Oracle Critical Patch Update Advisory - October 2017 - Oracle CVRF Oracle Critical Patch Update Advisory CPUOct2017 Final 1.0 1.0 2017-10-17T13:00:00-07:00 Initial Distribution 2017-10-17T13:00:00-07:00 2017-10-17T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had fixes released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including fix distribution information can be found at the Oracle sites referenced in this document. This document is published at: http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3937099.xml https://www.oracle.com/security-alerts/cpuoct2017.html URL to html version of Advisory Abdelfattah Ibrahim Abdelfattah Ibrahim Abhineeti Singh Abhineeti Singh Adam Willard Blue Canopy Ahsan Khan Ahsan Khan Alexey Tyurin ERPScan Ali Ardic Ali Ardic Andrés Blanco Onapsis Athul Jayaram Athul Jayaram Behzad Najjarpour Jabbari, Secunia Research at Flexera Software Berk İmran berk İmran Andreev Ivan Charles Fol Ambionics Christopher Tarquini Christopher Tarquini Cris Neckar of Divergent Security Daniel Ekberg of Swedish Public Employment Service Daniel Fröjdendahl Daniel Fröjdendahl David Litchfield Apple Devin Rosenbauer Identity Works LLC Dmitrii Iudin aka @ret5et of ERPScan Doğukan Karaciğer Doğukan Karaciğer Emad Shanab Emad Abou Shanab Fabio Pires NCC Group Federico Dotta Media Service Francesco Palmarini Ca' Foscari University of Venice Gaston Traberg Onapsis Hassan El Hadary - Secure Misr Ian Haken IAN HAKEN Jakub Palaczynski ING Services Polska Jared McLaren SecureWorks Jayson Grace Sandia National Laboratories Jeffrey Altman Secure Endpoints Inc. Joshua Graham Datacom TSS Juan Pablo Perez Etchegoyen Onapsis Karthik Reddy karthik reddy Krishna Manoj Vandavasi Krishna Manoj Vandavasi Lecamen Nartatez lecamen nartatez Lukasz Mikula LUKASZ MIKULA Léa Nuel NES An Anonymous researcher via Beyond Security's SecuriTeam Secure Disclosure Program Marcin Wołoszyn ING Services Polska Marco Squarcina Ca' Foscari University of Venice Martin Doyhenard Onapsis Mathew Nash NCC Group Matias Mevied Onapsis Mauro Tempesta Ca' Foscari University of Venice Ming Yi Ang SourceClear Mohammad Abdullah - ErrOr SquaD Bangladesh Muhammad Osama Muhammad Osama Mushraf Mustafa Mushraf Mustafa Nikita Egorov ERPScan Or Hanuka Motorola Solutions Orange Tsai Orange Tsai Owais Mehtab IS Pal Patel Pal Patel Reno Robert Reno Robert Riccardo Focardi Ca' Foscari University of Venice S. Venkatesh S. Venkatesh SaifAllah benMassaoud SaifAllah benMassaoud Sebastian Cornejo SIA Group Spyridon Chatzimichail of OTE Hellenic Telecommunications Organization S.A. Steven Danneman Security Innovation Steven Seeley Source Incite Tamas Szakaly Tamas Szakaly Tansel ÇETİN Tansel Çetin Tayeeb Rana IS Teemu Kääriäinen Teemu Kääriäinen Tobias Ospelt modzero Tor Erling Bjorstad of Mnemonic AS Travis Emmert Exodus Intelligence Travis Emmert of Synack Red Team Tushar Parab Tushar Parab Tzachy Horesh Motorola Solutions Vahagn Vardanyan ERPScan Vicente Motos SIA Group Vinod Kurup Vinod Kurup Yassine Nafiai Yassine Nafiai Zakaria Amous loopx9 loopx9 Çağatay Çalı Çağatay Çalı Communications Billing and Revenue Management Version 7.5 Communications Order and Service Management Version 7.2.4.x.x Communications Order and Service Management Version 7.3.0.x.x Communications Order and Service Management Version 7.3.1.x.x Communications Order and Service Management Version 7.3.5.x.x Communications Services Gatekeeper Version 5.1 Communications Services Gatekeeper Version 6.0 Communications Messaging Server Version 8.x Communications Unified Session Manager Version SCz 7.x Communications WebRTC Session Controller Version 7.0 Communications WebRTC Session Controller Version 7.1 Communications WebRTC Session Controller Version 7.2 Communications Diameter Signaling Router (DSR) Version 7.x Communications Policy Management Version 11.5 Communications Policy Management Version 12.x Tekelec HLR Router Version 4.x Communications User Data Repository Version 10.x Communications EAGLE LNP Application Processor Version 10.x Primavera Unifier Version 10.x Primavera Unifier Version 15.x Primavera Unifier Version 16.x Primavera Unifier Version 9.13 Primavera Unifier Version 9.14 Oracle Database Version 11.2.0.4 Oracle Database Version 12.1.0.2 Oracle Database Version 12.2.0.1 Applications DBA Version 12.1.3 Applications DBA Version 12.2.3 Applications DBA Version 12.2.4 Applications DBA Version 12.2.5 Applications DBA Version 12.2.6 Applications DBA Version 12.2.7 Interaction Center Intelligence Version 12.1.1 Interaction Center Intelligence Version 12.1.2 Interaction Center Intelligence Version 12.1.3 iSupport Version 12.1.1 iSupport Version 12.1.2 iSupport Version 12.1.3 iSupport Version 12.2.3 iSupport Version 12.2.4 