Oracle Critical Patch Update Advisory - October 2016 - Oracle CVRF Oracle Critical Patch Update Advisory CPUOct2016 Final 1.0 1.0 2016-10-18T13:00:00-07:00 Initial Distribution 2016-10-18T13:00:00-07:00 2016-10-18T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had fixes released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including fix distribution information can be found at the Oracle sites referenced in this document. This document is published at: http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3235388.xml https://www.oracle.com/security-alerts/cpuoct2016.html URL to html version of Advisory Abhishek Singh Abhishek Singh Adam Willard, reported through CMS Adam Willard Raytheon Foreground Security Ahmad Amjad Alfoqha'a Alejo Popovici Alejo Popovici Alexander Kornbrust Red Database Security Amichai Shulman Imperva, Inc. Amine HM Amine HM Arbin Godar Arbin Godar Ariel Walter Garcia Ariel Walter Garcia Ayoub Ait Elmokhtar Ayoub Ait Elmokhtar Behzad Najjarpour Jabbari, Secunia Research at Flexera Software Ben Khilfa Fahmi - SIFARIS Tunisia Cameron Dawe Spam404.com Cezar Santos Cezar Santos Christopher Lamberson CHRISTOPHER LAMBERSON David Litchfield Google Dawid Golunski Dawid Golunski Denis Shpektorov Denis Shpektorov Devin Rosenbauer Identity Works LLC Dhiraj Mishra TMT ITRA Cyber Security Team at EY Felix Wilhelm Felix Wilhelm Filippos Mastrogiannis Hellenic Telecommunications Organization S.A (OTE) Hamza Bachikh Hamza Bachikh Jackson Thuraisamy Security Compass Jacob Baines - Tenable Network Security working with Trend Micro's Zero Day Initiative Jakub Palaczynski ING Services Polska Jatinpreet Singh Jatinpreet Singh Jayvardhan Singh Jayvardhan Singh Jiri Stary Jiri Stary John Page (hyp3rlinx) Jordan Milne Jordan Milne Kamran Saifullah (ImpactX Technologies) Ketankumar B. Godhani Ketankumar Godhani Hunter Liu of Huawei's IT Infrastructure & Security Dept, BPIT&QM Mandeep Jadon Mandeep Jadon Masato Kinugawa Mateusz Guzik Mateusz Guzik Matias Mevied Onapsis Matthias Kaiser Code White Max Pilar Blue Canopy Michael Miller Integrigy Michael Rasmussen Zeroturnaround Mudit Punia Torrid Networks Pvt. Ltd. Muhammad Zeeshan Muhammad Zeeshan Nikhil Mittal Nikhil Mittal Okan Basegmez DORASEC Consulting Pete Finnigan Pete Finnigan Peter Moody Peter Moody Pradeep Kumar Pradeep Kumar Pravin Nagare Pravin Nagare Rahmat Nur Fauzi Rahmat Nur Fauzi Ravindra Singh Rathore Ravindra Singh Rathore Reno Robert Reno Robert Rex Dale Stevens Rex Dale Stevens Sahar Sabban Intel Shahmeer Baloch Shahmeer Baloch Shanliang Jiang Shanliang Jiang Shawar Khan Shawar Khan Spyridon Chatzimichail of OTE Hellenic Telecommunications Organization S.A. Sree Visakh Jain Sree Visakh Jain Suraj Khetani Gulf Business Machines Sven Blumenstein Google Talib Osmani Talib Osmani Recx Ltd. Tommy DeVoss Evolution Security Valentin Dornauer Valentin Dornauer Vishnu Padmakumar Vishnu Padmakumar bo13oy Trend Micro's Zero Day Initiative wh0ami wh0ami Big Data Spatial and Graph Version Prior to 1.2 Commerce Platform Version 10.0.3.5 Commerce Platform Version 10.2.0.5 Commerce Platform Version 11.2.0.1 Commerce Service Center Version 10.0.3.5 Commerce Service Center Version 10.2.0.5 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.0 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.1 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 3.1.1 Commerce Guided Search / Oracle Commerce Experience Manager Version 3.1.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.2.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.3.0 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.4.1.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.5.0 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.5.1 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.5.2 Enterprise Session Border Controller Version Ecz7.3m1p4 and earlier Enterprise Communications Broker Version Pcz2.0.0m4p5 and earlier Communications Policy Management Version 10.4.1 Communications Policy Management Version 12.1.1 and earlier Communications Policy Management Version 9.7.3 Communications Policy Management Version 9.9.1 Oracle Database Version 11.2.0.4 Oracle Database Version 12.1.0.2 SQL*Plus Version 11.2.0.4 SQL*Plus Version 12.1.0.2 Application Express Version Prior to 5.0.4.00.07 Applications DBA Version 12.1.3 Applications DBA Version 12.2.3 Applications DBA Version 12.2.4 Applications DBA Version 12.2.5 Applications DBA Version 12.2.6 Interaction Center Intelligence Version 12.1.1 Interaction Center Intelligence Version 12.1.2 Interaction Center Intelligence Version 12.1.3 iStore Version 12.1.1 iStore Version 12.1.2 iStore Version 12.1.3 iStore Version 12.2.3 iStore Version 12.2.4 iProcurement Version 12.1.1 iProcurement Version 12.1.2 iProcurement Version 12.1.3 iProcurement Version 12.2.3 iProcurement Version 12.2.4 iProcurement Version 12.2.5 iProcurement Version 12.2.6 Advanced Pricing Version 12.1.1 Advanced Pricing Version 12.1.2 Advanced Pricing Version 12.1.3 Advanced Pricing Version 12.2.3 Advanced Pricing Version 12.2.4 Advanced Pricing Version 12.2.5 Advanced Pricing Version 12.2.6 Email Center Version 12.1.1 Email Center Version 12.1.2 Email Center Version 12.1.3 Email Center Version 12.2.3 Email Center Version 12.2.4 Email Center Version 12.2.5 Email Center Version 12.2.6 Shipping Execution Version 12.1.1 Shipping Execution Version 12.1.2 Shipping Execution Version 12.1.3 Shipping Execution Version 12.2.3 Shipping Execution Version 12.2.4 Shipping Execution Version 12.2.5 Shipping Execution Version 12.2.6 iRecruitment Version 12.1.1 iRecruitment Version 12.1.2 iRecruitment Version 12.1.3 iRecruitment Version 12.2.3 iRecruitment Version 12.2.4 iRecruitment Version 12.2.5 iRecruitment Version 12.2.6 Common Applications Version 12.1.1 Common Applications Version 12.1.2 Common Applications Version 12.1.3 Common Applications Version 12.2.3 Common Applications Version 12.2.4 Common Applications Version 12.2.5 Common Applications Version 12.2.6 CRM Technical Foundation Version 12.1.1 CRM Technical Foundation Version 12.1.2 CRM Technical Foundation Version 12.1.3 CRM Technical Foundation Version 12.2.3 CRM Technical Foundation Version 12.2.4 CRM Technical Foundation Version 12.2.5 CRM Technical Foundation Version 12.2.6 Customer Interaction History Version 12.1.1 Customer Interaction History Version 12.1.2 Customer Interaction History Version 12.1.3 Customer Interaction History Version 12.2.3 Customer Interaction History Version 12.2.4 One-to-One Fulfillment Version 12.1.1 One-to-One Fulfillment Version 12.1.2 One-to-One Fulfillment Version 12.1.3 One-to-One Fulfillment Version 12.2.3 One-to-One Fulfillment Version 12.2.4 One-to-One Fulfillment Version 12.2.5 One-to-One Fulfillment Version 12.2.6 Applications Technology Stack Version 12.1.3 Enterprise Manager Base Platform Version 12.1.0.5 Application Testing Suite Version 12.5.0.1 Application Testing Suite Version 12.5.0.2 Application Testing Suite Version 12.5.0.3 Enterprise Manager Ops Center Version 12.1.4 Enterprise Manager Ops Center Version 12.2.2 Enterprise Manager Ops Center Version 12.3.2 Financial Services Analytical Applications Infrastructure Version 7.3.0 Financial Services Analytical Applications Infrastructure Version 7.3.1 Financial Services Analytical Applications Infrastructure Version 7.3.2 Financial Services Analytical Applications Infrastructure Version 7.3.3 Financial Services Analytical Applications Infrastructure Version 7.3.4 Financial Services Analytical Applications Infrastructure Version 7.3.5 Financial Services Analytical Applications Infrastructure Version 8.0.0 Financial Services Analytical Applications Infrastructure Version 8.0.1 Financial Services Analytical Applications Infrastructure Version 8.0.2 Financial Services Analytical Applications Infrastructure Version 8.0.3 FLEXCUBE Universal Banking Version 11.3.0 FLEXCUBE Universal Banking Version 11.4.0 FLEXCUBE Universal Banking Version 12.0.1 FLEXCUBE Universal Banking Version 12.0.2 FLEXCUBE Universal Banking Version 12.0.3 FLEXCUBE Universal Banking Version 12.1.0 FLEXCUBE Universal Banking Version 12.2.0 FLEXCUBE Universal Banking Version 12.87.1 FLEXCUBE Universal Banking Version 12.87.2 FLEXCUBE Investor Servicing Version 12.0.1 FLEXCUBE Enterprise Limits and Collateral Management Version 12.0.0 FLEXCUBE Enterprise Limits and Collateral Management Version 12.1.0 FLEXCUBE Core Banking Version 11.5.0.0.0 FLEXCUBE Core Banking Version 11.6.0.0.0 FLEXCUBE Private Banking Version 12.0.0 FLEXCUBE Private Banking Version 12.0.1 FLEXCUBE Private Banking Version 12.0.2 FLEXCUBE Private Banking Version 12.0.3 FLEXCUBE Private Banking Version 12.1.0 FLEXCUBE Private Banking Version 2.0.0 FLEXCUBE Private Banking Version 2.0.1 FLEXCUBE Private Banking Version 2.2.0 Financial Services Lending and Leasing Version 14.1.0 Financial Services Lending and Leasing Version 14.2.0 Banking Digital Experience Version 15.1 Discoverer Version 11.1.1.7.0 BI Publisher (formerly XML Publisher) Version 11.1.1.7.0 BI Publisher (formerly XML Publisher) Version 11.1.1.9.0 BI Publisher (formerly XML Publisher) Version 12.2.1.0.0 Identity Manager Version - Business Intelligence Enterprise Edition Version 11.1.1.7.0 Business Intelligence Enterprise Edition Version 11.1.1.9.0 Business Intelligence Enterprise Edition Version 12.1.1.0.0 Business Intelligence Enterprise Edition Version 12.2.1.1.0 Data Integrator Version 11.1.1.7.0 Data Integrator Version 11.1.1.9.0 Data Integrator Version 12.1.2.0.0 Data Integrator Version 12.1.3.0.0 Data Integrator Version 12.2.1.0.0 Data Integrator Version 12.2.1.1.0 Platform Security for Java Version 12.1.3.0.0 Platform Security for Java Version 12.2.1.0.0 Platform Security for Java Version 12.2.1.1.0 Outside In Technology Version 8.4.0 Outside In Technology Version 8.5.1 Outside In Technology Version 8.5.2 Outside In Technology Version 8.5.3 WebLogic Server Version 10.3.6.0 WebLogic Server Version 11.1.1.7.0 WebLogic Server Version 11.1.1.9.0 WebLogic Server Version 12.1.3.0 WebLogic Server Version 12.1.3.0.0 WebLogic Server Version 12.2.1.0 WebLogic Server Version 12.2.1.0.0 WebLogic Server Version 12.2.1.1 GlassFish Server Version 2.1.1 GlassFish Server Version 3.0.1 GlassFish Server Version 3.1.2 NetBeans Version 8.1 iPlanet Web Proxy Server Version 4.0 iPlanet Web Server Version 7.0 WebCenter Sites Version 12.2.1.0.0 WebCenter Sites Version 12.2.1.1.0 WebCenter Sites Version 12.2.1.2.0 Big Data Discovery Version 1.1.1 Big Data Discovery Version 1.1.3 Big Data Discovery Version 1.2.0 Life Sciences Data Hub Version 2.x Hospitality OPERA 5 Property Services Version 5.4.0.0 Hospitality OPERA 5 Property Services Version 5.4.1.0 Hospitality OPERA 5 Property Services Version 5.4.2.0 Hospitality OPERA 5 Property Services Version 5.4.3.0 Hospitality OPERA 5 Property Services Version 5.5.0.0 Hospitality OPERA 5 Property Services Version 5.5.1.0 Insurance Istream Version 4.3.2 JD Edwards EnterpriseOne Tools Version 9.1 JD Edwards World Security Version A9.4 Java Version 7u111 Java Version 8u102 Java Version 8u102; Java SE Embedded: 8u101 Java Version Java SE: 6u121 MySQL Server Version 5.5.50 and earlier MySQL Server Version 5.5.51 and earlier MySQL Server Version 5.5.52 and earlier MySQL Server Version 5.6.30 and earlier MySQL Server Version 5.6.31 and earlier MySQL Server Version 5.6.31 and earlier5.7.13 and earlier MySQL Server Version 5.6.32 and earlier MySQL Server Version 5.6.33 and earlier MySQL Server Version 5.7.12 and earlier MySQL Server Version 5.7.13 and earlier MySQL Server Version 5.7.14 and earlier MySQL Server Version 5.7.15 and earlier MySQL Connectors Version 2.0.4 and earlier MySQL Connectors Version 2.1.3 and earlier PeopleSoft Enterprise HCM Candidate Gateway Version 9.2 PeopleSoft Enterprise HCM Talent Acquisition Manager Version 9.2 PeopleSoft