Oracle Critical Patch Update Advisory - July 2017 - Oracle CVRF Oracle Critical Patch Update Advisory CPUJul2017 Final 1.0 1.0 2017-07-18T13:00:00-07:00 Initial Distribution 2017-07-18T13:00:00-07:00 2017-07-18T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had fixes released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including fix distribution information can be found at the Oracle sites referenced in this document. This document is published at: http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3809960.xml https://www.oracle.com/security-alerts/cpujul2017.html URL to html version of Advisory Adam Willard Blue Canopy Adesh Nandkishor Kolte Adesh Nandkishor Kolte Ahsan Khan Ahsan Khan Amin Achour Trading House Antonio Sanso Antonio Sanso Ary Dobrovolskiy Citadel Ashish Gautam Kamble Ashish Gautam Kamble Behzad Najjarpour Jabbari, Secunia Research at Flexera Software CERT/CC CERT/CC Che-Chun Kuo Divergent Security Christopher Tarquini Christopher Tarquini Daniel Bleichenbacher of Google David Litchfield Apple Deniz Cevik Biznet Bilisim A.S. Dmitrii Iudin aka @ret5et of ERPScan Emiliano J. Fausto Onapsis Federico Dobal Onapsis Francis Alexander Francis Alexander Francisco Correa Francisco Correa Gaston Traberg Onapsis George Argyros Columbia University Guifre Ruiz Guifre Ruiz Haider Kamal Haider Kamal Hassan El Hadary - Secure Misr Ilya Maykov Ilya Maykov Jakub Palaczynski ING Services Polska James Forshaw James Forshaw Jayson Grace Sandia National Laboratories Jesse Wilson Square John Lightsey John Lightsey Jolan Saluria Jolan Saluria Juan Pablo Perez Etchegoyen Onapsis Justin Ng Spark Kexin Pei Columbia University Li Qiang of the Qihoo 360 Gear Team Luca Napolitano Hewlett Packard Enterprise Lucas Molas Fundación Sadosky Lukasz Mikula LUKASZ MIKULA Marcin Wołoszyn ING Services Polska Marcus Mengs Marcus Mengs Marios Nicolaides RUNESEC Maris Elsins Pythian Matias Mevied Onapsis Mohit Rawat Mohit Rawat Moritz Bechler Moritz Bechler (eenterphace.org) Muhammad Uwais Muhammad Uwais Nick Bloor of NCC Group Nithin R Nithin R Or Hanuka Motorola Solutions Owais Mehtab IS Pham Van Khanh Viettel Information Security Center Pratik Luhana Pratik Luhana Prof. Angelos D. Keromytis Columbia University Prof. Suman Jana Columbia University Reno Robert Reno Robert Rodolfo Godalle Jr. Rodolfo Godalle Jr. Roman Shalymov ERPScan Sadik Shaikh extremehacking.org Sarath Nair Sarath Nair Sean Gambles Sean Gambles Sergio Abraham Onapsis Shannon Hickey Adobe Sule Bekin Turk Telekom Suphannee Sivakorn Columbia University Takeshi Terada Mitsui Bussan Secure Directions, Inc. Tayeeb Rana IS Tzachy Horesh Motorola Solutions Tzachy Horesh Palantir Security Ubais PK EY Global Delivery Services Vahagn Vardanyan ERPScan Willy Gaston Lindo Willy Gaston Lindo Zuozhi Fan formerly of Alibaba Commerce Guided Search / Oracle Commerce Experience Manager Version 11.0 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.1 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.1.4 Communications Network Charging and Control Version 4.4.1.5 Communications Network Charging and Control Version 5.0.0.1 Communications Network Charging and Control Version 5.0.0.2 Communications Network Charging and Control Version 5.0.1.0 Communications Network Charging and Control Version 5.0.2.0 Communications Convergence Version 3.0 Communications Convergence Version 3.0.1 Communications BRM - Elastic Charging Engine Version 11.2.0.0.0 Communications BRM - Elastic Charging Engine Version 11.3.0.0.0 Communications Session Router Version ECZ730 Communications Session Router Version SCZ730 Communications Session Router Version SCZ740 Enterprise Session Border Controller Version ECZ7.3.0 Enterprise Communications Broker Version PCZ210 Communications Policy Management Version 11.5 Communications EAGLE LNP Application Processor Version 10.0 Primavera P6 Enterprise Project Portfolio Management Version 15.1 Primavera P6 Enterprise Project Portfolio Management Version 15.2 Primavera P6 Enterprise Project Portfolio Management Version 16.1 Primavera P6 Enterprise Project Portfolio Management Version 16.2 Primavera P6 Enterprise Project Portfolio Management Version 8.3 Primavera P6 Enterprise Project Portfolio Management Version 8.4 Primavera Unifier Version 10.1 Primavera Unifier Version 10.2 Primavera Unifier Version 15.1 Primavera Unifier Version 15.2 Primavera Unifier Version 16.1 Primavera Unifier Version 16.2 Primavera Unifier Version 9.13 Primavera Unifier Version 9.14 Primavera Gateway Version 1.0 Primavera Gateway Version 1.1 Primavera Gateway Version 14.2 Primavera Gateway Version 15.1 Primavera Gateway Version 15.2 Primavera Gateway Version 16.1 Primavera Gateway Version 16.2 Oracle Database Version 11.2.0.4 Oracle Database Version 12.1.0.2 Oracle Database Version 12.2.0.1 Applications Manager Version 12.1.3 Applications DBA Version 12.1.3 Applications DBA Version 12.2.3 Applications DBA Version 12.2.4 Applications DBA Version 12.2.5 Applications DBA Version 12.2.6 Marketing Version 12.1.1 Marketing Version 12.1.2 Marketing Version 12.1.3 Marketing Version 12.2.3 Marketing Version 12.2.4 Marketing Version 12.2.5 Marketing Version 12.2.6 iSupport Version 12.1.1 iSupport Version 12.1.2 iSupport Version 12.1.3 iSupport Version 12.2.3 iSupport Version 12.2.4 iSupport Version 12.2.5 iSupport Version 12.2.6 iStore Version 12.1.1 iStore Version 12.1.2 iStore Version 12.1.3 iStore Version 12.2.3 iStore Version 12.2.4 iStore Version 12.2.5 iStore Version 12.2.6 General Ledger Version 12.1.1 General Ledger Version 12.1.2 General Ledger Version 12.1.3 General Ledger Version 12.2.3 General Ledger Version 12.2.4 General Ledger Version 12.2.5 General Ledger Version 12.2.6 Application Object Library Version 12.1.3 Application Object Library Version 12.2.3 Application Object Library Version 12.2.4 Application Object Library Version 12.2.5 Application Object Library Version 12.2.6 Field Service Version 12.1.1 Field Service Version 12.1.2 Field Service Version 12.1.3 Field Service Version 12.2.3 Field Service Version 12.2.4 Field Service Version 12.2.5 Field Service Version 12.2.6 Common Applications Version 12.1.3 Common Applications Version 12.2.3 Common Applications Version 12.2.4 Common Applications Version 12.2.5 Common Applications Version 12.2.6 CRM Technical Foundation Version 12.1.3 CRM Technical Foundation Version 12.2.3 CRM Technical Foundation Version 12.2.4 CRM Technical Foundation Version 12.2.5 CRM Technical Foundation Version 12.2.6 E-Business Suite Technology Stack Version 12.1.3 Web Analytics Version 12.1.1 Web Analytics Version 12.1.2 Web Analytics Version 12.1.3 Web Analytics Version 12.2.3 Web Analytics Version 12.2.4 Web Analytics Version 12.2.5 Web Analytics Version 12.2.6 Application Management Pack for Oracle E-Business Suite Version AMP 12.1.0.4.0 Application Management Pack for Oracle E-Business Suite Version AMP 13.1.1.1.0 Enterprise Manager Base Platform Version 12.1.0 Enterprise Manager Base Platform Version 13.1.0 Enterprise Manager Base Platform Version 13.2.0 Configuration Manager Version Prior to 12.1.2.0.4 Application Testing Suite Version 12.5.0.2 Application Testing Suite Version 12.5.0.3 Business Transaction Management Version 11.1.x Business Transaction Management Version 12.1.x Enterprise Manager Ops Center Version 12.2.2 Enterprise Manager Ops Center Version 12.3.2 FLEXCUBE Universal Banking Version 11.3.0 FLEXCUBE Universal Banking Version 11.4.0 FLEXCUBE Universal Banking Version 12.0.1 FLEXCUBE Universal Banking Version 12.0.2 FLEXCUBE Universal Banking Version 12.0.3 FLEXCUBE Universal Banking Version 12.1.0 FLEXCUBE Universal Banking Version 12.2.0 FLEXCUBE Universal Banking Version 12.3.0 FLEXCUBE Private Banking Version 12.0.1 FLEXCUBE Private Banking Version 2.0.0 FLEXCUBE Private Banking Version 2.0.1 FLEXCUBE Private Banking Version 2.2.0 FLEXCUBE Direct Banking Version 12.0.2 FLEXCUBE Direct Banking Version 12.0.3 Banking Platform Version 2.3 Banking Platform Version 2.4 Banking Platform Version 2.4.1 Banking Platform Version 2.5 Financial Services Behavior Detection Platform Version 8.0.1 Financial Services Behavior Detection Platform Version 8.0.2 BI Publisher (formerly XML Publisher) Version 11.1.1.7.0 BI Publisher (formerly XML Publisher) Version 11.1.1.9.0 BI Publisher (formerly XML Publisher) Version 12.2.1.1.0 BI Publisher (formerly XML Publisher) Version 12.2.1.2.0 Secure Enterprise Search Version 11.2.2.2.0 Business Intelligence Enterprise Edition Version 11.1.1.9.0 Business Intelligence Enterprise Edition Version 12.2.1.1.0 Business Intelligence Enterprise Edition Version 12.2.1.2.0 Data Integrator Version 11.1.1.7.0 Data Integrator Version 11.1.1.9.0 Data Integrator Version 12.1.3.0.0 Data Integrator Version 12.2.1.0.0 WebCenter Content Version 11.1.1.9.0 WebCenter Content Version 12.2.1.1.0 WebCenter Content Version 12.2.1.2.0 Outside In Technology Version 8.5.3.0 WebLogic Server Version 10.3.6.0 WebLogic Server Version 12.1.3.0 WebLogic Server Version 12.2.1.1 WebLogic Server Version 12.2.1.2 Service Bus Version 11.1.1.9.0 Enterprise Repository Version 11.1.1.7.0 Enterprise Repository Version 12.1.3.0.0 Tuxedo Version 12.1.1 Tuxedo System and Applications Monitor (TSAM) Version 11.1.1.2.0 Tuxedo System and Applications Monitor (TSAM) Version 11.1.1.2.1 Tuxedo System and Applications Monitor (TSAM) Version 11.1.1.2.2 Tuxedo System and Applications Monitor (TSAM) Version 12.1.1.1.0 Tuxedo System and Applications Monitor (TSAM) Version 12.1.3.0.0 Tuxedo System and Applications Monitor (TSAM) Version 12.2.2.0.0 OpenSSO Version 3.0.0.8 API Gateway Version 11.1.2.4.0 Traffic Director Version 11.1.1.7.0 Traffic Director Version 11.1.1.9.0 Enterprise Data Quality Version 8.1.13.0.0 Endeca Server Version 7.3.0.0 Endeca Server Version 7.4.0.0 Endeca Server Version 7.5.0.0 Endeca Server Version 7.5.1.0 Endeca Server Version 7.6.0.0 Endeca Server Version 7.6.1.0 Endeca Server Version 7.7.0.0 Hospitality OPERA 5 Property Services Version 5.4.0.x Hospitality OPERA 5 Property Services Version 5.4.1.x Hospitality OPERA 5 Property Services Version 5.4.3.x Hospitality Simphony First Edition Version 1.7.1 Hospitality Suites Management Version 3.7 Hospitality Simphony First Edition Venue Management Version 3.9 Hospitality Simphony Version 2.8 Hospitality Simphony Version 2.9 Hospitality 9700 Version 4.0 Hospitality RES 3700 Version 5.5 Hospitality e7 Version 4.2.1 Hospitality Reporting and Analytics Version 8.5.1 Hospitality Reporting and Analytics Version 9.0.0 Hospitality Inventory Management Version 8.5.1 Hospitality Inventory Management Version 9.0.0 Hospitality Cruise Materials Management Version 7.30.562 Hospitality Cruise Dining Room Management Version 8.0.75 Hospitality Cruise Shipboard Property Management System Version 8.0.0.0 Hospitality Cruise Fleet Management Version 9.0 Hospitality Cruise AffairWhere Version 2.2.05.062 MICROS Workstation 6 Version Prior to E1500n MICROS PC Workstation 2015 Version Prior to O1302h Hospitality Materials Control Version 8.31.4 Hospitality Materials Control Version 8.32.0 MICROS BellaVita Version 2.7.x Hospitality Guest Access Version 4.2.0.0 Hospitality Guest Access Version 4.2.1.0 Hospitality Suite8 Version 8.10.x Hospitality Suite8 Property Interfaces Version 8.10.x Hospitality WebSuite8 Cloud Service Version 8.10.x Hospitality WebSuite8 Cloud Service Version 8.9.6 Hospitality Hotel Mobile Version 1.01 Hospitality Hotel Mobile Version 1.05 Hospitality Hotel Mobile Version 1.1 Payment Interface Version 6.1.1 Hyperion Essbase Version 12.2.1.1 Java Version 7u141 Java Version 8u131 Java Version 8u131; Java SE Embedded: 8u131 Java Version 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Java Version Java Advanced Management Console: 2.6 Java Version Java SE: 6u151 Java Version Java SE: 7u141 Java Version Java SE: 8u131 Java Version Java SE: 8u131; Java SE Embedded: 8u131 MySQL Server Version 5.5.56 and earlier MySQL Server Version 5.6.35 and earlier MySQL Server Version 5.6.36 and earlier MySQL Server Version 5.7.16 and earlier MySQL Server Version 5.7.17 and earlier MySQL Server Version 5.7.18 and earlier MySQL Cluster Version 7.3.5 and earlier MySQL Enterprise Monitor Version 3.1.5.7958 and earlier MySQL Enterprise Monitor Version 3.2.5.1141 and earlier MySQL Enterprise Monitor Version 3.2.7.1204 and earlier MySQL Enterprise Monitor Version 3.3.2.1162 and earlier MySQL Enterprise Monitor Version 3.3.3.1199 and earlier MySQL Connectors Version 5.3.7 and earlier MySQL Connectors Version 6.1.10 and earlier PeopleSoft Enterprise FIN Staffing Front Office Version 9.2 PeopleSoft Enterprise PT PeopleTools Version 8.54 PeopleSoft Enterprise PT PeopleTools Version 8.55 PeopleSoft Enterprise PRTL Interaction Hub Version 9.1.0 PeopleSoft Enterprise SCM eProcurement Version 9.2 PeopleSoft Enterprise SCM Strategic Sourcing Version 9.2 Policy Automation Version 12.1.0 Policy Automation Version 12.1.1 Policy Automation Version 12.2.0 Policy Automation Version 12.2.1 Policy Automation Version 12.2.2 Policy Automation Version 12.2.3 REST Data Services Version Prior to 3.0.10.25.02.36 Retail Allocation Version 13.3.1 Retail Allocation Version 14.0.4 Retail Allocation Version 14.1.3 Retail Allocation Version 15.0.1 Retail Allocation Version 16.0.1 Retail Warehouse Management System Version 14.0.4 Retail Warehouse Management System Version 14.1.3 Retail Warehouse Management System Version 15.0.1 Retail Workforce Management Version 1.60.7 Retail Workforce Management Version 1.64.0 Retail Customer Insights Version 15.0 Retail Customer Insights Version 16.0 Retail Xstore Point of Service Version 15.0.x Retail Xstore Point of Service Version 16.0.0 Retail Xstore Point of Service Version 6.0.x Retail Xstore Point of Service Version 6.5.x Retail Xstore Point of Service Version 7.0.x Retail Xstore Point of Service Version 7.1.x Retail Open Commerce Platform Cloud Service Version 15.0 Retail Open Commerce Platform Cloud Service Version 15.1 Retail Open Commerce Platform Cloud Service Version 5.0 Retail Open Commerce Platform Cloud Service Version 5.1 Retail Open Commerce Platform Cloud Service Version 5.2 Retail Open Commerce Platform Cloud Service Version 5.3 Retail Open Commerce Platform Cloud Service Version 6.0 Retail Open Commerce Platform Cloud Service Version 6.1 Siebel Core - Server Framework Version 16.0 Siebel Core - Server Framework Version 17.0 Solaris Cluster Version 4 Solaris Operating System Version 10 Solaris Operating System Version 11 Sun ZFS Storage Appliance Kit (AK) Software Version AK 2013 Transportation Management Version 6.1 Transportation Management Version 6.2 Transportation Management Version 6.3.4.1 Transportation Management Version 6.3.5.1 Transportation Management Version 6.3.6.1 Transportation Management Version 6.3.7.1 Transportation Management Version 6.4.0 Transportation Management Version 6.4.1 Transportation Management Version 6.4.2 Agile Product Governance and Compliance Version 9.3.5 Agile Product Governance and Compliance Version 9.3.6 Agile PLM Framework Version 9.3.5 Agile PLM Framework Version 9.3.6 OSS Support Tools Version Prior to 8.16 VM VirtualBox Version Prior to 5.1.24 iLearning Version 6.2 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLST). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2013-2027 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 5.9 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: CLSTCONF (Python)). Supported versions that are affected are 7.3.5 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.0 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2014-1912 P-8479V-7.3.5 and earlier 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8479V-7.3.5 and earlier Vulnerability in the Oracle Endeca Server component of Oracle Fusion Middleware (subcomponent: Core (OpenSSL)). Supported versions that are affected are 7.4.0.0, 7.5.0.0, 7.5.1.0, 7.6.0.0 and 7.6.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Endeca Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Endeca Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Endeca Server accessible data. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Fix has been released CVE-2014-3566 P-10217V-7.4.0.0 P-10217V-7.5.0.0 P-10217V-7.5.1.0 P-10217V-7.6.0.0 P-10217V-7.6.1.0 3.4 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10217V-7.4.0.0 P-10217V-7.5.0.0 P-10217V-7.5.1.0 P-10217V-7.6.0.0 P-10217V-7.6.1.0 Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Platform (GlibC)). The supported version that is affected is 11.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management. Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-0235 P-10900V-11.5 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10900V-11.5 Vulnerability in the Primavera Gateway component of Oracle Construction and Engineering Suite (subcomponent: Primavera Integration (Standard)). Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Gateway accessible data as well as unauthorized read access to a subset of Primavera Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Gateway. CVSS 3.0 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Fix has been released CVE-2015-0254 P-10605V-1.0 P-10605V-1.1 P-10605V-14.2 P-10605V-15.1 P-10605V-15.2 P-10605V-16.1 P-10605V-16.2 6.5 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10605V-1.0 P-10605V-1.1 P-10605V-14.2 P-10605V-15.1 P-10605V-15.2 P-10605V-16.1 P-10605V-16.2 Vulnerability in the Oracle Communications BRM component of Oracle Communications Applications (subcomponent: Elastic Charging Engine (Apache Groovy)). Supported versions that are affected are 11.2.0.0.0 and 11.3.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications BRM. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-9742V-11.2.0.0.0 P-9742V-11.3.0.0.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9742V-11.2.0.0.0 P-9742V-11.3.0.0.0 Vulnerability in the Oracle Enterprise Data Quality component of Oracle Fusion Middleware (subcomponent: General (Apache Groovy)). The supported version that is affected is 8.1.13.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Data Quality. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Data Quality. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-9464V-8.1.13.0.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9464V-8.1.13.0.0 Vulnerability in the Oracle Enterprise Repository component of Oracle Fusion Middleware (subcomponent: Security Subsystem (Apache ActiveMQ)). Supported versions that are affected are 11.1.1.7.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Repository. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Repository. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-5254 P-5326V-11.1.1.7.0 P-5326V-12.1.3.0.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5326V-11.1.1.7.0 P-5326V-12.1.3.0.0 Vulnerability in the Oracle Communications BRM component of Oracle Communications Applications (subcomponent: Elastic Charging Engine (Apache Commons Collections)). The supported version that is affected is 11.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications BRM. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9742V-11.2.0.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9742V-11.2.0.0.0 Vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware (subcomponent: Studio). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-2196V-11.1.1.7.0 P-2196V-11.1.1.9.0 P-2196V-12.1.3.0.0 P-2196V-12.2.1.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-2196V-11.1.1.7.0 P-2196V-11.1.1.9.0 P-2196V-12.1.3.0.0 P-2196V-12.2.1.0.0 Vulnerability in the Oracle Endeca Server component of Oracle Fusion Middleware (subcomponent: Core (Apache Commons Collections)). Supported versions that are affected are 7.6.0.0 and 7.6.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Endeca Server. Successful attacks of this vulnerability can result in takeover of Oracle Endeca Server. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-10217V-7.6.0.0 P-10217V-7.6.1.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10217V-7.6.0.0 P-10217V-7.6.1.0 Vulnerability in the Oracle Enterprise Data Quality component of Oracle Fusion Middleware (subcomponent: General (Apache Commons Fileupload)). The supported version that is affected is 8.1.13.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Data Quality. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Data Quality. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9464V-8.1.13.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9464V-8.1.13.0.0 Vulnerability in the Oracle Enterprise Repository component of Oracle Fusion Middleware (subcomponent: Security). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Repository. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Repository. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-5326V-12.1.3.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5326V-12.1.3.0.0 Vulnerability in the Oracle Tuxedo System and Applications Monitor component of Oracle Fusion Middleware (subcomponent: General (Apache Commons Collections)). Supported versions that are affected are 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Tuxedo System and Applications Monitor. Successful attacks of this vulnerability can result in takeover of Oracle Tuxedo System and Applications Monitor. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-5436V-11.1.1.2.0 P-5436V-11.1.1.2.1 P-5436V-11.1.1.2.2 P-5436V-12.1.1.1.0 P-5436V-12.1.3.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5436V-11.1.1.2.0 P-5436V-11.1.1.2.1 P-5436V-11.1.1.2.2 P-5436V-12.1.1.1.0 P-5436V-12.1.3.0.0 Vulnerability in the Oracle Business Transaction Management component of Oracle Enterprise Manager Products Suite (subcomponent: Security). Supported versions that are affected are 11.1.x and 12.1.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Transaction Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Transaction Management accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-8564V-11.1.x P-8564V-12.1.x 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8564V-11.1.x P-8564V-12.1.x Vulnerability in the Oracle Communications Convergence component of Oracle Communications Applications (subcomponent: Mail Proxy (Bouncy Castle)). Supported versions that are affected are 3.0 and 3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Convergence accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-8501V-3.0 P-8501V-3.0.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8501V-3.0 P-8501V-3.0.1 Vulnerability in the Oracle Enterprise Repository component of Oracle Fusion Middleware (subcomponent: Security Subsystem (Bouncy Castle)). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Repository. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Repository accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-5326V-12.1.3.0.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5326V-12.1.3.0.0 Vulnerability in the Oracle Secure Enterprise Search component of Oracle Fusion Middleware (subcomponent: Generic (Bouncy Castle)). The supported version that is affected is 11.2.2.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Secure Enterprise Search. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Secure Enterprise Search accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-1737V-11.2.2.2.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1737V-11.2.2.2.0 Vulnerability in the Oracle Communications BRM component of Oracle Communications Applications (subcomponent: Elastic Charging Engine (Spring)). Supported versions that are affected are 11.2.0.0.0 and 11.3.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications BRM. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-9742V-11.2.0.0.0 P-9742V-11.3.0.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9742V-11.2.0.0.0 P-9742V-11.3.0.0.0 Vulnerability in the Oracle Enterprise Repository component of Oracle Fusion Middleware (subcomponent: Security Subsystem). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Repository. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Repository. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-5326V-12.1.3.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5326V-12.1.3.0.0 Vulnerability in the Financial Services Behavior Detection Platform component of Oracle Financial Services Applications (subcomponent: Admin Tool (Spring)). Supported versions that are affected are 8.0.1 and 8.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Financial Services Behavior Detection Platform. Successful attacks of this vulnerability can result in takeover of Financial Services Behavior Detection Platform. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-9190V-8.0.1 P-9190V-8.0.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9190V-8.0.1 P-9190V-8.0.2 Vulnerability in the Hyperion Essbase component of Oracle Hyperion (subcomponent: Java Based Agent (Spring)). The supported version that is affected is 12.2.1.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Hyperion Essbase. Successful attacks of this vulnerability can result in takeover of Hyperion Essbase. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-4379V-12.2.1.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4379V-12.2.1.1 Vulnerability in the Oracle Tuxedo System and Applications Monitor component of Oracle Fusion Middleware (subcomponent: General (Spring)). Supported versions that are affected are 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0, 12.1.3.0.0 and 12.2.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Tuxedo System and Applications Monitor. Successful attacks of this vulnerability can result in takeover of Oracle Tuxedo System and Applications Monitor. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-5436V-11.1.1.2.0 P-5436V-11.1.1.2.1 P-5436V-11.1.1.2.2 P-5436V-12.1.1.1.0 P-5436V-12.1.3.0.0 P-5436V-12.2.2.0.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5436V-11.1.1.2.0 P-5436V-11.1.1.2.1 P-5436V-11.1.1.2.2 P-5436V-12.1.1.1.0 P-5436V-12.1.3.0.0 P-5436V-12.2.2.0.0 Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Installation). Supported versions that are affected are 12.5.0.2 and 12.5.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-1181 P-4622V-12.5.0.2 P-4622V-12.5.0.3 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4622V-12.5.0.2 P-4622V-12.5.0.3 Vulnerability in the Oracle Communications EAGLE LNP Application Processor component of Oracle Communications Applications (subcomponent: Platform (OpenSSL)). The supported version that is affected is 10.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications EAGLE LNP Application Processor. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications EAGLE LNP Application Processor accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-2107 P-11118V-10.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11118V-10.0 Vulnerability in the Oracle Communications Session Router component of Oracle Communications Applications (subcomponent: Routing (OpenSSL)). Supported versions that are affected are SCZ730, SCZ740 and ECZ730. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Session Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Session Router and unauthorized read access to a subset of Oracle Communications Session Router accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-10752V-SCZ730 P-10752V-SCZ740 P-10752V-ECZ730 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10752V-SCZ730 P-10752V-SCZ740 P-10752V-ECZ730 Vulnerability in the Oracle Enterprise Communications Broker component of Oracle Communications Applications (subcomponent: Routing (OpenSSL)). The supported version that is affected is PCZ210. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Enterprise Communications Broker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Communications Broker and unauthorized read access to a subset of Oracle Enterprise Communications Broker accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-10758V-PCZ210 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10758V-PCZ210 Vulnerability in the Real Application Clusters component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Real Application Clusters. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Real Application Clusters accessible data as well as unauthorized access to critical data or complete access to all Real Application Clusters accessible data. CVSS 3.0 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-2183 P-5V-11.2.0.4 P-5V-12.1.0.2 6.8 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5V-11.2.0.4 P-5V-12.1.0.2 Vulnerability in the Oracle Configuration Manager component of Oracle Enterprise Manager Products Suite (subcomponent: Installation). The supported version that is affected is Prior to 12.1.2.0.4. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Configuration Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Configuration Manager accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2016-2381 P-1967V-Prior to 12.1.2.0.4 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1967V-Prior to 12.1.2.0.4 Vulnerability in the Oracle OpenSSO component of Oracle Fusion Middleware (subcomponent: Web Agents (NSS)). The supported version that is affected is 3.0.0.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle OpenSSO. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle OpenSSO. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-2834 P-8520V-3.0.0.8 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8520V-3.0.0.8 Vulnerability in the Oracle Traffic Director component of Oracle Fusion Middleware (subcomponent: Security (NSS)). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Traffic Director. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Traffic Director. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-2834 P-9276V-11.1.1.7.0 P-9276V-11.1.1.9.0 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9276V-11.1.1.7.0 P-9276V-11.1.1.9.0 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server (Apache Commons Fileupload)). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of BI Publisher. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-1479V-11.1.1.9.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.9.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 Vulnerability in the Oracle Banking Platform component of Oracle Financial Services Applications (subcomponent: Collections (Apache Commons FileUpload)). Supported versions that are affected are 2.3, 2.4, 2.4.1 and 2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking Platform. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-9178V-2.3 P-9178V-2.4 P-9178V-2.4.1 P-9178V-2.5 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9178V-2.3 P-9178V-2.4 P-9178V-2.4.1 P-9178V-2.5 Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Hosted Framework). Supported versions that are affected are 12.2.2 and 12.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Ops Center. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Enterprise Manager Ops Center. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2016-3092 P-9835V-12.2.2 P-9835V-12.3.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9835V-12.2.2 P-9835V-12.3.2 Vulnerability in the Oracle Policy Automation component of Oracle Policy Automation (subcomponent: Determinations Engine (Apache Commons FileUplaod)). Supported versions that are affected are 12.1.0, 12.1.1, 12.2.0, 12.2.1, 12.2.2 and 12.2.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Policy Automation. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Policy Automation. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-5624V-12.1.0 P-5624V-12.1.1 P-5624V-12.2.0 P-5624V-12.2.1 P-5624V-12.2.2 P-5624V-12.2.3 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5624V-12.1.0 P-5624V-12.1.1 P-5624V-12.2.0 P-5624V-12.2.1 P-5624V-12.2.2 P-5624V-12.2.3 Vulnerability in the Oracle REST Data Services component of Oracle REST Data Services. The supported version that is affected is Prior to 3.0.10.25.02.36. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle REST Data Services. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-9456V-Prior to 3.0.10.25.02.36 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9456V-Prior to 3.0.10.25.02.36 Vulnerability in the Oracle Retail Warehouse Management System component of Oracle Retail Applications (subcomponent: Installers). Supported versions that are affected are 14.0.4, 14.1.3 and 15.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Warehouse Management System. Successful attacks of this vulnerability can result in takeover of Oracle Retail Warehouse Management System. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1847V-14.0.4 P-1847V-14.1.3 P-1847V-15.0.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1847V-14.0.4 P-1847V-14.1.3 P-1847V-15.0.1 Vulnerability in the Oracle Retail Workforce Management component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 1.60.7 and 1.64.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Workforce Management. Successful attacks of this vulnerability can result in takeover of Oracle Retail Workforce Management. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-2019V-1.60.7 P-2019V-1.64.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-2019V-1.60.7 P-2019V-1.64.0 Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitor: General (Apache Struts 2)). Supported versions that are affected are 3.1.5.7958 and earlier, 3.2.5.1141 and earlier, 3.3.2.1162 and earlier and . Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP over TLS to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-4436 P-8480V-3.1.5.7958 and earlier P-8480V-3.2.5.1141 and earlier P-8480V-3.3.2.1162 and earlier 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8480V-3.1.5.7958 and earlier P-8480V-3.2.5.1141 and earlier P-8480V-3.3.2.1162 and earlier Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access (Apache Trinidad)). Supported versions that are affected are 8.3, 8.4, 15.1 and 15.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in takeover of Primavera P6 Enterprise Project Portfolio Management. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5019 P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Satellite Framework). Supported versions that are affected are 12.2.2 and 12.3.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops Center. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5387 P-9835V-12.2.2 P-9835V-12.3.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9835V-12.2.2 P-9835V-12.3.2 Vulnerability in the Application Server component of Oracle E-Business Suite (subcomponent: OpenSSL). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Application Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Application Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-1745V-12.1.3 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1745V-12.1.3 Vulnerability in the Oracle Enterprise Session Border Controller component of Oracle Communications Applications (subcomponent: Routing (OpenSSL)). The supported version that is affected is ECZ7.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Session Border Controller. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-10757V-ECZ7.3.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10757V-ECZ7.3.0 Vulnerability in the Primavera Gateway component of Oracle Construction and Engineering Suite (subcomponent: Primavera Integration (Groovy)). Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Primavera Gateway. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-10605V-1.0 P-10605V-1.1 P-10605V-14.2 P-10605V-15.1 P-10605V-15.2 P-10605V-16.1 P-10605V-16.2 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10605V-1.0 P-10605V-1.1 P-10605V-14.2 P-10605V-15.1 P-10605V-15.2 P-10605V-16.1 P-10605V-16.2 Vulnerability in the Oracle Retail Allocation component of Oracle Retail Applications (subcomponent: Manage Allocation). Supported versions that are affected are 13.3.1, 14.0.4, 14.1.3, 15.0.1 and 16.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Allocation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Allocation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Retail Allocation. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-1786V-13.3.1 P-1786V-14.0.4 P-1786V-14.1.3 P-1786V-15.0.1 P-1786V-16.0.1 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1786V-13.3.1 P-1786V-14.0.4 P-1786V-14.1.3 P-1786V-15.0.1 P-1786V-16.0.1 Vulnerability in the Oracle Retail Customer Insights component of Oracle Retail Applications (subcomponent: ODI Configuration). Supported versions that are affected are 15.0 and 16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Customer Insights. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Customer Insights, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Insights. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-10263V-15.0 P-10263V-16.0 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10263V-15.0 P-10263V-16.0 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. While the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Fix has been released CVE-2017-10000 P-11599V-8.5.1 P-11599V-9.0.0 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Core). The supported version that is affected is 1.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony First Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony First Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Simphony First Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony First Edition. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H). Fix has been released CVE-2017-10001 P-11591V-1.7.1 7.6 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11591V-1.7.1 Vulnerability in the Oracle Hospitality Inventory Management component of Oracle Hospitality Applications (subcomponent: Settings and Config). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Inventory Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Inventory Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Inventory Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10002 P-11602V-8.5.1 P-11602V-9.0.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11602V-8.5.1 P-11602V-9.0.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Network Services Library). The supported version that is affected is 10. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 4.