iSupport Version 12.2.5 iSupport Version 12.2.6 iSupport Version 12.2.7 iStore Version 12.1.1 iStore Version 12.1.2 iStore Version 12.1.3 iStore Version 12.2.3 iStore Version 12.2.4 iStore Version 12.2.5 iStore Version 12.2.6 iStore Version 12.2.7 Application Object Library Version 12.1.3 Application Object Library Version 12.2.3 Application Object Library Version 12.2.4 Application Object Library Version 12.2.5 Application Object Library Version 12.2.6 Application Object Library Version 12.2.7 Global Order Promising Version 12.1.1 Global Order Promising Version 12.1.2 Global Order Promising Version 12.1.3 Global Order Promising Version 12.2.3 Global Order Promising Version 12.2.4 Global Order Promising Version 12.2.5 Global Order Promising Version 12.2.6 Global Order Promising Version 12.2.7 Mobile Field Service Version 12.1.1 Mobile Field Service Version 12.1.2 Mobile Field Service Version 12.1.3 Mobile Field Service Version 12.2.3 Mobile Field Service Version 12.2.4 Mobile Field Service Version 12.2.5 Mobile Field Service Version 12.2.6 Mobile Field Service Version 12.2.7 Trade Management Version 12.1.1 Trade Management Version 12.1.2 Trade Management Version 12.1.3 Trade Management Version 12.2.3 Trade Management Version 12.2.4 Trade Management Version 12.2.5 Trade Management Version 12.2.6 Universal Work Queue Version 12.1.1 Universal Work Queue Version 12.1.2 Universal Work Queue Version 12.1.3 Universal Work Queue Version 12.2.3 Universal Work Queue Version 12.2.4 Universal Work Queue Version 12.2.5 Universal Work Queue Version 12.2.6 Universal Work Queue Version 12.2.7 Advanced Outbound Telephony Version 12.2.3 Advanced Outbound Telephony Version 12.2.4 Advanced Outbound Telephony Version 12.2.5 Advanced Outbound Telephony Version 12.2.6 Advanced Outbound Telephony Version 12.2.7 Web Applications Desktop Integrator Version 12.1.1 Web Applications Desktop Integrator Version 12.1.2 Web Applications Desktop Integrator Version 12.1.3 Web Applications Desktop Integrator Version 12.2.3 Web Applications Desktop Integrator Version 12.2.4 Web Applications Desktop Integrator Version 12.2.5 Web Applications Desktop Integrator Version 12.2.6 Common Applications Version 12.1.3 Common Applications Version 12.2.3 Common Applications Version 12.2.4 Common Applications Version 12.2.5 Common Applications Version 12.2.6 Common Applications Version 12.2.7 CRM Technical Foundation Version 12.1.3 CRM Technical Foundation Version 12.2.3 CRM Technical Foundation Version 12.2.4 CRM Technical Foundation Version 12.2.5 CRM Technical Foundation Version 12.2.6 CRM Technical Foundation Version 12.2.7 Knowledge Management Version 12.1.1 Knowledge Management Version 12.1.2 Knowledge Management Version 12.1.3 Knowledge Management Version 12.2.3 Knowledge Management Version 12.2.4 Knowledge Management Version 12.2.5 Knowledge Management Version 12.2.6 Knowledge Management Version 12.2.7 Common Applications Calendar Version 12.1.1 Common Applications Calendar Version 12.1.2 Common Applications Calendar Version 12.1.3 Common Applications Calendar Version 12.2.3 Common Applications Calendar Version 12.2.4 Common Applications Calendar Version 12.2.5 Common Applications Calendar Version 12.2.6 Common Applications Calendar Version 12.2.7 E-Business Suite Technology Stack Version 12.1.3 E-Business Suite Technology Stack Version 12.2.3 E-Business Suite Technology Stack Version 12.2.4 E-Business Suite Technology Stack Version 12.2.5 E-Business Suite Technology Stack Version 12.2.6 E-Business Suite Technology Stack Version 12.2.7 Enterprise Manager Ops Center Version 12.2.2 Enterprise Manager Ops Center Version 12.3.2 FLEXCUBE Universal Banking Version 11.3 FLEXCUBE Universal Banking Version 11.4.0 FLEXCUBE Universal Banking Version 12.0.1 FLEXCUBE Universal Banking Version 12.0.2 FLEXCUBE Universal Banking Version 12.0.3 FLEXCUBE Universal Banking Version 12.1.0 FLEXCUBE Universal Banking Version 12.2.0 FLEXCUBE Universal Banking Version 12.3.0 FLEXCUBE Universal Banking Version 12.4.0 JDeveloper Version 12.1.3.0.0 JDeveloper Version 12.2.1.2.0 Security Service Version 12.1.3.0.0 Security Service Version FMW: 11.1.1.9.0 HTTP Server Version 11.1.1.7.0 HTTP Server Version 11.1.1.9.0 HTTP Server Version 12.1.3.0.0 HTTP Server Version 12.2.1.1.0 HTTP Server Version 12.2.1.2.0 SOA Suite Version 11.1.1.7.0 BI Publisher (formerly XML Publisher) Version 11.1.1.7.0 BI Publisher (formerly XML Publisher) Version 11.1.1.9.0 BI Publisher (formerly XML Publisher) Version 12.2.1.1.0 BI Publisher (formerly XML Publisher) Version 12.2.1.2.0 COREid Access Version 11.1.2.3.0 Oracle Virtual Directory Version 11.1.1.7.0 Oracle Virtual Directory Version 11.1.1.9.0 Identity Manager Version 11.1.2.3.0 Identity Manager