Enterprise HCM Time and Labor Version 9.2 PeopleSoft Enterprise PT PeopleTools Version 8.54 PeopleSoft Enterprise PT PeopleTools Version 8.55 PeopleSoft Enterprise SCM Services Procurement Version 9.1 PeopleSoft Enterprise SCM Services Procurement Version 9.2 Primavera P6 Enterprise Project Portfolio Management Version 15.x Primavera P6 Enterprise Project Portfolio Management Version 16.x Primavera P6 Enterprise Project Portfolio Management Version 8.3 Primavera P6 Enterprise Project Portfolio Management Version 8.4 Retail Back Office Version 13.0 Retail Back Office Version 13.1 Retail Back Office Version 13.2 Retail Back Office Version 13.3 Retail Back Office Version 13.4 Retail Back Office Version 14.0 Retail Back Office Version 14.1 Retail Central Office Version 13.0 Retail Central Office Version 13.1 Retail Central Office Version 13.2 Retail Central Office Version 13.3 Retail Central Office Version 13.4 Retail Central Office Version 14.0 Retail Central Office Version 14.1 Retail Returns Management Version 13.0 Retail Returns Management Version 13.1 Retail Returns Management Version 13.2 Retail Returns Management Version 13.3 Retail Returns Management Version 13.4 Retail Returns Management Version 14.0 Retail Returns Management Version 14.1 Retail Clearance Optimization Engine Version 13.2 Retail Clearance Optimization Engine Version 13.3 Retail Clearance Optimization Engine Version 13.4 Retail Clearance Optimization Engine Version 14.0 Retail Customer Insights Version 15.0 Retail Xstore Point of Service Version 5.0 Retail Xstore Point of Service Version 5.5 Retail Xstore Point of Service Version 6.0 Retail Xstore Point of Service Version 6.5 Retail Xstore Point of Service Version 7.0 Retail Xstore Point of Service Version 7.1 MICROS Xstore Payment Version 1.x MICROS XBR Version 7.0.2 MICROS XBR Version 7.0.4 Retail Merchandising Insights Cloud Service Version 15.0 Oracle Secure Backup Version Prior to 10.4.0.4.0 Oracle Secure Backup Version Prior to 12.1.0.2.0 Siebel Apps - Customer Order Management Version 16.1 Siebel Apps - E-Billing Version 7.1 Siebel UI Framework Version 16.1 Solaris Cluster Version 3.3 Solaris Cluster Version 4.3 Solaris Operating System Version 10 Solaris Operating System Version 11.3 Sun ZFS Storage Appliance Kit (AK) Software Version AK 2013 Advanced Supply Chain Planning Version 12.2.3 Advanced Supply Chain Planning Version 12.2.4 Advanced Supply Chain Planning Version 12.2.5 Transportation Management Version 6.1 Transportation Management Version 6.2 Transportation Management Version 6.3.0 Transportation Management Version 6.3.1 Transportation Management Version 6.3.2 Transportation Management Version 6.3.3 Transportation Management Version 6.3.4 Transportation Management Version 6.3.5 Transportation Management Version 6.3.6 Transportation Management Version 6.3.7 Agile Engineering Data Management Version 6.1.3.0 Agile Engineering Data Management Version 6.2.0.0 Agile Product Supplier Collaboration for Process Version 6.1.0.4 Agile Product Supplier Collaboration for Process Version 6.1.1.6 Agile Product Supplier Collaboration for Process Version 6.2.0.0 Agile PLM Framework Version 9.3.4 Agile PLM Framework Version 9.3.5 Sun Ray Software Version SROS prior to 11.1.7 Oracle VM VirtualBox Version VirtualBox prior to 5.0.28 Oracle VM VirtualBox Version VirtualBox prior to 5.1.4 Oracle VM VirtualBox Version prior to 5.1.8 Secure Global Desktop Version 4.7 Secure Global Desktop Version 5.2 Virtual Desktop Infrastructure Version VDI prior to 3.5.3 Vulnerability in the Application Express component of Oracle Database Server. The supported version that is affected is Prior to 5.0.4.00.07. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Express accessible data as well as unauthorized read access to a subset of Application Express accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2010-5312 P-1348V-Prior to 5.0.4.00.07 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1348V-Prior to 5.0.4.00.07 Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2013-2067 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2013-2067 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: Security). Supported versions that are affected are Ecz7.3m1p4 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSH to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Session Border Controller accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2013-2566 P-10757V-Ecz7.3m1p4 and earlier 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10757V-Ecz7.3m1p4 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2013-4286 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2013-4322 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2013-4444 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Policy Management accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2013-4590 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2014-0050 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2014-0075 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Policy Management accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2014-0096 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2014-0099 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Policy Management accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2014-0119 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Ecz7.3m1p4 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Session Border Controller accessible data as well as unauthorized read access to a subset of Oracle Enterprise Session Border Controller accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Session Border Controller. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2014-0224 P-10757V-Ecz7.3m1p4 and earlier 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10757V-Ecz7.3m1p4 and earlier Vulnerability in the Oracle Enterprise Communications Broker component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Pcz2.0.0m4p5 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Communications Broker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Communications Broker accessible data as well as unauthorized read access to a subset of Oracle Enterprise Communications Broker accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Communications Broker. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2014-0224 P-10758V-Pcz2.0.0m4p5 and earlier 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10758V-Pcz2.0.0m4p5 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2014-0224 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Tomcat). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2014-0227 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Security). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via SSH to compromise Oracle Communications Policy Management. While the vulnerability is in Oracle Communications Policy Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2014-2532 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 4.9 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Ecz7.3m1p4 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Session Border Controller. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2014-3571 P-10757V-Ecz7.3m1p4 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10757V-Ecz7.3m1p4 and earlier Vulnerability in the Oracle Enterprise Communications Broker component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Pcz2.0.0m4p5 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Communications Broker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Communications Broker. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2014-3571 P-10758V-Pcz2.0.0m4p5 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10758V-Pcz2.0.0m4p5 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2014-3571 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: NTP). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via NTP to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2014-9296 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Glibc). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2015-0235 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Secure Backup component of Oracle Secure Backup. The supported version that is affected is Prior to 10.4.0.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Secure Backup. While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Secure Backup. CVSS 3.0 Base Score 5.8 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). Fix has been released CVE-2015-0286 P-1522V-Prior to 10.4.0.4.0 5.8 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1522V-Prior to 10.4.0.4.0 Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Ecz7.3m1p4 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Session Border Controller. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2015-0286 P-10757V-Ecz7.3m1p4 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10757V-Ecz7.3m1p4 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2015-0286 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: MySQL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2015-0381 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: MySQL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2015-0382 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: MySQL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2015-0409 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: MySQL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2015-0411 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: MySQL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2015-0423 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: MySQL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2015-0433 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: MySQL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2015-0500 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Secure Backup component of Oracle Secure Backup. The supported version that is affected is Prior to 12.1.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Secure Backup. While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Secure Backup. CVSS 3.0 Base Score 5.8 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). Fix has been released CVE-2015-1351 P-1522V-Prior to 12.1.0.2.0 5.8 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1522V-Prior to 12.1.0.2.0 Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Ecz7.3m1p4 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Session Border Controller accessible data as well as unauthorized read access to a subset of Oracle Enterprise Session Border Controller accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Session Border Controller. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2015-1791 P-10757V-Ecz7.3m1p4 and earlier 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10757V-Ecz7.3m1p4 and earlier Vulnerability in the JD Edwards World Security component of Oracle JD Edwards Products (subcomponent: GUI / World Vision). The supported version that is affected is A9.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards World Security. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards World Security accessible data as well as unauthorized read access to a subset of JD Edwards World Security accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2015-1793 P-4839V-A9.4 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4839V-A9.4 Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: MySQL). Supported versions that are affected are 9.7.3, 9.9.1, 10.4.1 and 12.1.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Policy Management. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2015-2568 P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10900V-9.7.3 P-10900V-9.9.1 P-10900V-10.4.1 P-10900V-12.1.1 and earlier Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Ecz7.3m1p4 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Session Border Controller. