Design/Logic Flaw

Vulnerability in the Hospitality WebSuite8 Cloud Service component of Oracle Hospitality Applications subcomponent: General. Supported versions that are affected are 8.9.6 and 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2017-10214

Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications subcomponent: Xstore Office. Supported versions that are affected are 6.0.x, 6.5.x, 7.0.x, 7.1.x, 15.0.x and 16.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2017-10121

Vulnerability in the Java Advanced Management Console component of Oracle Java SE subcomponent: Server. The supported version that is affected is Java Advanced Management Console: 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java...

CVE-2017-10097

CVE-2017-10097 relates to Oracle Hospitality Reporting and Analytics (Reporting subcomponent) within Oracle Hospitality Applications. Affected versions are 8.5.1 and 9.0.0. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise the component, with exploit...

CVE-2017-10211

Oracle Hospitality Applications – Hospitality Suite8 WebConnect (affected version 8.10.x) contains a vulnerability that is easily exploitable over HTTP with network access and requires user interaction. An unauthenticated attacker can potentially update, insert, or delete data and also read a sub...

CVE-2017-10027

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Fluid Homepage & Navigation. Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2017-10134

CVE-2017-10134 affects Oracle PeopleSoft Enterprise FSCM (subcomponent: eProcurement) on version 9.2. The vulnerability allows a low-privilege attacker with network access via HTTP to compromise FSCM, requiring user interaction. Successful exploitation can lead to unauthorized update/insert/delet...

CVE-2017-10156

CVE-2017-10156 affects Oracle Fusion Middleware BI Publisher (BI Publisher Security) with affected versions 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise BI Publisher; an attack requires user inte...

CVE-2017-10027

The CVE-2017-10027 entry concerns Oracle PeopleSoft: Fluid Homepage & Navigation within PeopleTools. Affected are PeopleSoft 8.54 and 8.55. The vulnerability allows a low-privilege, network-accessible attacker (via HTTP) to read and modify some PeopleTools data, with user interaction required. CV...

CVE-2017-10106

CVE-2017-10106 affects Oracle PeopleSoft Enterprise PeopleTools Portal (ToolsRelease 8.54 and 8.55). The vulnerability is a cross-site scripting (XSS) issue in TestServlet/Portal components that allows an unauthenticated, network-accessing attacker to execute scripts via HTTP requests, potentiall...

CVE-2017-10012

CVE-2017-10012 (Oracle FLEXCUBE Private Banking) affects Oracle Financial Services Applications, FLEXCUBE Private Banking; Operations subcomponent. Affected versions: 2.0.0, 2.0.1, 2.2.0, and 12.0.1. The vulnerability allows a low-privilege attacker with network access via HTTP to perform unautho...

PT-2017-11162

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Field Service, requiring human interaction from a person other than the attacker...

CVE-2017-6873: Missing Authentication for Critical Function

A vulnerability was discovered in Siemens OZW672 all versions and OZW772 all versions that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle MITM attack on the integrated web server on port 443/tcp...

CVE-2017-3651: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client mysqldump. Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple...

PT-2017-11058

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 11.1.1.7.0 Description The issue affects the BI Publisher component, specifically the Mobile Service subcomponent. It allows a low-privileged attacker with network access via HTTP to compromise BI Publisher,...

PT-2017-11172

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation, requiring human interaction from a...

CVE-2017-6873

A vulnerability was discovered in Siemens OZW672 all versions and OZW772 all versions that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle MITM attack on the integrated web server on port 443/tcp...

PT-2017-17388

Name of the Vulnerable Software and Affected Versions Siemens OZW672 all versions Siemens OZW772 all versions Description A vulnerability was discovered that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle MITM attack on the integrated web...

CVE-2017-12424

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes with a buffer overflow or other memory corruption or other unspecified behaviors. This crosses a privilege boundary in, for example,...

Buffer overflow

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes with a buffer overflow or other memory corruption or other unspecified behaviors. This crosses a privilege boundary in, for example,...