Connector Version 9.1.1.5.0 Business Intelligence Enterprise Edition Version 11.1.1.7.0 Business Intelligence Enterprise Edition Version 11.1.1.9.0 Business Intelligence Enterprise Edition Version 12.2.1.1.0 Business Intelligence Enterprise Edition Version 12.2.1.2.0 WebCenter Content Version 11.1.1.9.0 WebCenter Content Version 12.2.1.1.0 WebCenter Content Version 12.2.1.2.0 Outside In Technology Version 8.5.3.0 WebLogic Server Version 10.3.6.0.0 WebLogic Server Version 12.1.3.0.0 WebLogic Server Version 12.2.1.1.0 WebLogic Server Version 12.2.1.2.0 WebLogic Server Version 12.2.1.3.0 Business Process Management Suite Version 11.1.1.7.0 Business Process Management Suite Version 11.1.1.9.0 Business Process Management Suite Version 12.1.3.0.0 Business Process Management Suite Version 12.2.1.1.0 Business Process Management Suite Version 12.2.1.2.0 Access Manager Version 11.1.2.3.0 Management Pack for Oracle GoldenGate Version 11.2.1.0.12 GlassFish Server Version 3.0.1 GlassFish Server Version 3.1.2 Directory Server Enterprise Edition Version 11.1.1.7.0 iPlanet Web Server Version 7.0 API Gateway Version 11.1.2.4.0 WebCenter Sites Version 11.1.1.8.0 WebCenter Sites Version 12.2.1.2.0 Managed File Transfer Version 12.1.3.0.0 Managed File Transfer Version 12.2.1.1.0 Managed File Transfer Version 12.2.1.2.0 Endeca Information Discovery Integrator Version 2.4 Endeca Information Discovery Integrator Version 3.0 Endeca Information Discovery Integrator Version 3.1 Endeca Information Discovery Integrator Version 3.2 Healthcare Master Person Index Version 4.x Hospitality OPERA 5 Property Services Version 5.4.2.x through 5.5.1.x Hospitality Simphony Version 2.6 Hospitality Simphony Version 2.7 Hospitality Simphony Version 2.8 Hospitality Simphony Version 2.9 Hospitality Reporting and Analytics Version 8.5.1 Hospitality Reporting and Analytics Version 9.0.0 Hospitality Cruise Materials Management Version 7.30.564.0 Hospitality Cruise Shipboard Property Management System Version 8.0.2.0 Hospitality Cruise Fleet Management Version 9.0.2.0 Hospitality Cruise AffairWhere Version 2.2.5.0 Hospitality Cruise AffairWhere Version 2.2.6.0 Hospitality Cruise AffairWhere Version 2.2.7.0 Hospitality Guest Access Version 4.2.0 Hospitality Guest Access Version 4.2.1 Hospitality Suite8 Version 8.10.1 Hospitality Suite8 Version 8.10.2 Hospitality Hotel Mobile Version 1.1 Hyperion BI+ Version 11.1.2.4 Hyperion Financial Reporting Version 11.1.2 JD Edwards EnterpriseOne Tools Version 9.2 JD Edwards World Security Version A9.1 JD Edwards World Security Version A9.2 JD Edwards World Security Version A9.3 JD Edwards World Security Version A9.4 Java Version 7u151 Java Version 8u144 Java Version 8u144; Java SE Embedded: 8u144 Java Version 9 Java Version 9; Java SE Embedded: 8u144 Java Version 9; Java SE Embedded: 8u144; JRockit: R28.3.15 Java Version Java Advanced Management Console: 2.7 Java Version Java SE: 6u161 Java Version Java SE: 7u151 Java Version Java SE: 8u144 MySQL Server Version 5.5.57 and earlier MySQL Server Version 5.5.57 and earlier5.6.37 and earlier5.7.19 and earlier MySQL Server Version 5.6.35 and earlier MySQL Server Version 5.6.36 and earlier MySQL Server Version 5.6.37 and earlier MySQL Server Version 5.7.11 and earlier MySQL Server Version 5.7.18 and earlier MySQL Server Version 5.7.19 and earlier MySQL Enterprise Monitor Version 3.2.8.2223 and earlier MySQL Enterprise Monitor Version 3.3.4.3247 and earlier MySQL Enterprise Monitor Version 3.4.2.4181 and earlier MySQL Connectors Version 6.9.9 and earlier PeopleSoft Enterprise FIN Staffing Front Office Version 9.2 PeopleSoft Enterprise HCM Human Resources Version 9.2 PeopleSoft Enterprise PT PeopleTools Version 8.54 PeopleSoft Enterprise PT PeopleTools Version 8.55 PeopleSoft Enterprise PT PeopleTools Version 8.56 PeopleSoft Enterprise PRTL Interaction Hub Version 9.1.00 PeopleSoft Enterprise SCM eProcurement Version 9.1.00 PeopleSoft Enterprise SCM eProcurement Version 9.2.00 PeopleSoft Enterprise SCM Strategic Sourcing Version 9.2 Retail Store Inventory Management Version 13.2.9 Retail Store Inventory Management Version 14.0.4 Retail Store Inventory Management Version 14.1.3 Retail Store Inventory Management Version 15.0.1 Retail Store Inventory Management Version 16.0.1 Retail Markdown Optimization Version 13.4 Retail Markdown Optimization Version 14.0 Retail Point-of-Service Version 13.2 Retail Point-of-Service Version 13.3 Retail Point-of-Service Version 13.4 Retail Point-of-Service Version 14.0 Retail Point-of-Service Version 14.1 Retail Clearance Optimization Engine Version 13.4 XBRi Cloud Service Version 10.0.1 XBRi Cloud Service Version 10.5.0 XBRi Cloud Service Version 10.6.0 XBRi Cloud Service Version 10.7.7 XBRi Cloud