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2015-3195 P-10757V-Ecz7.3m1p4 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10757V-Ecz7.3m1p4 and earlier Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Ecz7.3m1p4 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Session Border Controller accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-3197 P-10757V-Ecz7.3m1p4 and earlier 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10757V-Ecz7.3m1p4 and earlier Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Event Java PX). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-4461V-9.3.4 P-4461V-9.3.5 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Supported versions that are affected are 10.0.3.5, 10.2.0.5 and 11.2.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-9348V-10.0.3.5 P-9348V-10.2.0.5 P-9348V-11.2.0.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9348V-10.0.3.5 P-9348V-10.2.0.5 P-9348V-11.2.0.1 Vulnerability in the Oracle Retail Customer Insights component of Oracle Retail Applications (subcomponent: Security). The supported version that is affected is 15.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Customer Insights. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Insights. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-10263V-15.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10263V-15.0 Vulnerability in the Oracle Big Data Discovery component of Oracle Fusion Middleware (subcomponent: Data Processing). Supported versions that are affected are 1.1.1, 1.1.3 and 1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Big Data Discovery. Successful attacks of this vulnerability can result in takeover of Oracle Big Data Discovery. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-11305V-1.1.1 P-11305V-1.1.3 P-11305V-1.2.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11305V-1.1.1 P-11305V-1.1.3 P-11305V-1.2.0 Vulnerability in the Oracle Retail Merchandising Insights component of Oracle Retail Applications (subcomponent: Security). The supported version that is affected is 15.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising Insights. Successful attacks of this vulnerability can result in takeover of Oracle Retail Merchandising Insights. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-12561V-15.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-12561V-15.0 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Apache Commons Collections). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-4461V-9.3.4 P-4461V-9.3.5 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: None). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 Vulnerability in the Oracle Retail Clearance Optimization Engine component of Oracle Retail Applications (subcomponent: General Application). Supported versions that are affected are 13.2, 13.3, 13.4 and 14.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Clearance Optimization Engine. Successful attacks of this vulnerability can result in takeover of Oracle Retail Clearance Optimization Engine. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-5256V-13.2 P-5256V-13.3 P-5256V-13.4 P-5256V-14.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5256V-13.2 P-5256V-13.3 P-5256V-13.4 P-5256V-14.0 Vulnerability in the Oracle Insurance IStream component of Oracle Insurance Applications (subcomponent: Apache Commons Collections). The supported version that is affected is 4.3.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Insurance IStream. Successful attacks of this vulnerability can result in takeover of Oracle Insurance IStream. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-5486V-4.3.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5486V-4.3.2 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). Supported versions that are affected are 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 8.0.0, 8.0.1, 8.0.2 and 8.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-5680V-7.3.0 P-5680V-7.3.1 P-5680V-7.3.2 P-5680V-7.3.3 P-5680V-7.3.4 P-5680V-7.3.5 P-5680V-8.0.0 P-5680V-8.0.1 P-5680V-8.0.2 P-5680V-8.0.3 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5680V-7.3.0 P-5680V-7.3.1 P-5680V-7.3.2 P-5680V-7.3.3 P-5680V-7.3.4 P-5680V-7.3.5 P-5680V-8.0.0 P-5680V-8.0.1 P-5680V-8.0.2 P-5680V-8.0.3 Vulnerability in the Virtual Desktop Infrastructure component of Oracle Virtualization (subcomponent: Apache Commons Collection). The supported version that is affected is VDI prior to 3.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Virtual Desktop Infrastructure. Successful attacks of this vulnerability can result in takeover of Virtual Desktop Infrastructure. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-8540V-VDI prior to 3.5.3 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8540V-VDI prior to 3.5.3 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). Supported versions that are affected are 12.87.1 and 12.87.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9052V-12.87.1 P-9052V-12.87.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-12.87.1 P-9052V-12.87.2 Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). The supported version that is affected is 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Investor Servicing. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9099V-12.0.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9099V-12.0.1 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Enterprise Limits and Collateral Management. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9100V-12.0.0 P-9100V-12.1.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). Supported versions that are affected are 11.5.0.0.0 and 11.6.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Core Banking. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Core Banking. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9101V-11.5.0.0.0 P-9101V-11.6.0.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9101V-11.5.0.0.0 P-9101V-11.6.0.0.0 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Private Banking. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.0 P-9110V-12.0.1 P-9110V-12.0.2 P-9110V-12.0.3 P-9110V-12.1.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.0 P-9110V-12.0.1 P-9110V-12.0.2 P-9110V-12.0.3 P-9110V-12.1.0 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: Content Acquisition System). Supported versions that are affected are 3.1.1, 3.1.2, 11.0, 11.1 and 11.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9633V-3.1.1 P-9633V-3.1.2 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9633V-3.1.1 P-9633V-3.1.2 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 Vulnerability in the Oracle Financial Services Lending and Leasing component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). Supported versions that are affected are 14.1.0 and 14.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Lending and Leasing. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Lending and Leasing. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-10484V-14.1.0 P-10484V-14.2.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10484V-14.1.0 P-10484V-14.2.0 Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xenvironment). Supported versions that are affected are 5.0, 5.5, 6.0, 6.5, 7.0 and 7.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in takeover of Oracle Retail Xstore Point of Service. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-11513V-5.0 P-11513V-5.5 P-11513V-6.0 P-11513V-6.5 P-11513V-7.0 P-11513V-7.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11513V-5.0 P-11513V-5.5 P-11513V-6.0 P-11513V-6.5 P-11513V-7.0 P-11513V-7.1 Vulnerability in the Big Data Graph component of Oracle Big Data Graph (subcomponent: Apache Commons Collections). The supported version that is affected is Prior to 1.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Big Data Graph. Successful attacks of this vulnerability can result in takeover of Big Data Graph. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-11528V-Prior to 1.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11528V-Prior to 1.2 Vulnerability in the MICROS XBR component of Oracle Retail Applications (subcomponent: Liferay). Supported versions that are affected are 7.0.2 and 7.0.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MICROS XBR. Successful attacks of this vulnerability can result in takeover of MICROS XBR. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-11564V-7.0.2 P-11564V-7.0.4 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11564V-7.0.2 P-11564V-7.0.4 Vulnerability in the Oracle Banking Digital Experience component of Oracle Financial Services Applications (subcomponent: Apache Commons Collections). The supported version that is affected is 15.1. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Banking Digital Experience. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Banking Digital Experience accessible data. CVSS 3.0 Base Score 2.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N). Fix has been released CVE-2015-7501 P-12605V-15.1 2.0 AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-12605V-15.1 Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Grid Control (subcomponent: Load Testing for Web Apps). Supported versions that are affected are 12.5.0.1, 12.5.0.2 and 12.5.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-4622V-12.5.0.1 P-4622V-12.5.0.2 P-4622V-12.5.0.3 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4622V-12.5.0.1 P-4622V-12.5.0.2 P-4622V-12.5.0.3 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Bouncy Castle Java). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-5085V-8.54 P-5085V-8.55 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Virtual Desktop Infrastructure component of Oracle Virtualization (subcomponent: Bouncy Castle Java). The supported version that is affected is VDI prior to 3.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Virtual Desktop Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Virtual Desktop Infrastructure accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-8540V-VDI prior to 3.5.3 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8540V-VDI prior to 3.5.3 Vulnerability in the Enterprise Manager component of Oracle Enterprise Manager Grid Control (subcomponent: Ops Center). Supported versions that are affected are 12.1.4 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-9835V-12.1.4 P-9835V-12.2.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9835V-12.1.4 P-9835V-12.2.2 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Spring). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-4461V-9.3.4 P-4461V-9.3.5 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure component of Oracle Financial Services Applications (subcomponent: Inline Processing). Supported versions that are affected are 8.0.0, 8.0.1, 8.0.2 and 8.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-5680V-8.0.0 P-5680V-8.0.1 P-5680V-8.0.2 P-5680V-8.0.3 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5680V-8.0.0 P-5680V-8.0.1 P-5680V-8.0.2 P-5680V-8.0.3 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: Content Acquisition System). Supported versions that are affected are 3.1.1, 3.1.2, 11.0, 11.1 and 11.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-9633V-3.1.1 P-9633V-3.1.2 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9633V-3.1.1 P-9633V-3.1.2 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: Tools and Frameworks). Supported versions that are affected are 3.1.1, 3.1.2, 11.0, 11.1 and 11.