SUSE CVE-2018-12536

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

SUSE CVE-2023-30539

Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Serv...

CVE-2023-21926

Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications component: Core. Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure wher...

CVE-2023-21904

Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications component: OBVAM Trn Journal Domain. Supported versions that are affected are 14.5, 14.6 and 14.7. Difficult to exploit vulnerability allows high privileged attacker with network acces...

Buffer overflow

Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications component: SMS Module. Supported versions that are affected are 14.5, 14.6 and 14.7. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

Design/Logic Flaw

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit...

Buffer overflow

Vulnerability in the Oracle Clinical Remote Data Capture product of Oracle Health Sciences Applications component: Forms. The supported version that is affected is 5.4.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Clinical...

Buffer overflow

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications component: OXI. The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

UBUNTU-CVE-2023-21954

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit...

CVE-2023-21993

CVE-2023-21993 affects Oracle Clinical Remote Data Capture (Oracle Health Sciences Applications), component Forms, with vulnerable version 5.4.0.2. The issue is a network-accessible, low-privilege flaw that can lead to unauthorized data access (CVSS v3.1 base score 6.5, Confidentiality impact). P...

CVE-2023-21932

CVE-2023-21932 affects Oracle Hospitality OPERA 5 Property Services, component OXI, with the affected release listed as 5.6. The Red Hat and other connected documents describe an unauthenticated/privilege-protected vulnerability in the FileReceiver/HTTP interface that allows high-privilege networ...

CVE-2023-21925

The CVE-2023-21925 issue affects Oracle Health Sciences InForm (Core) with input validation in the Core component. Versions prior to 6.3.1.3 and prior to 7.0.0.1 are vulnerable. An unauthenticated attacker with network access via HTTP can compromise InForm, enabling partial denial of service (par...

CVE-2023-21924

The CVE-2023-21924 entry concerns Oracle Health Sciences InForm (Core) within Oracle Health Sciences Applications. Affected versions are prior to 6.3.1.3 and prior to 7.0.0.1. The vulnerability is exploitable by a high-privilege attacker with network access via HTTP, with user interaction require...

CVE-2023-21908

The CVE-2023-21908 vulnerability affects Oracle Financial Services Applications, specifically the Oracle Banking Virtual Account Management component (OBVAM Trn Journal Domain) in versions 14.5–14.7. It enables a high-privileged attacker with network access via HTTP to compromise OBVAM, with expl...

CVE-2023-21905

The CVE-2023-21905 entry affects Oracle Banking Virtual Account Management (Routing Hub) in Oracle Financial Services Applications, specifically versions 14.5–14.7. A root cause of the vulnerability is insufficient input validation in the Routing Hub subcomponent, which enables a high-privilege a...

CVE-2023-21906

CVE-2023-21906 affects Oracle Banking Virtual Account Management (SMS Module) in Oracle Financial Services Applications. Affected versions: 14.5, 14.6, 14.7. An attacker with network access via HTTP and high privileges can exploit this vulnerability, with user interaction required, to perform una...

CVE-2023-21907

CVE-2023-21907 affects Oracle Banking Virtual Account Management (OBVAM Trn Journal Domain) in Oracle Financial Services Applications, specifically versions 14.5–14.7. The issue is a input validation weakness that can be exploited by a high-privilege attacker with network access over HTTP to obta...

CVE-2023-21904

CVE-2023-21904 affects Oracle Financial Services Applications, specifically the Oracle Banking Virtual Account Management (OBVAM) Trn Journal Domain. Affected versions: 14.5, 14.6, 14.7. The issue is exploitable by a high-privilege attacker with network access via HTTP and requires user interacti...

CVE-2023-21903

CVE-2023-21903 affects Oracle Financial Services Applications, specifically the OBVAM Internal Tfr Domain within Oracle Banking Virtual Account Management. Affected versions are 14.5, 14.6 and 14.7. The vulnerability is described as difficult to exploit and requires network access over HTTP by a ...

Microsoft Vulnerability Severity Classification for Online Services Publication

The Microsoft Security Response Center MSRC is always looking for ways to provide clarity and transparency around how we assess the impact of vulnerabilities reported in our products and services. We have published a new Microsoft Vulnerability Severity Classification for Online Services to provi...