Service Version 10.8.0 XBRi Cloud Service Version 10.8.1 Retail Xstore Point of Service Version 15.0.1 Retail Xstore Point of Service Version 6.0.11 Retail Xstore Point of Service Version 6.5.11 Retail Xstore Point of Service Version 7.0.6 Retail Xstore Point of Service Version 7.1.6 Retail Convenience and Fuel POS Software Version 2.1.132 MICROS XBR Version 10.0.1 MICROS XBR Version 10.5.0 MICROS XBR Version 10.6.0 MICROS XBR Version 10.7.7 MICROS XBR Version 10.8.0 MICROS XBR Version 10.8.1 Siebel CRM Desktop Version 16.0 Siebel CRM Desktop Version 17.0 Siebel Apps - Field Service Version 16.0 Siebel Apps - Field Service Version 17.0 Siebel Core - Server Framework Version 16.0 Siebel Core - Server Framework Version 17.0 Siebel UI Framework Version 16.0 Siebel UI Framework Version 17.0 SPARC - OPL Service Processor (XCP) Version Prior to XCP1123 SPARC - Sun System Firmware - NPE Version Prior to 9.7.6.b SSM - (hot-tamale) ILOM: Integrated Lights Out Manager Version Prior to 3.2.6 Solaris Cluster Version 3.3 Solaris Cluster Version 4.3 Solaris Operating System Version AK 2013 Fujitsu SPARC Servers Firmware Version Prior to XCP2340 and Prior to XCP3030 X86 - Oracle Server X7-2c Version 1.0 X86 - Oracle Server X7-2c Version 1.0 and 1.0.1 Transportation Management Version 6.3.0 Transportation Management Version 6.3.1 Transportation Management Version 6.3.2 Transportation Management Version 6.3.3 Transportation Management Version 6.3.4 Transportation Management Version 6.3.5 Transportation Management Version 6.3.6 Transportation Management Version 6.3.7 Transportation Management Version 6.4.1 Transportation Management Version 6.4.2 Agile Engineering Data Management Version 6.1.3 Agile Engineering Data Management Version 6.1.3.0 Agile Engineering Data Management Version 6.2.0 Agile Engineering Data Management Version 6.2.2.0 Agile PLM Framework Version 9.3.5 Agile PLM Framework Version 9.3.6 VM VirtualBox Version Prior to 5.1.30 Secure Global Desktop Version 5.3 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.9.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HTTP Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2003-1418 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 Vulnerability in the Siebel Apps - Field Service component of Oracle Siebel CRM (subcomponent: Smart Answer (Python)). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Field Service. While the vulnerability is in Siebel Apps - Field Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2013-1903 P-8971V-16.0 P-8971V-17.0 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8971V-16.0 P-8971V-17.0 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Postgresql)). Supported versions that are affected are 7.0, 7.1 and 7.2. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications WebRTC Session Controller accessible data as well as unauthorized read access to a subset of Oracle Communications WebRTC Session Controller accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2014-0062 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Xalan)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications WebRTC Session Controller accessible data as well as unauthorized read access to a subset of Oracle Communications WebRTC Session Controller accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2014-0107 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Media (BeanUtils)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications WebRTC Session Controller accessible data as well as unauthorized read access to a subset of Oracle Communications WebRTC Session Controller accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2014-0114 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Tekelec HLR Router component of Oracle Communications Applications (subcomponent: Security (OpenSSL)). The supported version that is affected is 4.x. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Tekelec HLR Router. Successful attacks of this vulnerability can result in takeover of Tekelec HLR Router. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2014-0224 P-11047V-4.x 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11047V-4.x Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (file)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2014-3538 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (libcurl)). Supported versions that are affected are 7.0, 7.1 and 7.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications WebRTC Session Controller accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2014-3707 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Kerberos)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications WebRTC Session Controller accessible data as well as unauthorized read access to a subset of Oracle Communications WebRTC Session Controller accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2014-4345 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Wireshark)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2014-8714 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Communications User Data Repository component of Oracle Communications Applications (subcomponent: Security (glibc)). The supported version that is affected is 10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications User Data Repository. Successful attacks of this vulnerability can result in takeover of Oracle Communications User Data Repository. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-0235 P-11108V-10.x 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11108V-10.x Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Media (glibc)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-0235 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-2808 P-1042V-11.1.1.7.0 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 P-1042V-12.2.1.1.0 P-1042V-12.2.1.2.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1042V-11.1.1.7.0 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 P-1042V-12.2.1.1.0 P-1042V-12.2.1.2.0 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Apache Groovy)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware (subcomponent: BI Publisher Security (Apache ActiveMQ)). Supported versions that are affected are 11.1.1.7.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2310008.1">My Oracle Support Note 2310008.1</a> for instructions on how to address this issue. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-5254 P-1479V-11.1.1.7.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1479V-11.1.1.7.0 P-1479V-12.2.1.1.0 P-1479V-12.2.1.2.0 Vulnerability in the Oracle Agile Engineering Data Management component of Oracle Supply Chain Products Suite (subcomponent: Install (Apache Commons Collections)). Supported versions that are affected are 6.1.3 and 6.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-4436V-6.1.3 P-4436V-6.2.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4436V-6.1.3 P-4436V-6.2.0 Vulnerability in the Oracle Business Process Management Suite component of Oracle Fusion Middleware (subcomponent: Security (Apache Commons Collections)). Supported versions that are affected are 11.1.1.9.0 and 12.2.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-5325V-11.1.1.9.0 P-5325V-12.2.1.1.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5325V-11.1.1.9.0 P-5325V-12.2.1.1.0 Vulnerability in the Oracle Communications Order and Service Management component of Oracle Communications Applications (subcomponent: Security (Apache Commons Collections)). Supported versions that are affected are 7.2.4.x.x, 7.3.0.x.x,7.3.1.x.x and 7.3.5.x.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Order and Service Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Order and Service Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Order and Service Management accessible data as well as unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Order and Service Management. CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Fix has been released CVE-2015-7501 P-2270V-7.2.4.x.x P-2270V-7.3.0.x.x P-2270V-7.3.1.x.x P-2270V-7.3.5.x.x 7.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-2270V-7.2.4.x.x P-2270V-7.3.0.x.x P-2270V-7.3.1.x.x P-2270V-7.3.5.x.x Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Apache Commons Collections)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Endeca Information Discovery Integrator component of Oracle Fusion Middleware (subcomponent: Security (Apache Commons Collections)). Supported versions that are affected are 2.4, 3.0, 3.1 and 3.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Endeca Information Discovery Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Endeca Information Discovery Integrator. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-10561V-2.4 P-10561V-3.0 P-10561V-3.1 P-10561V-3.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10561V-2.4 P-10561V-3.0 P-10561V-3.1 P-10561V-3.2 Vulnerability in the Management Pack for Oracle GoldenGate component of Oracle Fusion Middleware (subcomponent: Monitor (Apache Commons Collections)). The supported version that is affected is 11.2.1.0.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Management Pack for Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Management Pack for Oracle GoldenGate. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-5759V-11.2.1.0.12 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5759V-11.2.1.0.12 Vulnerability in the Oracle Business Process Management Suite component of Oracle Fusion Middleware (subcomponent: Workspace and Process portal (Bouncy Castle Java package)). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-5325V-11.1.1.7.0 P-5325V-11.1.1.9.0 P-5325V-12.1.3.0.0 P-5325V-12.2.1.1.0 P-5325V-12.2.1.2.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5325V-11.1.1.7.0 P-5325V-11.1.1.9.0 P-5325V-12.1.3.0.0 P-5325V-12.2.1.1.0 P-5325V-12.2.1.2.0 Vulnerability in the Oracle Managed File Transfer component of Oracle Fusion Middleware (subcomponent: MFT Runtime Server (Bouncy Castle Java package)). Supported versions that are affected are 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Managed File Transfer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Managed File Transfer accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-10198V-12.1.3.0.0 P-10198V-12.2.1.1.0 P-10198V-12.2.1.2.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10198V-12.1.3.0.0 P-10198V-12.2.1.1.0 P-10198V-12.2.1.2.0 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Spring)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Endeca Information Discovery Integrator component of Oracle Fusion Middleware (subcomponent: Security (Spring Framework)). The supported version that is affected is 3.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Endeca Information Discovery Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Endeca Information Discovery Integrator. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-10561V-3.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10561V-3.2 Vulnerability in the Management Pack for Oracle GoldenGate component of Oracle Fusion Middleware (subcomponent: Monitor (Apache Tomcat)). The supported version that is affected is 11.2.1.0.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Management Pack for Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Management Pack for Oracle GoldenGate. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0714 P-5759V-11.2.1.0.12 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5759V-11.2.1.0.12 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D (Little CMS 2)). Supported versions that are affected are Java SE: 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-10165 P-856V-Java SE: 7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: OIM Legacy UI (Apache Struts 1)). The supported version that is affected is 11.1.2.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-1181 P-1980V-11.1.2.3.0 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1980V-11.1.2.3.0 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (OpenSSL)). Supported versions that are affected are 7.0, 7.1 and 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications WebRTC Session Controller and unauthorized read access to a subset of Oracle Communications WebRTC Session Controller accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OSSL Module). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HTTP Server accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-2183 P-1042V-11.1.1.7.0 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 P-1042V-12.2.1.1.0 P-1042V-12.2.1.2.0 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1042V-11.1.1.7.0 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 P-1042V-12.2.1.1.0 P-1042V-12.2.1.2.0 Vulnerability in the Oracle Communications Billing and Revenue Management component of Oracle Communications Applications (subcomponent: Security (Perl)). The supported version that is affected is 7.5. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2016-2381 P-2136V-7.5 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-2136V-7.5 Vulnerability in the Oracle Directory Server Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Admin Server (NSS)). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Directory Server Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Directory Server Enterprise Edition. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-2834 P-8512V-11.1.1.7.0 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8512V-11.1.1.7.0 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container (Apache Commons FileUpload)). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-8493V-3.1.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8493V-3.1.2 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Install (Apache Commons FileUpload)). Supported versions that are affected are 6.4.1 and 6.4.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Transportation Management. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-1991V-6.4.1 P-1991V-6.4.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1991V-6.4.1 P-1991V-6.4.2 Vulnerability in the Oracle Retail Clearance Optimization Engine component of Oracle Retail Applications (subcomponent: Installation). The supported version that is affected is 13.