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-9633V-3.1.1 P-9633V-3.1.2 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9633V-3.1.1 P-9633V-3.1.2 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Install). Supported versions that are affected are 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6 and 6.3.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in takeover of Oracle Transportation Management. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0714 P-1991V-6.1 P-1991V-6.2 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1991V-6.1 P-1991V-6.2 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 Vulnerability in the Virtual Desktop Infrastructure component of Oracle Virtualization (subcomponent: Apache Tomcat). The supported version that is affected is VDI prior to 3.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Virtual Desktop Infrastructure. Successful attacks of this vulnerability can result in takeover of Virtual Desktop Infrastructure. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0714 P-8540V-VDI prior to 3.5.3 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8540V-VDI prior to 3.5.3 Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Portal SEC). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-1181 P-4781V-9.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4781V-9.1 Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.0, 13.1, 13.2, 13.3, 13.4, 14.0 and 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Back Office. While the vulnerability is in Oracle Retail Back Office, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Back Office accessible data as well as unauthorized read access to a subset of Oracle Retail Back Office accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Back Office. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2016-1881 P-2013V-13.0 P-2013V-13.1 P-2013V-13.2 P-2013V-13.3 P-2013V-13.4 P-2013V-14.0 P-2013V-14.1 8.3 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2013V-13.0 P-2013V-13.1 P-2013V-13.2 P-2013V-13.3 P-2013V-13.4 P-2013V-14.0 P-2013V-14.1 Vulnerability in the Oracle Retail Central Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.0, 13.1, 13.2, 13.3, 13.4, 14.0 and 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Central Office. While the vulnerability is in Oracle Retail Central Office, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Central Office accessible data as well as unauthorized read access to a subset of Oracle Retail Central Office accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Central Office. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2016-1881 P-2016V-13.0 P-2016V-13.1 P-2016V-13.2 P-2016V-13.3 P-2016V-13.4 P-2016V-14.0 P-2016V-14.1 8.3 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2016V-13.0 P-2016V-13.1 P-2016V-13.2 P-2016V-13.3 P-2016V-13.4 P-2016V-14.0 P-2016V-14.1 Vulnerability in the Oracle Retail Returns Management component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.0, 13.1, 13.2, 13.3, 13.4, 14.0 and 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Returns Management. While the vulnerability is in Oracle Retail Returns Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Returns Management accessible data as well as unauthorized read access to a subset of Oracle Retail Returns Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Returns Management. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2016-1881 P-2020V-13.0 P-2020V-13.1 P-2020V-13.2 P-2020V-13.3 P-2020V-13.4 P-2020V-14.0 P-2020V-14.1 8.3 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2020V-13.0 P-2020V-13.1 P-2020V-13.2 P-2020V-13.3 P-2020V-13.4 P-2020V-14.0 P-2020V-14.1 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). The supported version that is affected is 2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle GlassFish Server. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-1950 P-8493V-2.1.1 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8493V-2.1.1 Vulnerability in the Oracle iPlanet Web Proxy Server component of Oracle Fusion Middleware (subcomponent: Security). The supported version that is affected is 4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iPlanet Web Proxy Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iPlanet Web Proxy Server. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-1950 P-8542V-4.0 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8542V-4.0 Vulnerability in the Oracle iPlanet Web Server component of Oracle Fusion Middleware (subcomponent: Security ). The supported version that is affected is 7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iPlanet Web Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iPlanet Web Server. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-1950 P-8543V-7.0 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8543V-7.0 Vulnerability in the Oracle Life Sciences Data Hub component of Oracle Health Sciences Applications (subcomponent: OpenSSL). The supported version that is affected is 2.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Life Sciences Data Hub. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Life Sciences Data Hub and unauthorized read access to a subset of Oracle Life Sciences Data Hub accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-1710V-2.x 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1710V-2.x Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Install). Supported versions that are affected are 6.1 and 6.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Transportation Management and unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-1991V-6.1 P-1991V-6.2 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1991V-6.1 P-1991V-6.2 Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Installation). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.1.0.0 and 12.2.1.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-2107 P-2025V-11.1.1.7.0 P-2025V-11.1.1.9.0 P-2025V-12.1.1.0.0 P-2025V-12.2.1.1.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2025V-11.1.1.7.0 P-2025V-11.1.1.9.0 P-2025V-12.1.1.0.0 P-2025V-12.2.1.1.0 Vulnerability in the Primavera P6 Professional Project Management component of Oracle Primavera Products Suite (subcomponent: OpenSSL). Supported versions that are affected are 8.3, 8.4, 15.x and 16.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Professional Project Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera P6 Professional Project Management and unauthorized read access to a subset of Primavera P6 Professional Project Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-5579V-8.3 P-5579V-8.4 P-5579V-15.x P-5579V-16.x 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5579V-8.3 P-5579V-8.4 P-5579V-15.x P-5579V-16.x Vulnerability in the Sun Ray Operating Software component of Oracle Virtualization (subcomponent: OpenSSL). The supported version that is affected is SROS prior to 11.1.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Sun Ray Operating Software. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun Ray Operating Software and unauthorized read access to a subset of Sun Ray Operating Software accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-8242V-SROS prior to 11.1.7 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8242V-SROS prior to 11.1.7 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: MDEX). Supported versions that are affected are 6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1 and 6.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager and unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-9633V-6.2.2 P-9633V-6.3.0 P-9633V-6.4.1.2 P-9633V-6.5.0 P-9633V-6.5.1 P-9633V-6.5.2 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9633V-6.2.2 P-9633V-6.3.0 P-9633V-6.4.1.2 P-9633V-6.5.0 P-9633V-6.5.1 P-9633V-6.5.2 Vulnerability in the Enterprise Manager component of Oracle Enterprise Manager Grid Control (subcomponent: Ops Center). Supported versions that are affected are 12.1.4, 12.2.2 and 12.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager and unauthorized read access to a subset of Enterprise Manager accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-9835V-12.1.4 P-9835V-12.2.2 P-9835V-12.3.2 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9835V-12.1.4 P-9835V-12.2.2 P-9835V-12.3.2 Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: OpenSSL). Supported versions that are affected are Ecz7.3m1p4 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Session Border Controller and unauthorized read access to a subset of Oracle Enterprise Session Border Controller accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-10757V-Ecz7.3m1p4 and earlier 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10757V-Ecz7.3m1p4 and earlier Vulnerability in the Oracle HTTP Server component of Oracle E-Business Suite (subcomponent: OpenSSL). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle HTTP Server and unauthorized read access to a subset of Oracle HTTP Server accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2176 P-1745V-12.1.3 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1745V-12.1.3 Vulnerability in the Siebel Apps - E-Billing component of Oracle Siebel CRM (subcomponent: Security). The supported version that is affected is 7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - E-Billing. Successful attacks of this vulnerability can result in takeover of Siebel Apps - E-Billing. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3081 P-8969V-7.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8969V-7.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Struts). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0, 12.0.1, 12.0.3 and 12.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Private Banking. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3081 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 P-9110V-12.0.3 P-9110V-12.1.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 P-9110V-12.0.3 P-9110V-12.1.0 Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0 and 12.2.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2016-3473 P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 P-1479V-12.2.1.0.0 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 P-1479V-12.2.1.0.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.51 and earlier, 5.6.32 and earlier and 5.7.14 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3492 P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.13 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3495 P-8478V-5.7.13 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JavaServer Faces). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3505 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 Vulnerability in the Oracle Web Services component of Oracle Fusion Middleware (subcomponent: JAXWS Web Services Stack). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services. Successful attacks of this vulnerability can result in takeover of Oracle Web Services. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3551 P-5242V-11.1.1.7.0 P-5242V-11.1.1.9.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.0.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5242V-11.1.1.7.0 P-5242V-11.1.1.9.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.0.0 Vulnerability in the RDBMS Security and SQL*Plus component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows high privileged attacker having DBA level privileged account privilege with network access via Oracle Net to compromise RDBMS Security and SQL*Plus. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS Security and SQL*Plus accessible data. Note: Fix applicable to both server and client side installations. CVSS 3.0 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-3562 P-50V-11.2.0.4 P-50V-12.1.0.2 2.4 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-50V-11.2.0.4 P-50V-12.1.0.2 Vulnerability in the Enterprise Manager component of Oracle Enterprise Manager Grid Control (subcomponent: Ops Center). Supported versions that are affected are 12.1.4, 12.2.2 and 12.