CVE-2021-35587

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: OpenSSO Agent. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2022-39412

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Admin Console. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager...

Oracle Access Manager (Jul 2024 CPU)

The 12.2.1.4.0 versions of Access Manager installed on the remote host are affected by a vulnerability as referenced in the July 2024 CPU advisory. - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Third Party Apache HttpClient. The supported version that...

Oracle Access Manager (Apr 2024 CPU)

The 12.2.1.4.0 versions of Access Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory. - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Webserver Plugin Apache Xerces-C++. The support...

The vulnerability of the Centralized Third-party Jars component (OkHttp) of the Oracle Access Manager control system allows a hacker to disclose protected information.

The vulnerability of the Centralized Third-party Jars component OkHttp in the Oracle Access Manager access control tool is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

Oracle Access Manager DoS (October 2023 CPU)

The version of Oracle Access Manager installed on the remote host is missing a security patch from the October 2023 CPU Advisory. It is, therefore, affected by denial of service vulnerability. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Centralized...

Vulnerabilities fixed in Oracle Fusion Middleware

Vulnerabilities have been fixed in Oracle Fusion Middleware. A malicious party can exploit the vulnerabilities exploit them to carry out attacks that can result in the following categories of damage: Denial-of-Service DoS Remote code execution Administrator/Root privileges Access to sensitive dat...

Oracle Access Manager DoS (Jul 2023 CPU)

The version of Oracle Access Manager installed on the remote host is missing a security patch from the July 2023 CPU Advisory. It is, therefore, affected by denial of service vulnerability. Oracle Access Manager product of Oracle Fusion Middleware component: Centralized Thirdparty Jars...

Vulnerabilities fixed in Oracle Fusion Middleware

Vulnerabilities have been fixed in Oracle Fusion Middleware products. A malicious party can exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Administrator/Root rights Remote cod...

Oracle Access Manager Multiple Vulnerabilities (Apr 2023 CPU)

The version of Oracle Access Manager installed on the remote host is missing a security patch from the April 2023 CPU Advisory. It is, therefore, affected by multiple vulnerabilities: - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Third Party Jython. T...

K84891934: Oracle Access Manager vulnerability CVE-2018-2739 and CVE-2018-2587

Security Advisory Description CVE-2018-2739 Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware subcomponent: Web Server Plugin. Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated...

The vulnerability of the Authentication Engine component of the Oracle Access Manager control system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Oracle Access Manager Elevation of Privilege (Jan 2023 CPU)

The version of Oracle Access Manager installed on the remote host is affected by the following vulnerability as noted in the January 2023 CPU advisory: - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. The supported version that is...

CVE-2023-21859

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Access Manager...

CVE-2023-21859

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Access Manager...

Design/Logic Flaw

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Access Manager...

CVE-2023-21859

The CVE-2023-21859 entry concerns Oracle Access Manager (Authentication Engine) in Oracle Fusion Middleware. Affected version: 12.2.1.4.0. Root cause described as insufficient input validation in the Authentication Engine, enabling a high-privilege attacker with logon on the infrastructure to com...

PT-2023-1193 · Oracle · Oracle Access Manager

Name of the Vulnerable Software and Affected Versions: Oracle Access Manager version 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Authentication Engine component of Oracle Access Manager. This allows a high-privileged attacker with logon access to the...

CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a critical flaw impacting Oracle Fusion Middleware to its Known Exploited Vulnerabilities KEV Catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2021-35587, carries a CVSS score of 9.8 a...

CVE-2022-39405

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager...