CVE-2020-2950

Oracle-BI CVE-2020-2950 AMF deseiralize Version: 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 Install:https://www.sql.edu.vn/obiee/oracle-business-intelligence-12c/ Ref: https://peterjson.medium.com/cve-2020-2950-turning-amf-deserialize-bug-to-java-deserialize-bug-2984a8542b6f Exploit - PoC amf.bin Header c...

Oracle Business Intelligence - Path Traversal

Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...

CVE-2025-61882-Oracle-BI-Publisher-RCE

Affected Software: Oracle BI Publisher versions 12.2.1.4.0, 12.2.1.3.0. Vulnerability Type: Remote code execution via insecure deserialization in the BI Publisher integration component. Description: The BI Publisher integration component deserializes untrusted data without validation, allowing...

cve-2025-61882-oracle_ebs_rce_reproduction

CVE-2025-61882 — Oracle E-Business Suite Unauthenticated Remote Code Execution CVSS 9.8 CRITICAL Overview CVE-2025-61882 is an unauthenticated remote code execution vulnerability in Oracle E-Business Suite EBS, affecting the Concurrent Processing and BI Publisher components. The flaw allows an...

CVE-2026-117494 Multiple vulnerabilities in Sisense’s Cloud BI Platform

Cross-Site Scripting XSS in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed conte...

CVE-2026-117494

Sisense’s Cloud BI Platform contains a Cross-Site Scripting (XSS) vulnerability (CWE-79) during the processing of SVG images submitted to the /api/v2/ai/sessions API. The flaw occurs when images are submitted in the data:image/svg+xml;base64 format; because the system processes script tags embedd...

CVE-2026-117493 Multiple vulnerabilities in Sisense’s Cloud BI Platform

Stored cross-site scripting XSS in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information...

CVE-2026-117493

Sisense's Cloud BI Platform is vulnerable to Stored Cross-Site Scripting (XSS) in BloX widgets . The /api/dashboards//widgets/ API fails to properly sanitize HTML and JavaScript content submitted via the desc and text parameters. When a widget is rendered, the injected code executes in the user's...

Vulnerabilities in Oracle Analytics

Oracle has identified 33 vulnerabilities in various Oracle Analytics products, including Oracle Business Intelligence Enterprise Edition and Oracle BI Publisher. The patch notes list these 33 vulnerabilities, among which 14 can be exploited remotely without the need for authentication. Depending ...

EUVD-2026-106801

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

EUVD-2026-106794

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Search. Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

EUVD-2026-106793

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Search. The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Busines...

EUVD-2026-106792

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: BI Platform Security. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ...

EUVD-2026-106791

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Platform Security. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-106789

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: BI Publisher Security. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ...

EUVD-2026-106795

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher...

EUVD-2026-106782

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Foundation. The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business...

EUVD-2026-106774

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Foundation. The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-106781

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI...

EUVD-2026-106780

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of...