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Enterprise Manager accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2016-4979 P-9835V-12.1.4 P-9835V-12.2.2 P-9835V-12.3.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9835V-12.1.4 P-9835V-12.2.2 P-9835V-12.3.2 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5479 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Bash). The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data. CVSS 3.0 Base Score 2.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-5480 P-10006V-10 2.8 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-10 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services). The supported version that is affected is AK 2013. Difficult to exploit vulnerability allows unauthenticated attacker with network access via DNS to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Sun ZFS Storage Appliance Kit (AK) accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5481 P-10026V-AK 2013 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10026V-AK 2013 Vulnerability in the Oracle Commerce Guided Search component of Oracle Commerce (subcomponent: Oracle Commerce Guided Search). Supported versions that are affected are 6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1 and 6.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-5482 P-9633V-6.2.2 P-9633V-6.3.0 P-9633V-6.4.1.2 P-9633V-6.5.0 P-9633V-6.5.1 P-9633V-6.5.2 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9633V-6.2.2 P-9633V-6.3.0 P-9633V-6.4.1.2 P-9633V-6.5.0 P-9633V-6.5.1 P-9633V-6.5.2 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services). The supported version that is affected is AK 2013. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Sun ZFS Storage Appliance Kit (AK) executes to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Sun ZFS Storage Appliance Kit (AK) accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5486 P-10026V-AK 2013 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10026V-AK 2013 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Files). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2016-5487 P-10006V-11.3 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-11.3 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2016-5488 P-5242V-10.3.6.0 P-5242V-12.1.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Runtime Catalog). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-5489 P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle FLEXCUBE Universal Banking executes to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5490 P-9052V-11.4.0 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.4.0 Vulnerability in the Oracle Commerce Service Center component of Oracle Commerce (subcomponent: Commerce Service Center). Supported versions that are affected are 10.0.3.5 and 10.2.0.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Service Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Service Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Service Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Service Center accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-5491 P-9351V-10.0.3.5 P-9351V-10.2.0.5 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9351V-10.0.3.5 P-9351V-10.2.0.5 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: SMB Users). The supported version that is affected is AK 2013. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Sun ZFS Storage Appliance Kit (AK) executes to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Sun ZFS Storage Appliance Kit (AK) accessible data as well as unauthorized access to critical data or complete access to all Sun ZFS Storage Appliance Kit (AK) accessible data. Note: This vulnerability applies to local users (i.e. users in /etc/passwd) and not applicable to other (e.g. LDAP) users. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-5492 P-10026V-AK 2013 7.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10026V-AK 2013 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Admin). Supported versions that are affected are 12.0.1, 12.0.2 and 12.0.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5493 P-9110V-12.0.1 P-9110V-12.0.2 P-9110V-12.0.3 4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9110V-12.0.1 P-9110V-12.0.2 P-9110V-12.0.3 Vulnerability in the Oracle Discoverer component of Oracle Fusion Middleware (subcomponent: EUL Code & Schema). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Discoverer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Discoverer accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5495 P-964V-11.1.1.7.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-964V-11.1.1.7.0 Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Difficult to exploit vulnerability allows high privileged attacker having Create Session privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in takeover of RDBMS Security. CVSS 3.0 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5497 P-5V-12.1.0.2 6.4 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5V-12.1.0.2 Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS Security accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5498 P-5V-11.2.0.4 P-5V-12.1.0.2 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5V-11.2.0.4 P-5V-12.1.0.2 Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS Security accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5499 P-5V-11.2.0.4 P-5V-12.1.0.2 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5V-11.2.0.4 P-5V-12.1.0.2 Vulnerability in the Oracle Discoverer component of Oracle Fusion Middleware (subcomponent: Viewer). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Discoverer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Discoverer accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5500 P-964V-11.1.1.7.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-964V-11.1.1.7.0 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 5.0.28 and prior to 5.1.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-5501 P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 7.8 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2 and 12.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5502 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services). The supported version that is affected is AK 2013. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Sun ZFS Storage Appliance Kit (AK) executes to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-5503 P-10026V-AK 2013 8.2 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10026V-AK 2013 Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: Supplier Portal). Supported versions that are affected are 6.1.0.4, 6.1.1.6 and 6.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile Product Lifecycle Management for Process executes to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5504 P-4447V-6.1.0.4 P-4447V-6.1.1.6 P-4447V-6.2.0.0 4.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4447V-6.1.0.4 P-4447V-6.1.1.6 P-4447V-6.2.0.0 Vulnerability in the RDBMS Programmable Interface component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with logon to the infrastructure where RDBMS Programmable Interface executes to compromise RDBMS Programmable Interface. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all RDBMS Programmable Interface accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5505 P-5V-11.2.0.4 P-5V-12.1.0.2 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5V-11.2.0.4 P-5V-12.1.0.2 Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: App Server). For supported versions that are affected see note. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Identity Manager executes to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. Note: Fixed in all supported releases and patchsets. CVSS 3.0 Base Score 3.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5506 P-1980V-- 3.1 AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1980V-- Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.32 and earlier and 5.7.14 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5507 P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: Cluster Geo). The supported version that is affected is 4.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris Cluster executes to compromise Solaris Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris Cluster accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5508 P-10005V-4.3 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10005V-4.3 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Folders, Files & Attachments). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5510 P-4461V-9.3.4 P-4461V-9.3.5 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. Note: Please refer to <a href="https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2188873.1"> My Oracle Support Note 2188873.1 </a> for instructions on how to address this issue. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-5511 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2016-5512 P-4461V-9.3.4 P-4461V-9.3.5 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: File Manager). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5513 P-4461V-9.3.4 P-4461V-9.3.5 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: ExportServlet). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5514 P-4461V-9.3.4 P-4461V-9.3.5 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: RMIServlet). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5515 P-4461V-9.3.4 P-4461V-9.3.5 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Kernel PDB component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_PDB_EXEC_SQL privilege with logon to the infrastructure where Kernel PDB executes to compromise Kernel PDB. While the vulnerability is in Kernel PDB, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Kernel PDB. CVSS 3.0 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H). Fix has been released CVE-2016-5516 P-5V-12.1.0.2 6.0 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5V-12.1.0.2 Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Applications DBA executes to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5517 P-166V-12.1.3 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-166V-12.1.3 Vulnerability in the Oracle Agile Engineering Data Management component of Oracle Supply Chain Products Suite (subcomponent: webfileservices). Supported versions that are affected are 6.1.3.0 and 6.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5518 P-4436V-6.1.3.0 P-4436V-6.2.0.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4436V-6.1.3.0 P-4436V-6.2.0.0 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in takeover of Oracle GlassFish Server. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5519 P-8493V-2.1.1 P-8493V-3.0.1 P-8493V-3.1.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8493V-2.1.1 P-8493V-3.0.1 P-8493V-3.1.2 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5521 P-4461V-9.3.4 P-4461V-9.3.5 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5522 P-4461V-9.3.4 P-4461V-9.3.5 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: AutoVue Java Applet). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5523 P-4461V-9.3.4 P-4461V-9.3.5 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5524 P-4461V-9.3.4 P-4461V-9.3.5 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: Cluster check files). Supported versions that are affected are 3.3 and 4.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris Cluster executes to compromise Solaris Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris Cluster accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-5525 P-10005V-3.3 P-10005V-4.3 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10005V-3.3 P-10005V-4.3 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Apache Tomcat). Supported versions that are affected are 9.3.4 and 9.3.