Infogram: Login Cross Site Request Forgery

Login form is not protected against Cross Site Request Forgery. An attacker can craft html page containing POST information to have victim sign into an attacker's account, where the victim can add information assuming he/she is logged into the correct account, where in reality, the victim is sign...

CVE-2017-10427

Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications subcomponent: Point of Sale. Supported versions that are affected are 6.0.11, 6.5.11, 7.0.6, 7.1.6 and 15.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access...

CVE-2017-10400

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Administration Graphical User Interface. The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2017-10302

Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM subcomponent: UIF Open UI. Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful...

CVE-2017-10270

Vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware subcomponent: Microsoft Active Directory. The supported version that is affected is 9.1.1.5.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracl...

Design/Logic Flaw

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Core Formatting API. Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ...

CVE-2017-10341

Vulnerability in the Java Advanced Management Console component of Oracle Java SE subcomponent: Server. The supported version that is affected is Java Advanced Management Console: 2.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CVE-2017-10419

CVE-2017-10419 affects Oracle Hospitality Suite8 (PMS component). Affected versions: 8.10.1 and 8.10.2. The vulnerability is exploitable by an unauthenticated attacker with logon to the infrastructure where Suite8 runs, enabling unauthorized update/insert/delete and read access to a subset of dat...

CVE-2017-10358

Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion subcomponent: Workspace. The supported version that is affected is 11.1.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2017-10382

CVE-2017-10382 affects Oracle PeopleSoft Products, specifically the PeopleSoft Enterprise PeopleTools component (subcomponent PIA Core Technology ). Affected versions listed: 8.54, 8.55, 8.56 . The vulnerability is exploitable by an unauthenticated attacker with network access via HTTP ; exploita...

CVE-2017-10386

CVE-2017-10386 affects Oracle Java SE’s Java Advanced Management Console (JAMC) Server component, version 2.7. The vulnerability is exploitable remotely over HTTP by a high-privilege attacker, with user interaction required, potentially leading to unauthorized updates, insertions/deletions, and r...

CVE-2017-10327

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Query. Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2017-10304

The CVE-2017-10304 vulnerability affects Oracle PeopleSoft Enterprise HCM (Security subcomponent) in version 9.2. The issue is exploitable over HTTP with network access, requiring user interaction, and can lead to unauthorized read, update, insert, or delete of PeopleSoft HCM data (confidentialit...

CVE-2017-10338

Vulnerability CVE-2017-10338 affects Oracle PeopleSoft Enterprise PRTL Interaction Hub (Enterprise Portal subcomponent), specifically version 9.1.00. The issue allows unauthenticated network access via HTTP to compromise the Interaction Hub, with human interaction required for exploitation and po...

CVE-2017-10302

CVE-2017-10302 affects Oracle Siebel CRM, specifically the Siebel UI Framework (subcomponent: UIF Open UI). Affected versions are 16.0 and 17.0 . The vulnerability allows an unauthenticated, network-hosted attacker to access via HTTP and, after user interaction, may lead to unauthorized update/in...

CVE-2017-10340

Oracle Hospitality Simphony, Import/Export subcomponent, is affected in versions 2.8 and 2.9 per CVE-2017-10340. A connected document (PRION) lists a buffer overflow as the underlying cause. The vulnerability is described as allowing an unauthenticated attacker with network access via HTTP to com...

CVE-2017-10312

Vulnerability in the Oracle Hyperion BI+ component of Oracle Hyperion subcomponent: UI and Visualization. The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion BI+. Successful...

PT-2017-11386

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.7 Description The issue affects the Oracle Advanced Outbound Telephony component, allowing an unauthenticated attacker with network access via HTTP to compromise it. Successful attacks requi...

PT-2017-11035

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher versions 11.1.1.7.0 through 11.1.1.9.0 Description The issue affects the Core Formatting API subcomponent of Oracle BI Publisher, allowing an unauthenticated attacker with network access via HTTP to compromise the system...

PT-2017-11254

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 16.0 and 17.0 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise the Siebel UI Framework component, requiring human interaction from a person other than the attacker...