CVE Vulnerability Catalog

Electric Postgres Sync versions below 1.6.10 contain an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses.

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5-12.2.15 have a vulnerability in the Internal Operations component. A low-privileged authenticated attacker with network access via HTTP can exploit it, requiring human interaction, leading to unauthorized read and write access to some data and affecting other products.

Vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 6.5 (Confidentiality).

A vulnerability in Oracle HRMS (US) of Oracle E-Business Suite allows a high-privileged attacker to access critical data. The vulnerability has a scope change, affecting other products.

Vulnerability in Oracle HRMS (US) of Oracle E-Business Suite, Internal Operations component. A low-privileged attacker via HTTP can gain unauthorized access to critical data or all Oracle HRMS (US) data.

A vulnerability in Oracle Advanced Benefits (Oracle E-Business Suite) versions 12.2.3-12.2.15 allows a low-privileged attacker with network access via HTTP to gain unauthorized read, update, insert, or delete access to some data and cause a partial denial of service.

Vulnerability in Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks can result in unauthorized update, insert or delete access to some data, unauthorized read access, and partial denial of service. CVSS 6.3.

Vulnerability in Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks can result in unauthorized update, insert or delete access to some data, unauthorized read access, and partial denial of service. CVSS 6.3.

A vulnerability in Oracle Quality (Oracle E-Business Suite) versions 12.2.3-12.2.15 allows a low-privileged attacker with network access via HTTP to gain unauthorized read, update, insert, or delete access to some data and cause a partial denial of service.

A vulnerability in Oracle HRMS (US) (Oracle E-Business Suite) versions 12.2.3-12.2.15 allows a low-privileged attacker with network access via HTTP to gain unauthorized read, update, insert, or delete access to some data and cause a partial denial of service.

Vulnerability in Oracle Succession planning of Oracle E-Business Suite, Succession plan component. A low-privileged attacker via HTTP can modify, read data, and cause partial denial of service.

In Oracle Production Scheduling (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, a difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise data confidentiality. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized access to critical data or complete access to all Oracle Production Scheduling data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).

A difficult-to-exploit vulnerability in Oracle Time and Labor (Oracle E-Business Suite) versions 12.2.3-12.2.15 allows a low-privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification of critical data.

Vulnerability in Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations) versions 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Time and Labor. Requires human interaction and may impact additional products. Successful attack can lead to unauthorized update, insert, delete, or read access to data.

Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3-12.2.15 has a vulnerability allowing a high-privileged attacker to unauthorizedly create, delete, or modify critical data, access it, and cause partial DoS.

Vulnerability in Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attack can lead to unauthorized access to critical data or complete access to all data.

A difficult-to-exploit vulnerability in Oracle Contracts Integration allows a low-privileged attacker via HTTP to gain unauthorized read and write access to some data.

Vulnerability in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise data integrity, gaining unauthorized create, delete, or modify access to critical data.

Oracle Contracts Integration versions 12.2.3-12.2.15 has a vulnerability allowing an unauthenticated attacker with network access via HTTP to compromise the product. Human interaction is required. The attack may significantly impact additional products (scope change) and result in unauthorized read and write access to data.