle HRMS (Norway) data. Attacks may significantly impact additional products (scope change).

A vulnerability in Oracle HRMS (US) of Oracle E-Business Suite allows a high-privileged attacker to access critical data. The vulnerability has a scope change, affecting other products.

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK).

Vulnerability in Oracle HRMS (US) of Oracle E-Business Suite, Internal Operations component. A low-privileged attacker via HTTP can gain unauthorized access to critical data or all Oracle HRMS (US) data.

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).

Vulnerability in Oracle HRMS (France) product of Oracle E-Business Suite, component French HR. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Vulnerability in Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks can result in unauthorized update, insert or delete access to some data, unauthorized read access, and partial denial of service. CVSS 6.3.

Vulnerability in Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks can result in unauthorized update, insert or delete access to some data, unauthorized read access, and partial denial of service. CVSS 6.3.

Vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite, component US Payroll - General. Affects versions 12.2.7-12.2.15. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.

Vulnerability in Oracle Succession planning of Oracle E-Business Suite, Succession plan component. A low-privileged attacker via HTTP can modify, read data, and cause partial denial of service.

Vulnerability in Oracle Time and Labor product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).

Vulnerability in Oracle Flow Manufacturing product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.13-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Oracle Process Manufacturing Process Execution (part of Oracle E-Business Suite) version 12.2.15 has a difficult-to-exploit vulnerability that allows a low-privileged attacker with network access via HTTP to take over the component.

Vulnerability in Oracle Time and Labor product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Oracle Purchasing (part of Oracle E-Business Suite) versions 12.2.11-12.2.15 have a difficult-to-exploit vulnerability that allows a low-privileged attacker with network access via HTTP to take over the component.

A vulnerability in Oracle Contracts Integration of Oracle E-Business Suite allows an unauthenticated attacker to modify critical data. Exploitation is difficult (high AC).

Vulnerability in Oracle Public Sector Financials (Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized read and write access to some data.

Vulnerability in Oracle Public Sector Financials (Oracle E-Business Suite) versions 12.2.3-12.2.15. Easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all Oracle Public Sector Financials data.

Vulnerability in Oracle Public Sector Financials (Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can perform unauthorized update, insert, delete or read access. Requires user interaction.

Vulnerability in Oracle Human Resources (part of Oracle E-Business Suite, component: Enterprise Command Center). A low-privileged attacker with local access can gain unauthorized access to critical data and modify it. CVSS 7.1.

Vulnerability in Oracle Human Resources (Oracle E-Business Suite) component Enterprise Command Center. Versions 12.2.14-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

In Oracle Human Resources in Oracle E-Business Suite (Data Removal Tool component) versions 12.2.3-12.2.15, a vulnerability exists. An authenticated attacker with high privileges can remotely take over Oracle Human Resources via HTTP.

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle HRMS (UK).

Vulnerability in Oracle Order Management (Oracle E-Business Suite) component Product Diagnostic Tools. Versions 12.2.4-12.2.15 affected. Low-privileged attacker with network access via HTTP can compromise confidentiality and integrity.

In Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, an easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP, requiring human interaction. Successful attacks can result in unauthorized creation, deletion, or modification of critical data and partial denial of service.