CVE Vulnerability Catalog

Vulnerability in Oracle Enterprise Manager Base Platform (component: Agent Next Gen) affects versions 13.5 and 24.1. It is difficult to exploit but allows an unauthenticated attacker via HTTP to take over the platform. Successful attacks result in full takeover.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. Easily exploitable, allows unauthenticated attacker via HTTP, requires user interaction, to unauthorized update, insert or delete of some data.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. Difficult to exploit, requires network access via HTTP. Allows unauthenticated attacker unauthorized read access to a subset of data.

Vulnerability in Oracle Applications DBA (component: JRI and other Java utilities) affects versions 12.2.3-12.2.15. It is difficult to exploit, requires user interaction, but allows an unauthenticated attacker via HTTP to take over the application.

Vulnerability in Oracle Applications DBA (component: Internal Operations) affects versions 12.2.3-12.2.15. It is easily exploitable by a low-privileged attacker via HTTP, allowing unauthorized access to critical data and partial denial of service.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. Easily exploitable, allows unauthenticated attacker via HTTP to unauthorized update, insert or delete of some data.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) affects version 11.2.25.0.000. It is easily exploitable by a low-privileged attacker, requires user interaction, and may impact additional products (scope change). Allows unauthorized access to critical data and modification of some data.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. Difficult to exploit, allows unauthenticated attacker via HTTP, requires user interaction, to unauthorized access to critical data and update, insert or delete of some data.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) affects version 11.2.25.0.000. It is difficult to exploit but allows an unauthenticated attacker via HTTP to perform unauthorized modification of critical data, partial data read, and partial denial of service.

Vulnerability in Oracle Reports Developer (component: Security and Authentication) affects version 14.1.2.0.0. It is difficult to exploit but allows an unauthenticated attacker via HTTP to take over the application.

Vulnerability in Oracle Reports Developer (component: Security and Authentication) affects version 14.1.2.0.0. It is easily exploitable by an attacker with access to the physical network segment, allowing takeover of the application.

Vulnerability in Oracle Reports Developer (component: Security and Authentication) version 14.1.2.0.0. Easily exploitable by an unauthenticated attacker over HTTP, allowing unauthorized data access and modification. Attacks may impact additional products (scope change). CVSS score 9.3.

Vulnerability in Oracle Reports Developer (component: Security and Authentication) affects version 14.1.2.0.0. It is difficult to exploit but allows an unauthenticated attacker via HTTP to perform unauthorized modification of critical data and full data access.

Vulnerability in Oracle Reports Developer (component: Security and Authentication) affects version 14.1.2.0.0. It is easily exploitable by a low-privileged attacker via HTTP, allowing unauthorized modification of critical data and full data access.

Vulnerability in Oracle Reports Developer (component: Security and Authentication) version 14.1.2.0.0. Easily exploitable by an unauthenticated attacker with access to the physical network segment, allowing takeover of the system. Attacks may impact additional products (scope change). CVSS score 9.6.

Vulnerability in Oracle Reports Developer (component: Security and Authentication) version 14.1.2.0.0. Easily exploitable by an unauthenticated attacker over HTTP, allowing takeover of the system. CVSS score 9.8.

Vulnerability in Oracle Reports Developer (component: Security and Authentication) version 14.1.2.0.0. Easily exploitable by an unauthenticated attacker over SOAP, allowing unauthorized data access and modification. CVSS score 9.1.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions but does not remove the deleted role identifier from user's info.roles array or runtime usersMap cache. This can lead to retained authorization rights after admin revocation.

Froxlor 2.3.7 through 2.3.8 in the API commands Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing returns full database rows without removing password and data_2fa fields. An authenticated API caller with permission to use these endpoints can obtain customer, administrator, and FTP password hashes as well as Base32-encoded TOTP seeds for administrator and customer accounts. Password hashes can be cracked offline, and TOTP seeds can generate valid second-factor codes until two-factor authentication is reset. Exposure of both values for an account can enable takeover of the hosting panel or hosted resources and can defeat both authentication factors. This issue is fixed in version 2.3.8.

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).