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile PLM. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2016-5526 P-4461V-9.3.4 P-4461V-9.3.5 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.4 and 9.3.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5527 P-4461V-9.3.4 P-4461V-9.3.5 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-4461V-9.3.4 P-4461V-9.3.5 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2016-5529 P-5085V-8.54 P-5085V-8.55 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2016-5530 P-5085V-8.54 P-5085V-8.55 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS-WebServices). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5531 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 Vulnerability in the Oracle Shipping Execution component of Oracle E-Business Suite (subcomponent: Workflow Events). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5532 P-996V-12.1.1 P-996V-12.1.2 P-996V-12.1.3 P-996V-12.2.3 P-996V-12.2.4 P-996V-12.2.5 P-996V-12.2.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-996V-12.1.1 P-996V-12.1.2 P-996V-12.1.3 P-996V-12.2.3 P-996V-12.2.4 P-996V-12.2.5 P-996V-12.2.6 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Team Member). Supported versions that are affected are 8.4, 15.x and 16.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5533 P-5579V-8.4 P-5579V-15.x P-5579V-16.x 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5579V-8.4 P-5579V-15.x P-5579V-16.x Vulnerability in the Siebel Apps - Customer Order Management component of Oracle Siebel CRM (subcomponent: Customizable Prod/Configurator). The supported version that is affected is 16.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Customer Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Customer Order Management accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5534 P-9011V-16.1 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9011V-16.1 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: None). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5535 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 Vulnerability in the Oracle Platform Security for Java component of Oracle Fusion Middleware (subcomponent: Audit Schema). Supported versions that are affected are 12.1.3.0.0, 12.2.1.0.0 and 12.2.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Platform Security for Java accessible data as well as unauthorized update, insert or delete access to some of Oracle Platform Security for Java accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Platform Security for Java. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2016-5536 P-2233V-12.1.3.0.0 P-2233V-12.2.1.0.0 P-2233V-12.2.1.1.0 7.6 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2233V-12.1.3.0.0 P-2233V-12.2.1.0.0 P-2233V-12.2.1.1.0 Vulnerability in the NetBeans component of Oracle Fusion Middleware (subcomponent: Project Import). The supported version that is affected is 8.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where NetBeans executes to compromise NetBeans. While the vulnerability is in NetBeans, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of NetBeans accessible data as well as unauthorized read access to a subset of NetBeans accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of NetBeans. CVSS 3.0 Base Score 5.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2016-5537 P-8506V-8.1 5.7 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8506V-8.1 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 5.0.28 and prior to 5.1.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5538 P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 Vulnerability in the Oracle Retail Xstore Payment component of Oracle Retail Applications (subcomponent: Security). The supported version that is affected is 1.x. Easily exploitable vulnerability allows physical access to compromise Oracle Retail Xstore Payment. While the vulnerability is in Oracle Retail Xstore Payment, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail Xstore Payment accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail Xstore Payment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Xstore Payment. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L). Fix has been released CVE-2016-5539 P-11562V-1.x 7.3 AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11562V-1.x Vulnerability in the Oracle Retail Xstore Payment component of Oracle Retail Applications (subcomponent: Security). The supported version that is affected is 1.x. Difficult to exploit vulnerability allows physical access to compromise Oracle Retail Xstore Payment. While the vulnerability is in Oracle Retail Xstore Payment, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail Xstore Payment accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail Xstore Payment accessible data. CVSS 3.0 Base Score 6.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). Fix has been released CVE-2016-5540 P-11562V-1.x 6.7 AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11562V-1.x Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u121, 7u111 and 8u102; Java SE Embedded: 8u101. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-5542 P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Enterprise Limits and Collateral Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2016-5543 P-9100V-12.0.0 P-9100V-12.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel/X86). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5544 P-10006V-10 P-10006V-11.3 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-10 P-10006V-11.3 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Filesystem). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5553 P-10006V-10 P-10006V-11.3 5.0 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-10 P-10006V-11.3 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u121, 7u111 and 8u102; Java SE Embedded: 8u101. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-5554 P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows high privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise OJVM. While the vulnerability is in OJVM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of OJVM. CVSS 3.0 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-5555 P-5V-11.2.0.4 P-5V-12.1.0.2 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5V-11.2.0.4 P-5V-12.1.0.2 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u121, 7u111 and 8u102. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-5556 P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102 Vulnerability in the Oracle Advanced Pricing component of Oracle E-Business Suite (subcomponent: Price Book). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Pricing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Pricing accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-5557 P-495V-12.1.1 P-495V-12.1.2 P-495V-12.1.3 P-495V-12.2.3 P-495V-12.2.4 P-495V-12.2.5 P-495V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-495V-12.1.1 P-495V-12.1.2 P-495V-12.1.3 P-495V-12.2.3 P-495V-12.2.4 P-495V-12.2.5 P-495V-12.2.6 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.4.0, 8.5.1, 8.5.2 and 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2016-5558 P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris accessible data. CVSS 3.0 Base Score 4.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2016-5559 P-10006V-10 P-10006V-11.3 4.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-10 P-10006V-11.3 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: OpenUI). The supported version that is affected is 16.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel UI Framework accessible data as well as unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5560 P-8967V-16.1 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8967V-16.1 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: IKE). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via IKEv2 to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L). Fix has been released CVE-2016-5561 P-10006V-11.3 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-11.3 Vulnerability in the Oracle iProcurement component of Oracle E-Business Suite (subcomponent: Requisition Management). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iProcurement. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iProcurement, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iProcurement accessible data as well as unauthorized update, insert or delete access to some of Oracle iProcurement accessible data. CVSS 3.0 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-5562 P-398V-12.1.1 P-398V-12.1.2 P-398V-12.1.3 P-398V-12.2.3 P-398V-12.2.4 P-398V-12.2.5 P-398V-12.2.6 7.6 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-398V-12.1.1 P-398V-12.1.2 P-398V-12.1.3 P-398V-12.2.3 P-398V-12.2.4 P-398V-12.2.5 P-398V-12.2.6 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA File Upload Download). Supported versions that are affected are 5.4.0.0, 5.4.1.0, 5.4.2.0, 5.4.3.0, 5.5.0.0 and 5.5.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. While the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.0 Base Score 7.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L). Fix has been released CVE-2016-5563 P-11580V-5.4.0.0 P-11580V-5.4.1.0 P-11580V-5.4.2.0 P-11580V-5.4.3.0 P-11580V-5.5.0.0 P-11580V-5.5.1.0 7.9 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11580V-5.4.0.0 P-11580V-5.4.1.0 P-11580V-5.4.2.0 P-11580V-5.4.3.0 P-11580V-5.5.0.0 P-11580V-5.5.1.0 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Application Login). Supported versions that are affected are 5.4.0.0, 5.4.1.0, 5.4.2.0, 5.4.3.0, 5.5.0.0 and 5.5.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. While the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized read access to a subset of Oracle Hospitality OPERA 5 Property Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.0 Base Score 7.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2016-5564 P-11580V-5.4.0.0 P-11580V-5.4.1.0 P-11580V-5.4.2.0 P-11580V-5.4.3.0 P-11580V-5.5.0.0 P-11580V-5.5.1.0 7.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11580V-5.4.0.0 P-11580V-5.4.1.0 P-11580V-5.4.2.0 P-11580V-5.4.3.0 P-11580V-5.5.0.0 P-11580V-5.5.1.0 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Xchange Interface (OXI)). Supported versions that are affected are 5.4.0.0, 5.4.1.0, 5.4.2.0, 5.4.3.0, 5.5.0.0 and 5.5.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. While the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2016-5565 P-11580V-5.4.0.0 P-11580V-5.4.1.0 P-11580V-5.4.2.0 P-11580V-5.4.3.0 P-11580V-5.5.0.0 P-11580V-5.5.1.0 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-11580V-5.4.0.0 P-11580V-5.4.1.0 P-11580V-5.4.2.0 P-11580V-5.4.3.0 P-11580V-5.5.0.0 P-11580V-5.5.1.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Installation). The supported version that is affected is 11.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5566 P-10006V-11.3 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-11.3 Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-5567 P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u121, 7u111 and 8u102. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-5568 P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Limits and Collateral). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5569 P-9100V-12.0.0 P-9100V-12.1.