CVE-2019-10219

The CVE-2019-10219 entry affects Hibernate Validator: SafeHtml validator annotation fails to sanitize HTML comments/instructions, enabling XSS in affected code paths. Affected CP4S versions are 1.7.2.0, 1.8.0.0, and 1.8.1.0. Remediation is to upgrade to Cloud Pak for Security 1.9.0.0 per IBM guid...

CVE-2022-21377

The CVE-2022-21377 entry concerns Oracle Construction and Engineering’s Primavera Portfolio Management (Web API). Affected versions are 18.0.0.0–18.0.3.0, 19.0.0.0–19.0.1.2 and 20.0.0.0. The vulnerability permits an unauthenticated attacker with network access via HTTP to compromise Primavera Por...

CVE-2022-21281

CVE-2022-21281 affects Oracle Primavera Portfolio Management (Web Access) with affected versions 18.0.0.0–18.0.3.0, 19.0.0.0–19.0.1.2, 20.0.0.0 and 20.0.0.1. The vulnerability can be exploited by a network attacker over HTTP who has high privileges and requires user interaction, potentially leadi...

CVE-2022-21244

CVE-2022-21244 affects Oracle Primavera Portfolio Management (Web Access) in Oracle Construction and Engineering. Affected versions include 18.0.0.0–18.0.3.0, 19.0.0.0–19.0.1.2, 20.0.0.0 and 20.0.0.1. The vulnerability allows an unauthenticated attacker, with network access via HTTP, to compromis...

CVE-2022-21242

CVE-2022-21242 affects Oracle Primavera Portfolio Management (Web Access) across 18.0.0.0–18.0.3.0, 19.0.0.0–19.0.1.2, 20.0.0.0 and 20.0.0.1. The vulnerability allows a low-privileged, network-accessible attacker to exploit over HTTP with user interaction, potentially leading to unauthorized upda...

CVE-2022-21243

The CVE-2022-21243 entry concerns Oracle Construction and Engineering’s Primavera Portfolio Management (Web Access) with affected versions 18.0.0.0–18.0.3.0, 19.0.0.0–19.0.1.2, 20.0.0.0 and 20.0.0.1. The vulnerability allows a low-privilege attacker with network access via HTTP to compromise Prim...

CVE-2022-21269

CVE-2022-21269 affects Oracle Primavera Portfolio Management (Web Access) with affected versions 18.0.0.0–18.0.3.0, 19.0.0.0–19.0.1.2, 20.0.0.0, 20.0.0.1. Reported as a network-access vulnerability that can be triggered via HTTP by an unauthenticated attacker, though exploitation requires user in...

CVE-2020-2562

CVE-2020-2562 affects Oracle Primavera Portfolio Management (Investor Module). Affected versions are 16.1.0.0–16.1.5.1, 18.0.0.0–18.0.2.0, and 19.0.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Primavera Portfolio Management, with attacks req...

CVE-2022-21376

CVE-2022-21376 affects Oracle Construction and Engineering’s Primavera Portfolio Management (Web Access). Vulnerable versions include 18.0.0.0–18.0.3.0, 19.0.0.0–19.0.1.2, and 20.0.0.0. An unauthenticated, network-accessible web request can compromise Primavera Portfolio Management, with user int...

CVE-2020-14528

CVE-2020-14528 affects Oracle Primavera Portfolio Management (Web Access). Affected versions are 16.1.0.0–16.1.5.1, 18.0.0.0–18.0.2.0, and 19.0.0.0. The vulnerability allows an unauthenticated attacker over HTTP with network access to compromise Primavera Portfolio Management, with exploitation r...

CVE-2020-14549

CVE-2020-14549 affects Oracle Primavera Portfolio Management Web Server in versions 16.1.0.0–16.1.5.1, 18.0.0.0–18.0.2.0, and 19.0.0.0. An unauthenticated attacker with network access over HTTPS can compromise Primavera Portfolio Management, with attacks requiring user interaction. Consequences i...

CVE-2020-14529

The CVE-2020-14529 entry refers to a vulnerability in Oracle Primavera Portfolio Management (Investor Module). Affected versions are 16.1.0.0–16.1.5.1, 18.0.0.0–18.0.2.0, and 19.0.0.0. It allows a low-privileged, network-accessible attacker (via HTTP) to compromise Primavera Portfolio Management,...

CVE-2020-14566

The CVE-2020-14566 vulnerability affects Oracle Primavera Portfolio Management Web Access. Affected versions are 16.1.0.0–16.1.5.1, 18.0.0.0–18.0.2.0, and 19.0.0.0. An unauthenticated attacker with network access via HTTP can compromise Primavera Portfolio Management, with successful attacks pote...

CVE-2020-14527

CVE-2020-14527 affects Oracle Primavera Portfolio Management (Web Access). Vulnerable in versions 16.1.0.0–16.1.5.1, 18.0.0.0–18.0.2.0, and 19.0.0.0. An unauthenticated network attacker can compromise Primavera via HTTP, with exploitation requiring human interaction. Impact includes unauthorized ...