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-10003 P-10006V-10 4.5 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10006V-10 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-10004 P-10006V-10 P-10006V-11 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10006V-10 P-10006V-11 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10005 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-10006 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10007 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10008 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10009 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: FileUploads). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10010 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle FLEXCUBE Private Banking executes to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10011 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10012 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: User Interface). The supported version that is affected is AK 2013. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10013 P-10026V-AK 2013 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10026V-AK 2013 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Application Designer). Supported versions that are affected are 8.54 and 8.55. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10015 P-5085V-8.54 P-5085V-8.55 4.7 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: User Interface). The supported version that is affected is AK 2013. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-10016 P-10026V-AK 2013 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10026V-AK 2013 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Workcenter). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10017 P-5085V-8.54 P-5085V-8.55 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10018 P-5136V-9.2 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5136V-9.2 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). Fix has been released CVE-2017-10019 P-5085V-8.54 P-5085V-8.55 7.4 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Updates Change Assistant). Supported versions that are affected are 8.54 and 8.55. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10020 P-5085V-8.54 P-5085V-8.55 4.7 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Search). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10021 P-5085V-8.54 P-5085V-8.55 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10022 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10023 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Layout Tools). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10024 P-1479V-11.1.1.7.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-10025 P-1479V-11.1.1.7.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Homepage & Navigation). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10027 P-5085V-8.54 P-5085V-8.55 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10028 P-1479V-11.1.1.7.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10029 P-1479V-11.1.1.7.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10030 P-1479V-11.1.1.7.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 Vulnerability in the Oracle Communications Convergence component of Oracle Communications Applications (subcomponent: Mail Proxy (dojo)). Supported versions that are affected are 3.0 and 3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Convergence. While the vulnerability is in Oracle Communications Convergence, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Convergence accessible data as well as unauthorized read access to a subset of Oracle Communications Convergence accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10031 P-8501V-3.0 P-8501V-3.0.1 7.2 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8501V-3.0 P-8501V-3.0.1 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Access Control List). Supported versions that are affected are 6.3.4.1, 6.3.5.1, 6.3.6.1, 6.3.7.1, 6.4.0, 6.4.1 and 6.4.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Transportation Management accessible data as well as unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10032 P-1991V-6.3.4.1 P-1991V-6.3.5.1 P-1991V-6.3.6.1 P-1991V-6.3.7.1 P-1991V-6.4.0 P-1991V-6.4.1 P-1991V-6.4.2 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1991V-6.3.4.1 P-1991V-6.3.5.1 P-1991V-6.3.6.1 P-1991V-6.3.7.1 P-1991V-6.4.0 P-1991V-6.4.1 P-1991V-6.4.2 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10035 P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: NFSv4). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via NFSv4 to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10036 P-10006V-10 P-10006V-11 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10006V-10 P-10006V-11 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10038 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Web Client). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N). Fix has been released CVE-2017-10039 P-4430V-9.3.5 P-4430V-9.3.6 6.8 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4430V-9.3.5 P-4430V-9.3.6 Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.9.0 and 12.2.1.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N). Fix has been released CVE-2017-10040 P-2271V-11.1.1.9.0 P-2271V-12.2.1.1.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-2271V-11.1.1.9.0 P-2271V-12.2.1.1.0 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10041 P-1479V-11.1.1.9.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 7.6 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.9.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: IKE). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via IKE to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10042 P-10006V-10 P-10006V-11 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10006V-10 P-10006V-11 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10043 P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10044 P-11599V-8.5.1 P-11599V-9.0.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10045 P-5085V-8.54 P-5085V-8.55 5.3 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2 and 16.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10046 P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 Vulnerability in the MICROS BellaVita component of Oracle Hospitality Applications (subcomponent: Interface). The supported version that is affected is 2.7.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS BellaVita. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MICROS BellaVita accessible data as well as unauthorized read access to a subset of MICROS BellaVita accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10047 P-12614V-2.7.x 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12614V-2.7.x Vulnerability in the Oracle Enterprise Repository component of Oracle Fusion Middleware (subcomponent: Web Interface). Supported versions that are affected are 11.1.1.7.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Repository. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Repository, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Repository accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Repository accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10048 P-5326V-11.1.1.7.0 P-5326V-12.1.3.0.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5326V-11.1.1.7.0 P-5326V-12.1.3.0.0 Vulnerability in the Siebel Core CRM component of Oracle Siebel CRM (subcomponent: Search). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Core CRM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Core CRM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Core CRM accessible data as well as unauthorized read access to a subset of Siebel Core CRM accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10049 P-9001V-16.0 P-9001V-17.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9001V-16.0 P-9001V-17.0 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: PCMServlet). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10052 P-4461V-9.3.5 P-4461V-9.3.6 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10053 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Oracle Hospitality 9700 component of Oracle Hospitality Applications (subcomponent: Property Management Systems). The supported version that is affected is 4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality 9700 executes to compromise Oracle Hospitality 9700. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality 9700 accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10056 P-11595V-4.0 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11595V-4.0 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Discussion Forum). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10057 P-5090V-9.1.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web Administration). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N). Fix has been released CVE-2017-10058 P-2025V-11.1.1.9.0 P-2025V-12.2.1.1.0 P-2025V-12.2.1.2.0 6.9 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-2025V-11.1.1.9.0 P-2025V-12.2.1.1.0 P-2025V-12.2.1.2.0 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Mobile Service). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10059 P-1479V-11.1.1.7.0 7.6 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10061 P-5085V-8.54 P-5085V-8.55 8.3 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Oracle Java Web Console). The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-10062 P-10006V-10 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10006V-10 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2017-10063 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the Hospitality WebSuite8 Cloud Service component of Oracle Hospitality Applications (subcomponent: General). Supported versions that are affected are 8.9.6 and 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hospitality WebSuite8 Cloud Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hospitality WebSuite8 Cloud Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hospitality WebSuite8 Cloud Service accessible data as well as unauthorized read access to a subset of Hospitality WebSuite8 Cloud Service accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10064 P-12731V-8.9.6 P-12731V-8.10.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12731V-8.9.6 P-12731V-8.10.x Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-10067 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131 Vulnerability in the Oracle Payment Interface component of Oracle Hospitality Applications (subcomponent: Core). The supported version that is affected is 6.1.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payment Interface. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payment Interface accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10069 P-13173V-6.1.1 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-13173V-6.1.1 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Maintenance Folders). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10070 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: All Modules). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10071 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: All Modules). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10072 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10073 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10074 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10075 P-2271V-11.1.1.9.0 P-2271V-12.2.1.1.0 P-2271V-12.2.1.2.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-2271V-11.1.1.9.0 P-2271V-12.2.1.1.0 P-2271V-12.2.1.2.0 Vulnerability in the Oracle Hospitality Simphony First Edition Venue Management component of Oracle Hospitality Applications (subcomponent: Core). The supported version that is affected is 3.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony First Edition Venue Management. While the vulnerability is in Oracle Hospitality Simphony First Edition Venue Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Simphony First Edition Venue Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Simphony First Edition Venue Management accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10076 P-11593V-3.9 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11593V-3.9 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-10078 P-856V-Java SE: 8u131 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 8u131 Vulnerability in the Oracle Hospitality Suites Management component of Oracle Hospitality Applications (subcomponent: Core). The supported version that is affected is 3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Suites Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Suites Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Suites Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Suites Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10079 P-11592V-3.7 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11592V-3.7 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10080 P-4461V-9.3.5 P-4461V-9.3.6 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10081 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10082 P-4461V-9.3.5 P-4461V-9.3.6 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10083 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Report Generator). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10084 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-10085 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10086 P-856V-Java SE: 7u141 P-856V-8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 7u141 P-856V-8u131 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10087 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 3.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10088 P-4461V-9.3.5 P-4461V-9.3.6 3.4 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10089 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10090 P-856V-Java SE: 7u141 P-856V-8u131; Java SE Embedded: 8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponent: UI Framework). Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. While the vulnerability is in Enterprise Manager Base Platform, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Enterprise Manager Base Platform accessible data. CVSS 3.0 Base Score 7.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N). Fix has been released CVE-2017-10091 P-1370V-12.1.0 P-1370V-13.1.0 P-1370V-13.2.0 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1370V-12.1.0 P-1370V-13.1.0 P-1370V-13.2.0 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10092 P-4461V-9.3.5 P-4461V-9.3.6 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10093 P-4461V-9.3.5 P-4461V-9.3.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10094 P-4461V-9.3.5 P-4461V-9.3.6 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10095 P-10006V-11 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10006V-11 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10096 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10097 P-11599V-8.5.1 P-11599V-9.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10098 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: HTML Area). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10100 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10101 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10102 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10103 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0 P-9110V-12.0.1 Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Java Advanced Management Console. While the vulnerability is in Java Advanced Management Console, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java Advanced Management Console accessible data as well as unauthorized read access to a subset of Java Advanced Management Console accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java Advanced Management Console. CVSS 3.0 Base Score 7.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10104 P-856V-Java Advanced Management Console: 2.6 7.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java Advanced Management Console: 2.6 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10105 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10106 P-5085V-8.54 P-5085V-8.55 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10107 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10108 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10109 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10110 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE: 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10111 P-856V-Java SE: 8u131; Java SE Embedded: 8u131 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 8u131; Java SE Embedded: 8u131 Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Registration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10112 P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: CRM User Management Framework). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data as well as unauthorized update, insert or delete access to some of Oracle Common Applications accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10113 P-1198V-12.1.3 P-1198V-12.2.3 P-1198V-12.2.4 P-1198V-12.2.5 P-1198V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1198V-12.1.3 P-1198V-12.2.3 P-1198V-12.2.4 P-1198V-12.2.5 P-1198V-12.2.6 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10114 P-856V-Java SE: 7u141 P-856V-8u131 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 7u141 P-856V-8u131 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10115 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10116 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java Advanced Management Console. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java Advanced Management Console accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10117 P-856V-Java Advanced Management Console: 2.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java Advanced Management Console: 2.6 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10118 P-856V-Java SE: 7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: OSB Web Console Design, Admin). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Service Bus, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Service Bus accessible data as well as unauthorized update, insert or delete access to some of Oracle Service Bus accessible data. CVSS 3.0 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10119 P-5308V-11.1.1.9.0 7.6 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5308V-11.1.1.9.0 Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Difficult to exploit vulnerability allows high privileged attacker having Create Session, Select Any Dictionary privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS Security accessible data. CVSS 3.0 Base Score 1.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10120 P-5V-12.1.0.2 1.9 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5V-12.1.0.2 Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java Advanced Management Console. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java Advanced Management Console, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java Advanced Management Console accessible data as well as unauthorized read access to a subset of Java Advanced Management Console accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10121 P-856V-Java Advanced Management Console: 2.6 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java Advanced Management Console: 2.6 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data. CVSS 3.0 Base Score 1.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10122 P-10006V-10 P-10006V-11 1.8 AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10006V-10 P-10006V-11 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). The supported version that is affected is 12.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10123 P-5242V-12.1.3.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5242V-12.1.3.0 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 7u141 and 8u131. Difficult to exploit vulnerability allows physical access to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: Applies to deployment of Java where the Java Auto Update is enabled. CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10125 P-856V-Java SE: 7u141 P-856V-8u131 7.1 AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 7u141 P-856V-8u131 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: HTML Area). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10126 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the Hospitality WebSuite8 Cloud Service component of Oracle Hospitality Applications (subcomponent: General). Supported versions that are affected are 8.9.6 and 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hospitality WebSuite8 Cloud Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hospitality WebSuite8 Cloud Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hospitality WebSuite8 Cloud Service accessible data as well as unauthorized read access to a subset of Hospitality WebSuite8 Cloud Service accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10128 P-12731V-8.9.6 P-12731V-8.10.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12731V-8.9.6 P-12731V-8.10.x Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10129 P-8370V-Prior to 5.1.24 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Management). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10130 P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 7.6 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera P6 Enterprise Project Portfolio Management. CVSS 3.0 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10131 P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 6.5 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 Vulnerability in the Hospitality Hotel Mobile component of Oracle Hospitality Applications (subcomponent: Suite8/iOS). The supported version that is affected is 1.05. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality Hotel Mobile. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hospitality Hotel Mobile accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10132 P-13023V-1.05 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-13023V-1.05 Vulnerability in the Hospitality Hotel Mobile component of Oracle Hospitality Applications (subcomponent: Suite8/RestAPI). The supported version that is affected is 1.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality Hotel Mobile. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hospitality Hotel Mobile accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10133 P-13023V-1.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-13023V-1.1 Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: eProcurement). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise FSCM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FSCM accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10134 P-5118V-9.2 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5118V-9.2 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10135 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Import/Export). The supported version that is affected is 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10136 P-11594V-2.9 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11594V-2.9 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JNDI). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10137 P-5242V-10.3.6.0 P-5242V-12.1.3.0 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.0 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2017-10141 P-2276V-8.5.3.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-2276V-8.5.3.0 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Mobile Apps). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10142 P-11599V-8.5.1 P-11599V-9.0.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10143 P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: Oracle Diagnostics Interfaces). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Applications Manager. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10144 P-99V-12.1.3 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-99V-12.1.3 Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.6. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java Advanced Management Console. While the vulnerability is in Java Advanced Management Console, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java Advanced Management Console accessible data as well as unauthorized read access to a subset of Java Advanced Management Console accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java Advanced Management Console. CVSS 3.0 Base Score 7.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10145 P-856V-Java Advanced Management Console: 2.6 7.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java Advanced Management Console: 2.6 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10146 P-5085V-8.54 P-5085V-8.55 8.3 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 8.6 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). Fix has been released CVE-2017-10147 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N). Fix has been released CVE-2017-10148 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 5.8 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Platform). Supported versions that are affected are 9.13, 9.14, 10.1, 10.2, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10149 P-10354V-9.13 P-10354V-9.14 P-10354V-10.1 P-10354V-10.2 P-10354V-15.1 P-10354V-15.2 P-10354V-16.1 P-10354V-16.2 4.8 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10354V-9.13 P-10354V-9.14 P-10354V-10.1 P-10354V-10.2 P-10354V-15.1 P-10354V-15.2 P-10354V-16.1 P-10354V-16.2 Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Platform). Supported versions that are affected are 9.13, 9.14, 10.1, 10.2, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10150 P-10354V-9.13 P-10354V-9.14 P-10354V-10.1 P-10354V-10.2 P-10354V-15.1 P-10354V-15.2 P-10354V-16.1 P-10354V-16.2 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10354V-9.13 P-10354V-9.14 P-10354V-10.1 P-10354V-10.2 P-10354V-15.1 P-10354V-15.2 P-10354V-16.1 P-10354V-16.2 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10156 P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher accessible data as well as unauthorized read access to a subset of BI Publisher accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10157 P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10160 P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 Vulnerability in the Hospitality Hotel Mobile component of Oracle Hospitality Applications (subcomponent: Suite 8/Windows). The supported version that is affected is 1.1. Difficult to exploit vulnerability allows physical access to compromise Hospitality Hotel Mobile. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hospitality Hotel Mobile accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Hospitality Hotel Mobile. CVSS 3.0 Base Score 4.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L). Fix has been released CVE-2017-10168 P-13023V-1.1 4.6 AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-13023V-1.1 Vulnerability in the Oracle Hospitality 9700 component of Oracle Hospitality Applications (subcomponent: Operation Security). The supported version that is affected is 4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality 9700 executes to compromise Oracle Hospitality 9700. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality 9700 accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10169 P-11595V-4.0 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11595V-4.0 Vulnerability in the Oracle Field Service component of Oracle E-Business Suite (subcomponent: Wireless/WAP). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Field Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Field Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Field Service accessible data as well as unauthorized update, insert or delete access to some of Oracle Field Service accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10170 P-747V-12.1.1 P-747V-12.1.2 P-747V-12.1.3 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-747V-12.1.1 P-747V-12.1.2 P-747V-12.1.3 Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: Home Page). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10171 P-229V-12.1.1 P-229V-12.1.2 P-229V-12.1.3 P-229V-12.2.3 P-229V-12.2.4 P-229V-12.2.5 P-229V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-229V-12.1.1 P-229V-12.1.2 P-229V-12.1.3 P-229V-12.2.3 P-229V-12.2.4 P-229V-12.2.5 P-229V-12.2.6 Vulnerability in the Oracle Retail Open Commerce Platform component of Oracle Retail Applications (subcomponent: Framework). Supported versions that are affected are 5.0, 5.1, 5.2, 5.3, 6.0, 6.1, 15.0 and 15.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Open Commerce Platform, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Open Commerce Platform accessible data as well as unauthorized read access to a subset of Oracle Retail Open Commerce Platform accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10172 P-11521V-5.0 P-11521V-5.1 P-11521V-5.2 P-11521V-5.3 P-11521V-6.0 P-11521V-6.1 P-11521V-15.0 P-11521V-15.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11521V-5.0 P-11521V-5.1 P-11521V-5.2 P-11521V-5.3 P-11521V-6.0 P-11521V-6.1 P-11521V-15.0 P-11521V-15.1 Vulnerability in the Oracle Retail Open Commerce Platform component of Oracle Retail Applications (subcomponent: Website). Supported versions that are affected are 5.0, 5.1, 5.2, 5.3, 6.0, 6.1, 15.0 and 15.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. While the vulnerability is in Oracle Retail Open Commerce Platform, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Open Commerce Platform accessible data. CVSS 3.0 Base Score 5.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N). Fix has been released CVE-2017-10173 P-11521V-5.0 P-11521V-5.1 P-11521V-5.2 P-11521V-5.3 P-11521V-6.0 P-11521V-6.1 P-11521V-15.0 P-11521V-15.1 5.8 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11521V-5.0 P-11521V-5.1 P-11521V-5.2 P-11521V-5.3 P-11521V-6.0 P-11521V-6.1 P-11521V-15.0 P-11521V-15.1 Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Service Request). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data as well as unauthorized update, insert or delete access to some of Oracle iSupport accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10174 P-381V-12.1.1 P-381V-12.1.2 P-381V-12.1.3 P-381V-12.2.3 P-381V-12.2.4 P-381V-12.2.5 P-381V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-381V-12.1.1 P-381V-12.1.2 P-381V-12.1.3 P-381V-12.2.3 P-381V-12.2.4 P-381V-12.2.5 P-381V-12.2.6 Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Profiles). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupport accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10175 P-381V-12.1.1 P-381V-12.1.2 P-381V-12.1.3 P-381V-12.2.3 P-381V-12.2.4 P-381V-12.2.5 P-381V-12.2.6 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-381V-12.1.1 P-381V-12.1.2 P-381V-12.1.3 P-381V-12.2.3 P-381V-12.2.4 P-381V-12.2.5 P-381V-12.2.6 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10176 P-856V-Java SE: 7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Flexfields). The supported version that is affected is 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-10177 P-510V-12.2.6 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-510V-12.2.6 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10178 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring). Supported versions that are affected are AMP 12.1.0.4.0 and AMP 13.1.1.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Management Pack for Oracle E-Business Suite accessible data as well as unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10179 P-2294V-AMP 12.1.0.4.0 P-2294V-AMP 13.1.1.1.0 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-2294V-AMP 12.1.0.4.0 P-2294V-AMP 13.1.1.1.0 Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: CMRO). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10180 P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Forgot Password). Supported versions that are affected are 12.0.2 and 12.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Direct Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Direct Banking as well as unauthorized update, insert or delete access to some of Oracle FLEXCUBE Direct Banking accessible data and unauthorized read access to a subset of Oracle FLEXCUBE Direct Banking accessible data. CVSS 3.0 Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H). Fix has been released CVE-2017-10181 P-9111V-12.0.2 P-9111V-12.0.3 6.8 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9111V-12.0.2 P-9111V-12.0.3 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Export Functionality). Supported versions that are affected are 5.4.0.x, 5.4.1.x and 5.4.3.x. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10182 P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.3.x 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.3.x Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Point of Sale). Supported versions that are affected are 6.0.x, 6.5.x, 7.0.x, 7.1.x, 15.0.x and 16.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. While the vulnerability is in Oracle Retail Xstore Point of Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Xstore Point of Service. CVSS 3.0 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10183 P-11513V-6.0.x P-11513V-6.5.x P-11513V-7.0.x P-11513V-7.1.x P-11513V-15.0.x P-11513V-16.0.0 6.5 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11513V-6.0.x P-11513V-6.5.x P-11513V-7.0.x P-11513V-7.1.x P-11513V-15.0.x P-11513V-16.0.0 Vulnerability in the Oracle Field Service component of Oracle E-Business Suite (subcomponent: Wireless/WAP). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Field Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Field Service accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10184 P-747V-12.1.1 P-747V-12.1.2 P-747V-12.1.3 P-747V-12.2.3 P-747V-12.2.4 P-747V-12.2.5 P-747V-12.2.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-747V-12.1.1 P-747V-12.1.2 P-747V-12.1.3 P-747V-12.2.3 P-747V-12.2.4 P-747V-12.2.5 P-747V-12.2.6 Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: User Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10185 P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User and Company Profile). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10186 P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 4.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L). Fix has been released CVE-2017-10187 P-8370V-Prior to 5.1.24 4.6 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Hospitality Hotel Mobile component of Oracle Hospitality Applications (subcomponent: Suite 8/Android). The supported version that is affected is 1.01. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Hospitality Hotel Mobile executes to compromise Hospitality Hotel Mobile. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hospitality Hotel Mobile accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10188 P-13023V-1.01 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-13023V-1.01 Vulnerability in the Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Hospitality Suite8 executes to compromise Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hospitality Suite8 accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10189 P-12619V-8.10.x 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12619V-8.10.x Vulnerability in the Oracle Web Analytics component of Oracle E-Business Suite (subcomponent: Common Libraries). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Web Analytics accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10191 P-1751V-12.1.1 P-1751V-12.1.2 P-1751V-12.1.3 P-1751V-12.2.3 P-1751V-12.2.4 P-1751V-12.2.5 P-1751V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1751V-12.1.1 P-1751V-12.1.2 P-1751V-12.1.3 P-1751V-12.2.3 P-1751V-12.2.4 P-1751V-12.2.5 P-1751V-12.2.6 Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Shopping Cart). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10192 P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10193 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Import/Export). The supported version that is affected is 2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10195 P-11594V-2.8 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11594V-2.8 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.0 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2017-10196 P-2276V-8.5.3.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-2276V-8.5.3.0 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2017-10198 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 6.8 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Oracle iLearning component of Oracle iLearning (subcomponent: Learner Pages). The supported version that is affected is 6.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iLearning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iLearning, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iLearning accessible data as well as unauthorized update, insert or delete access to some of Oracle iLearning accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10199 P-902V-6.2 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-902V-6.2 Vulnerability in the Oracle Hospitality e7 component of Oracle Hospitality Applications (subcomponent: Other). The supported version that is affected is 4.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality e7 executes to compromise Oracle Hospitality e7. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality e7 accessible data as well as unauthorized read access to a subset of Oracle Hospitality e7 accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10200 P-11598V-4.2.1 4.4 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11598V-4.2.1 Vulnerability in the Oracle Hospitality e7 component of Oracle Hospitality Applications (subcomponent: Other). The supported version that is affected is 4.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality e7 executes to compromise Oracle Hospitality e7. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality e7 accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10201 P-11598V-4.2.1 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11598V-4.2.1 Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise OJVM. While the vulnerability is in OJVM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of OJVM. Note: This score is for Windows platforms. On non-Windows platforms Scope is Unchanged, giving a CVSS Base Score of 8.8. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10202 P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10204 P-8370V-Prior to 5.1.24 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Enterprise Management Console). The supported version that is affected is 2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10205 P-11594V-2.9 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11594V-2.9 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Engagement). The supported version that is affected is 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data as well as unauthorized read access to a subset of Oracle Hospitality Simphony accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Simphony. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-10206 P-11594V-2.9 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11594V-2.9 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Utilities). The supported version that is affected is 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Simphony. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10207 P-11594V-2.9 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11594V-2.9 Vulnerability in the Oracle Hospitality e7 component of Oracle Hospitality Applications (subcomponent: Other). The supported version that is affected is 4.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via SMTP to compromise Oracle Hospitality e7. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality e7 accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10208 P-11598V-4.2.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11598V-4.2.1 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 5.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L). Fix has been released CVE-2017-10209 P-8370V-Prior to 5.1.24 5.2 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10210 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hospitality Suite8. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hospitality Suite8, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hospitality Suite8 accessible data as well as unauthorized read access to a subset of Hospitality Suite8 accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10211 P-12619V-8.10.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12619V-8.10.x Vulnerability in the Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hospitality Suite8 accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10212 P-12619V-8.10.x 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12619V-8.10.x Vulnerability in the Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Hospitality Suite8 executes to compromise Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Hospitality Suite8 accessible data. CVSS 3.0 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10213 P-12619V-8.10.x 4.0 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12619V-8.10.x Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xstore Office). Supported versions that are affected are 6.0.x, 6.5.x, 7.0.x, 7.1.x, 15.0.x and 16.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Point of Service accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-10214 P-11513V-6.0.x P-11513V-6.5.x P-11513V-7.0.x P-11513V-7.1.x P-11513V-15.0.x P-11513V-16.0.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11513V-6.0.x P-11513V-6.5.x P-11513V-7.0.x P-11513V-7.1.x P-11513V-15.0.x P-11513V-16.0.0 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: EPPCM_DEFN_CATG). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10215 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the Hospitality Property Interfaces component of Oracle Hospitality Applications (subcomponent: Parser). The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality Property Interfaces. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hospitality Property Interfaces accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10216 P-12729V-8.10.x 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12729V-8.10.x Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0.0 and 4.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10217 P-12617V-4.2.0.0 P-12617V-4.2.1.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12617V-4.2.0.0 P-12617V-4.2.1.0 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0.0 and 4.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10218 P-12617V-4.2.0.0 P-12617V-4.2.1.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12617V-4.2.0.0 P-12617V-4.2.1.0 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0.0 and 4.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Guest Access executes to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10219 P-12617V-4.2.0.0 P-12617V-4.2.1.0 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12617V-4.2.0.0 P-12617V-4.2.1.0 Vulnerability in the Hospitality Property Interfaces component of Oracle Hospitality Applications (subcomponent: Parser). The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Hospitality Property Interfaces executes to compromise Hospitality Property Interfaces. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Hospitality Property Interfaces accessible data. CVSS 3.0 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10220 P-12729V-8.10.x 4.0 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12729V-8.10.x Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Hospitality Applications (subcomponent: OPS Operations). The supported version that is affected is 5.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality RES 3700 executes to compromise Oracle Hospitality RES 3700. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality RES 3700, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality RES 3700 accessible data as well as unauthorized read access to a subset of Oracle Hospitality RES 3700 accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality RES 3700. CVSS 3.0 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10221 P-11596V-5.5 5.0 AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11596V-5.5 Vulnerability in the Oracle Hospitality Materials Control component of Oracle Hospitality Applications (subcomponent: Production Tool). Supported versions that are affected are 8.31.4 and 8.32.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Materials Control. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Materials Control accessible data as well as unauthorized read access to a subset of Oracle Hospitality Materials Control accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10222 P-12573V-8.31.4 P-12573V-8.32.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12573V-8.31.4 P-12573V-8.32.0 Vulnerability in the Oracle Hospitality Materials Control component of Oracle Hospitality Applications (subcomponent: Purchasing). Supported versions that are affected are 8.31.4 and 8.32.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Materials Control. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Materials Control accessible data as well as unauthorized read access to a subset of Oracle Hospitality Materials Control accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10223 P-12573V-8.31.4 P-12573V-8.32.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12573V-8.31.4 P-12573V-8.32.0 Vulnerability in the Oracle Hospitality Inventory Management component of Oracle Hospitality Applications (subcomponent: Inventory and Count Cycle). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Inventory Management. While the vulnerability is in Oracle Hospitality Inventory Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Inventory Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Inventory Management accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10224 P-11602V-8.5.1 P-11602V-9.0.0 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11602V-8.5.1 P-11602V-9.0.0 Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Hospitality Applications (subcomponent: OPS Operations). The supported version that is affected is 5.5. Difficult to exploit vulnerability allows physical access to compromise Oracle Hospitality RES 3700. While the vulnerability is in Oracle Hospitality RES 3700, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality RES 3700 accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality RES 3700 accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality RES 3700. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L). Fix has been released CVE-2017-10225 P-11596V-5.5 7.0 AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11596V-5.5 Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Fleet Management System Suite). The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-10226 P-11608V-9.0 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11608V-9.0 Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Module). The supported version that is affected is 8.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10228 P-11607V-8.0.0.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11607V-8.0.0.0 Vulnerability in the Oracle Hospitality Cruise Materials Management component of Oracle Hospitality Applications (subcomponent: Event Viewer). The supported version that is affected is 7.30.562. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Materials Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Materials Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Materials Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10229 P-11604V-7.30.562 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11604V-7.30.562 Vulnerability in the Oracle Hospitality Cruise Dining Room Management component of Oracle Hospitality Applications (subcomponent: SilverWhere). The supported version that is affected is 8.0.75. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Dining Room Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Dining Room Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Dining Room Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10230 P-11605V-8.0.75 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11605V-8.0.75 Vulnerability in the Oracle Hospitality Cruise AffairWhere component of Oracle Hospitality Applications (subcomponent: AWExport). The supported version that is affected is 2.2.05.062. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise AffairWhere executes to compromise Oracle Hospitality Cruise AffairWhere. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise AffairWhere accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10231 P-11611V-2.2.05.062 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11611V-2.2.05.062 Vulnerability in the Hospitality WebSuite8 Cloud Service component of Oracle Hospitality Applications (subcomponent: General). Supported versions that are affected are 8.9.6 and 8.10.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality WebSuite8 Cloud Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hospitality WebSuite8 Cloud Service accessible data as well as unauthorized update, insert or delete access to some of Hospitality WebSuite8 Cloud Service accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Hospitality WebSuite8 Cloud Service. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2017-10232 P-12731V-8.9.6 P-12731V-8.10.x 7.6 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-12731V-8.9.6 P-12731V-8.10.x Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H). Fix has been released CVE-2017-10233 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: NAS device addition). The supported version that is affected is 4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris Cluster executes to compromise Solaris Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Solaris Cluster. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-10234 P-10005V-4 7.3 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10005V-4 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H). Fix has been released CVE-2017-10235 P-8370V-Prior to 5.1.24 6.7 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10236 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10237 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10238 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10239 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10240 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10241 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10242 P-8370V-Prior to 5.1.24 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8370V-Prior to 5.1.24 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Fix has been released CVE-2017-10243 P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-856V-Java SE: 6u151 P-856V-7u141 P-856V-8u131; Java SE Embedded: 8u131; JRockit: R28.3.14 Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10244 P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10245 P-500V-12.1.1 P-500V-12.1.2 P-500V-12.1.3 P-500V-12.2.3 P-500V-12.2.4 P-500V-12.2.5 P-500V-12.2.6 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-500V-12.1.1 P-500V-12.1.2 P-500V-12.1.3 P-500V-12.2.3 P-500V-12.2.4 P-500V-12.2.5 P-500V-12.2.6 Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-10246 P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: HTML Area). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10247 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: EPPCM_HIER_TOP). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10248 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10249 P-5085V-8.54 P-5085V-8.55 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Tuxedo). Supported versions that are affected are 8.54 and 8.55. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10250 P-5085V-8.54 P-5085V-8.55 4.7 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Test Framework). Supported versions that are affected are 8.54 and 8.55. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10251 P-5085V-8.54 P-5085V-8.55 4.7 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Updates Change Assistant). Supported versions that are affected are 8.54 and 8.55. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10252 P-5085V-8.54 P-5085V-8.55 4.7 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Pivot Grid). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10253 P-5085V-8.54 P-5085V-8.55 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10254 P-5026V-9.2 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5026V-9.2 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: EPPCM_HIER_TOP). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10255 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: EPPCM_HIER_TOP). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10256 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Browse Folder Hierarchy). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10257 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Add New Image). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10258 P-5090V-9.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5090V-9.1.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: UDF). Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3529 P-8478V-5.7.18 and earlier 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3562 P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: CDE Calendar). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3632 is assigned to the "EASYSTREET" vulnerability. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3632 P-10006V-10 P-10006V-11 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10006V-10 P-10006V-11 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Memcached to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2017-3633 P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 6.5 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3634 P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/C). Supported versions that are affected are 6.1.10 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. Note: The documentation has also been updated for the correct way to use mysql_stmt_close(). Please see:<br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-execute.html, <br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-fetch.html,<br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-close.html,<br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-error.html,<br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-errno.html, and <br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-sqlstate.html. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3635 P-8576V-6.1.10 and earlier 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8576V-6.1.10 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: C API). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Note: The documentation has also been updated for the correct way to use mysql_stmt_close(). Please see:<br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-execute.html, <br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-fetch.html,<br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-close.html,<br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-error.html,<br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-errno.html, and <br>https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-sqlstate.html. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3635 P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.56 and earlier and 5.6.36 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-3636 P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: X Plugin). Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3637 P-8478V-5.7.18 and earlier 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3638 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3639 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3640 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3641 P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3642 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3643 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3644 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3645 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: X Plugin). Supported versions that are affected are 5.7.16 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3646 P-8478V-5.7.16 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.16 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3647 P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3648 P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3649 P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: C API). Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3650 P-8478V-5.7.18 and earlier 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3651 P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3652 P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3653 P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.5.56 and earlier P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Security). Supported versions that are affected are 8.54 and 8.55. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3731 P-5085V-8.54 P-5085V-8.55 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Oracle API Gateway component of Oracle Fusion Middleware (subcomponent: OAG (OpenSSL)). The supported version that is affected is 11.1.2.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle API Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle API Gateway accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-9195V-11.1.2.4.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9195V-11.1.2.4.0 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: Platform Services). Supported versions that are affected are 6.1.4, 11.0, 11.1 and 11.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-9633V-6.1.4 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9633V-6.1.4 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 Vulnerability in the Oracle Communications Network Charging and Control component of Oracle Communications Applications (subcomponent: Common fns (OpenSSL)). Supported versions that are affected are 4.4.1.5, 5.0.0.1, 5.0.0.2, 5.0.1.0 and 5.0.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Network Charging and Control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Network Charging and Control accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-4623V-4.4.1.5 P-4623V-5.0.0.1 P-4623V-5.0.0.2 P-4623V-5.0.1.0 P-4623V-5.0.2.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-4623V-4.4.1.5 P-4623V-5.0.0.1 P-4623V-5.0.0.2 P-4623V-5.0.1.0 P-4623V-5.0.2.0 Vulnerability in the Oracle Endeca Server component of Oracle Fusion Middleware (subcomponent: Core (OpenSSL)). Supported versions that are affected are 7.3.0.0, 7.4.0.0, 7.5.0.0, 7.5.1.0, 7.6.0.0, 7.6.1.0 and 7.7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Endeca Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Endeca Server accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-10217V-7.3.0.0 P-10217V-7.4.0.0 P-10217V-7.5.0.0 P-10217V-7.5.1.0 P-10217V-7.6.0.0 P-10217V-7.6.1.0 P-10217V-7.7.0.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-10217V-7.3.0.0 P-10217V-7.4.0.0 P-10217V-7.5.0.0 P-10217V-7.5.1.0 P-10217V-7.6.0.0 P-10217V-7.6.1.0 P-10217V-7.7.0.0 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponent: Discovery Framework). Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-1370V-12.1.0 P-1370V-13.1.0 P-1370V-13.2.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1370V-12.1.0 P-1370V-13.1.0 P-1370V-13.2.0 Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Networking). Supported versions that are affected are 12.2.2 and 12.3.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Ops Center. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Ops Center accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-9835V-12.2.2 P-9835V-12.3.2 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-9835V-12.2.2 P-9835V-12.3.2 Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/ODBC (OpenSSL)). Supported versions that are affected are 5.3.7 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-8576V-5.3.7 and earlier 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8576V-5.3.7 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption (OpenSSL)). Supported versions that are affected are 5.6.35 and earlier and 5.7.17 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the Oracle Explorer component of Oracle Support Tools (subcomponent: Tools (OpenSSL)). The supported version that is affected is Prior to 8.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Explorer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Explorer accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-1330V-Prior to 8.16 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1330V-Prior to 8.16 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Apache Webserver). Supported versions that are affected are 6.1 and 6.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Transportation Management accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-1991V-6.1 P-1991V-6.2 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-1991V-6.1 P-1991V-6.2 Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: SSL Module (OpenSSL)). The supported version that is affected is 12.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-5433V-12.1.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5433V-12.1.1 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Sample apps (Struts 2)). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server (Apache Tomcat)). Supported versions that are affected are 3.3.3.1199 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP over TLS to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Enterprise Monitor accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-5647 P-8480V-3.3.3.1199 and earlier 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8480V-3.3.3.1199 and earlier Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server (Apache Tomcat)). Supported versions that are affected are 3.2.7.1204 and earlier and 3.3.3.1199 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP over TLS to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5651 P-8480V-3.2.7.1204 and earlier P-8480V-3.3.3.1199 and earlier 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-8480V-3.2.7.1204 and earlier P-8480V-3.3.3.1199 and earlier Vulnerability in the MICROS PC Workstation 2015 component of Oracle Hospitality Applications (subcomponent: BIOS (Intel AMT)). The supported version that is affected is Prior to O1302h. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS PC Workstation 2015. Successful attacks of this vulnerability can result in takeover of MICROS PC Workstation 2015. Note: MICROS PC Workstation 2015 systems with Intel ME firmware 6.2.61.3535 or later are not affected by this issue. See Patch Availability document for MICROS PC Workstation 2015 for identifying the Intel ME firmware version on this device. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5689 P-11637V-Prior to O1302h 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11637V-Prior to O1302h Vulnerability in the MICROS Workstation 650 component of Oracle Hospitality Applications (subcomponent: BIOS (Intel AMT)). The supported version that is affected is Prior to E1500n. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Workstation 650. Successful attacks of this vulnerability can result in takeover of MICROS Workstation 650. Note: MICROS Workstation 650 systems running Intel ME firmware 10.0.55.3000 or later are not affected by this issue. See Patch Availability document for MICROS Workstation 650 for identifying the Intel ME firmware version on this device. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5689 P-11628V-Prior to E1500n 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJul2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujul2017.html P-11628V-Prior to E1500n