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Supported versions that are affected are 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-5570 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-5571 P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 Vulnerability in the Kernel PDB component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Difficult to exploit vulnerability allows high privileged attacker having Create Session privilege with logon to the infrastructure where Kernel PDB executes to compromise Kernel PDB. Successful attacks of this vulnerability can result in takeover of Kernel PDB. CVSS 3.0 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5572 P-5V-12.1.0.2 6.4 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5V-12.1.0.2 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u121, 7u111 and 8u102; Java SE Embedded: 8u101. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-5573 P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.4.0, 8.5.1, 8.5.2 and 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2016-5574 P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 Vulnerability in the Oracle Common Applications Calendar component of Oracle E-Business Suite (subcomponent: Resources Module). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications Calendar. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Common Applications Calendar accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5575 P-1198V-12.1.1 P-1198V-12.1.2 P-1198V-12.1.3 P-1198V-12.2.3 P-1198V-12.2.4 P-1198V-12.2.5 P-1198V-12.2.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1198V-12.1.1 P-1198V-12.1.2 P-1198V-12.1.3 P-1198V-12.2.3 P-1198V-12.2.4 P-1198V-12.2.5 P-1198V-12.2.6 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel Zones). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5576 P-10006V-11.3 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-11.3 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.4.0, 8.5.1, 8.5.2 and 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2016-5577 P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.4.0, 8.5.1, 8.5.2 and 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2016-5578 P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.4.0, 8.5.1, 8.5.2 and 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2016-5579 P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 Vulnerability in the Secure Global Desktop component of Oracle Virtualization (subcomponent: Web Services). Supported versions that are affected are 4.7 and 5.2. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Secure Global Desktop. While the vulnerability is in Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Secure Global Desktop accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Secure Global Desktop. CVSS 3.0 Base Score 9.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H). Fix has been released CVE-2016-5580 P-8539V-4.7 P-8539V-5.2 9.6 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8539V-4.7 P-8539V-5.2 Vulnerability in the Oracle iRecruitment component of Oracle E-Business Suite (subcomponent: Candidate Self Service). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows physical access to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in takeover of Oracle iRecruitment. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5581 P-1193V-12.1.1 P-1193V-12.1.2 P-1193V-12.1.3 P-1193V-12.2.3 P-1193V-12.2.4 P-1193V-12.2.5 P-1193V-12.2.6 6.6 AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1193V-12.1.1 P-1193V-12.1.2 P-1193V-12.1.3 P-1193V-12.2.3 P-1193V-12.2.4 P-1193V-12.2.5 P-1193V-12.2.6 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u121, 7u111 and 8u102; Java SE Embedded: 8u101. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-5582 P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: File Upload). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-5583 P-1379V-12.1.1 P-1379V-12.1.2 P-1379V-12.1.3 P-1379V-12.2.3 P-1379V-12.2.4 P-1379V-12.2.5 P-1379V-12.2.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1379V-12.1.1 P-1379V-12.1.2 P-1379V-12.1.3 P-1379V-12.2.3 P-1379V-12.2.4 P-1379V-12.2.5 P-1379V-12.2.6 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.52 and earlier, 5.6.33 and earlier and 5.7.15 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5584 P-8478V-5.5.52 and earlier P-8478V-5.6.33 and earlier P-8478V-5.7.15 and earlier 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.52 and earlier P-8478V-5.6.33 and earlier P-8478V-5.7.15 and earlier Vulnerability in the Oracle Interaction Center Intelligence component of Oracle E-Business Suite (subcomponent: Select Application Dependencies). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Interaction Center Intelligence. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Interaction Center Intelligence accessible data as well as unauthorized read access to a subset of Oracle Interaction Center Intelligence accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5585 P-298V-12.1.1 P-298V-12.1.2 P-298V-12.1.3 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-298V-12.1.1 P-298V-12.1.2 P-298V-12.1.3 Vulnerability in the Oracle Email Center component of Oracle E-Business Suite (subcomponent: Dispatch/Service Call Requests). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Email Center accessible data as well as unauthorized read access to a subset of Oracle Email Center accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2016-5586 P-950V-12.1.1 P-950V-12.1.2 P-950V-12.1.3 P-950V-12.2.3 P-950V-12.2.4 P-950V-12.2.5 P-950V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-950V-12.1.1 P-950V-12.1.2 P-950V-12.1.3 P-950V-12.2.3 P-950V-12.2.4 P-950V-12.2.5 P-950V-12.2.6 Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: Outcome-Result). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Interaction History accessible data as well as unauthorized read access to a subset of Oracle Customer Interaction History accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2016-5587 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.4.0, 8.5.1, 8.5.2 and 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2016-5588 P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2276V-8.4.0 P-2276V-8.5.1 P-2276V-8.5.2 P-2276V-8.5.3 Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Responsibility Management). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle CRM Technical Foundation accessible data as well as unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2016-5589 P-1199V-12.1.1 P-1199V-12.1.2 P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1199V-12.1.1 P-1199V-12.1.2 P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: Outcome-Result). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Interaction History accessible data as well as unauthorized read access to a subset of Oracle Customer Interaction History accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2016-5591 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: Result-Reason). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Interaction History accessible data as well as unauthorized read access to a subset of Oracle Customer Interaction History accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2016-5592 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: Outcome-Result). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Interaction History accessible data as well as unauthorized read access to a subset of Oracle Customer Interaction History accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2016-5593 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2 and 12.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. While the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). Fix has been released CVE-2016-5594 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 5.0 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: Result-Reason). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3 and 12.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Interaction History accessible data as well as unauthorized read access to a subset of Oracle Customer Interaction History accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2016-5595 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 P-1374V-12.2.3 P-1374V-12.2.4 Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Default Responsibility). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5596 P-1199V-12.1.1 P-1199V-12.1.2 P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1199V-12.1.1 P-1199V-12.1.2 P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u121, 7u111 and 8u102; Java SE Embedded: 8u101. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5597 P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-856V-Java SE: 6u121 P-856V-7u111 P-856V-8u102; Java SE Embedded: 8u101 Vulnerability in the MySQL Connector component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 2.1.3 and earlier and 2.0.4 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connector accessible data as well as unauthorized read access to a subset of MySQL Connector accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connector. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2016-5598 P-8576V-2.1.3 and earlier P-8576V-2.0.4 and earlier 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8576V-2.1.3 and earlier P-8576V-2.0.4 and earlier Vulnerability in the Oracle Advanced Supply Chain Planning component of Oracle Supply Chain Products Suite (subcomponent: MscObieeSrvlt). Supported versions that are affected are 12.2.3, 12.2.4 and 12.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Supply Chain Planning. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Advanced Supply Chain Planning accessible data as well as unauthorized access to critical data or complete access to all Oracle Advanced Supply Chain Planning accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-5599 P-719V-12.2.3 P-719V-12.2.4 P-719V-12.2.5 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-719V-12.2.3 P-719V-12.2.4 P-719V-12.2.5 Vulnerability in the PeopleSoft Enterprise SCM Services Procurement component of Oracle PeopleSoft Products (subcomponent: Security). Supported versions that are affected are 9.1 and 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Services Procurement. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Services Procurement accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Services Procurement accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5600 P-5135V-9.1 P-5135V-9.2 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5135V-9.1 P-5135V-9.2 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: CIE Related Components). Supported versions that are affected are 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N). Fix has been released CVE-2016-5601 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 6.3 AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: Code Generation Engine). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.0.0 and 12.2.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. Note: Please refer to <a href="https://support.oracle.com/CSP/main/article?cmd=show&amp;type=NOT&amp;id=2188855.1"> My Oracle Support Note 2188855.1 </a> for instructions on how to address this issue. CVSS 3.0 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-5602 P-2196V-11.1.1.7.0 P-2196V-11.1.1.9.0 P-2196V-12.1.3.0.0 P-2196V-12.2.1.0.0 P-2196V-12.2.1.1.0 5.7 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2196V-11.1.1.7.0 P-2196V-11.1.1.9.0 P-2196V-12.1.3.0.0 P-2196V-12.2.1.0.0 P-2196V-12.2.1.1.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5603 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Security Framework). The supported version that is affected is 12.1.0.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Enterprise Manager Base Platform executes to compromise Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Enterprise Manager Base Platform, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Enterprise Manager Base Platform accessible data. CVSS 3.0 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N). Fix has been released CVE-2016-5604 P-1370V-12.1.0.5 6.3 AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-1370V-12.1.0.5 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VirtualBox Remote Desktop Extension (VRDE)). The supported version that is affected is VirtualBox prior to 5.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-5605 P-8370V-VirtualBox prior to 5.1.4 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8370V-VirtualBox prior to 5.1.4 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel Zones). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris as well as unauthorized update, insert or delete access to some of Solaris accessible data. CVSS 3.0 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2016-5606 P-10006V-11.3 6.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-11.3 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5607 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 5.0.28 and prior to 5.1.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5608 P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.6.31 and earlier 5.7.13 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5609 P-8478V-5.6.31 and earlier5.7.13 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.6.31 and earlier5.7.13 and earlier Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 5.0.28 and prior to 5.1.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2016-5610 P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 6.8 AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 5.0.28 and prior to 5.1.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Fix has been released CVE-2016-5611 P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 4.3 AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.50 and earlier, 5.6.31 and earlier and 5.7.13 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5612 P-8478V-5.5.50 and earlier P-8478V-5.6.31 and earlier P-8478V-5.7.13 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.50 and earlier P-8478V-5.6.31 and earlier P-8478V-5.7.13 and earlier Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 5.0.28 and prior to 5.1.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). Fix has been released CVE-2016-5613 P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 4.3 AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Lynx). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2016-5615 P-10006V-11.3 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-10006V-11.3 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Supported versions that are affected are 5.5.51 and earlier, 5.6.32 and earlier and 5.7.14 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5616 P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling). Supported versions that are affected are 5.5.51 and earlier, 5.6.32 and earlier and 5.7.14 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5617 P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: Code Generation Engine). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.2.0.0, 12.1.3.0.0, 12.2.1.0.0 and 12.2.1.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Data Integrator accessible data. Note: Please refer to <a href="https://support.oracle.com/CSP/main/article?cmd=show&amp;type=NOT&amp;id=2188871.1"> My Oracle Support Note 2188871.1 </a> for instructions on how to address this issue. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5618 P-2196V-11.1.1.7.0 P-2196V-11.1.1.9.0 P-2196V-12.1.2.0.0 P-2196V-12.1.3.0.0 P-2196V-12.2.1.0.0 P-2196V-12.2.1.1.0 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2196V-11.1.1.7.0 P-2196V-11.1.1.9.0 P-2196V-12.1.2.0.0 P-2196V-12.1.3.0.0 P-2196V-12.2.1.0.0 P-2196V-12.2.1.1.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-5619 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-5620 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5621 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: INFRA). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-5622 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.51 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5624 P-8478V-5.5.51 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.51 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.7.14 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5625 P-8478V-5.7.14 and earlier 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.14 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: GIS). Supported versions that are affected are 5.5.51 and earlier, 5.6.32 and earlier and 5.7.14 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5626 P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.31 and earlier and 5.7.13 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5627 P-8478V-5.6.31 and earlier P-8478V-5.7.13 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.6.31 and earlier P-8478V-5.7.13 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.13 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5628 P-8478V-5.7.13 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Federated). Supported versions that are affected are 5.5.51 and earlier, 5.6.32 and earlier and 5.7.14 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5629 P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.31 and earlier 5.7.13 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5630 P-8478V-5.6.31 and earlier5.7.13 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.6.31 and earlier5.7.13 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.7.13 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5631 P-8478V-5.7.13 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.14 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5632 P-8478V-5.7.14 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.14 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Performance Schema). Supported versions that are affected are 5.7.13 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5633 P-8478V-5.7.13 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: RBR). Supported versions that are affected are 5.7.13 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5634 P-8478V-5.7.13 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Audit). Supported versions that are affected are 5.7.13 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-5635 P-8478V-5.7.13 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: OpenSSL). Supported versions that are affected are VirtualBox prior to 5.0.28 and prior to 5.1.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8370V-VirtualBox prior to 5.0.28 P-8370V-prior to 5.1.8 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.6.33 and earlier and 5.7.15 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-8478V-5.6.33 and earlier P-8478V-5.7.15 and earlier 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.6.33 and earlier P-8478V-5.7.15 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Logging). Supported versions that are affected are 5.5.52 and earlier, 5.6.33 and earlier and 5.7.15 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6662 P-8478V-5.5.52 and earlier P-8478V-5.6.33 and earlier P-8478V-5.7.15 and earlier 7.2 AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.52 and earlier P-8478V-5.6.33 and earlier P-8478V-5.7.15 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.52 and earlier, 5.6.33 and earlier and 5.7.15 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-7440 P-8478V-5.5.52 and earlier P-8478V-5.6.33 and earlier P-8478V-5.7.15 and earlier 5.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.52 and earlier P-8478V-5.6.33 and earlier P-8478V-5.7.15 and earlier Vulnerability in the Oracle Platform Security for Java component of Oracle Fusion Middleware (subcomponent: Audit Reports). Supported versions that are affected are 12.1.3.0.0, 12.2.1.0.0 and 12.2.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Platform Security for Java accessible data as well as unauthorized update, insert or delete access to some of Oracle Platform Security for Java accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Platform Security for Java. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2016-8281 P-2233V-12.1.3.0.0 P-2233V-12.2.1.0.0 P-2233V-12.2.1.1.0 7.6 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-2233V-12.1.3.0.0 P-2233V-12.2.1.0.0 P-2233V-12.2.1.1.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Types). Supported versions that are affected are 5.5.51 and earlier, 5.6.32 and earlier and 5.7.14 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2016-8283 P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.5.51 and earlier P-8478V-5.6.32 and earlier P-8478V-5.7.14 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.31 and earlier and 5.7.13 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 1.8 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L). Fix has been released CVE-2016-8284 P-8478V-5.6.31 and earlier P-8478V-5.7.13 and earlier 1.8 AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.6.31 and earlier P-8478V-5.7.13 and earlier Vulnerability in the PeopleSoft Enterprise HCM component of Oracle PeopleSoft Products (subcomponent: Candidate Gateway). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N). Fix has been released CVE-2016-8285 P-5043V-9.2 4.8 AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5043V-9.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.14 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-8286 P-8478V-5.7.14 and earlier 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.14 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.13 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-8287 P-8478V-5.7.13 and earlier 4.5 AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB Plugin). Supported versions that are affected are 5.6.30 and earlier and 5.7.12 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-8288 P-8478V-5.6.30 and earlier P-8478V-5.7.12 and earlier 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.6.30 and earlier P-8478V-5.7.12 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.13 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2016-8289 P-8478V-5.7.13 and earlier 4.7 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Performance Schema). Supported versions that are affected are 5.7.13 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-8290 P-8478V-5.7.13 and earlier 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-8478V-5.7.13 and earlier Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Mobile Application Platform). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-8291 P-5085V-8.54 P-5085V-8.55 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise HCM component of Oracle PeopleSoft Products (subcomponent: Talent Acquisition Manager). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-8292 P-5078V-9.2 4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5078V-9.2 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-8293 P-5085V-8.54 P-5085V-8.55 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Query). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-8294 P-5085V-8.54 P-5085V-8.55 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise HCM component of Oracle PeopleSoft Products (subcomponent: Schedule). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise HCM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-8295 P-5079V-9.2 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5079V-9.2 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: LDAP). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2016-8296 P-5085V-8.54 P-5085V-8.55 7.6 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CPUOct2016 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2016.html P-5085V-8.54 P-5085V-8.55