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Clearance Optimization Engine. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail Clearance Optimization Engine accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail Clearance Optimization Engine accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-3506 P-5256V-13.4 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5256V-13.4 Vulnerability in the Oracle Retail Markdown Optimization component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 13.4 and 14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Markdown Optimization. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail Markdown Optimization accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail Markdown Optimization accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2016-3506 P-1889V-13.4 P-1889V-14.0 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1889V-13.4 P-1889V-14.0 Vulnerability in the Oracle Communications Services Gatekeeper component of Oracle Communications Applications (subcomponent: Security (Apache Trinidad)). Supported versions that are affected are 5.1 and 6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Services Gatekeeper. Successful attacks of this vulnerability can result in takeover of Oracle Communications Services Gatekeeper. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5019 P-5381V-5.1 P-5381V-6.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5381V-5.1 P-5381V-6.0 Vulnerability in the Oracle Communications Unified Session Manager component of Oracle Communications Applications (subcomponent: Routing (OpenSSL)). The supported version that is affected is SCz 7.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Session Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Session Manager. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-10753V-SCz 7.x 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10753V-SCz 7.x Vulnerability in the Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware (OpenSSL)). Supported versions that are affected are Prior to XCP2340 and Prior to XCP3030. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-10656V-Prior to XCP2340 and Prior to XCP3030 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10656V-Prior to XCP2340 and Prior to XCP3030 Vulnerability in the SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware (OpenSSL)). The supported version that is affected is Prior to XCP1123. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-9845V-Prior to XCP1123 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9845V-Prior to XCP1123 Vulnerability in the Oracle Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Networking (Apache Groovy)). Supported versions that are affected are 12.2.2 and 12.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Ops Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Ops Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Ops Center. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-9835V-12.2.2 P-9835V-12.3.2 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9835V-12.2.2 P-9835V-12.3.2 Vulnerability in the Oracle Healthcare Master Person Index component of Oracle Health Sciences Applications (subcomponent: Relationship Management (Apache Groovy)). The supported version that is affected is 4.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Healthcare Master Person Index, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-8575V-4.x 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8575V-4.x Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Java Business Objects (Apache Groovy)). Supported versions that are affected are 12.2.1.2.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle JDeveloper, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-807V-12.2.1.2.0 P-807V-12.1.3.0.0 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-807V-12.2.1.2.0 P-807V-12.1.3.0.0 Vulnerability in the Spatial (Apache Groovy) component of Oracle Database Server. The supported version that is affected is 12.2.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Spatial (Apache Groovy). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Spatial (Apache Groovy), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Spatial (Apache Groovy). Note: Component installed optionally. Not in the default installation. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-5V-12.2.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5V-12.2.0.1 Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Platform (Apache Groovy)). Supported versions that are affected are 9.13, 9.14, 10.x, 15.x,16.x and . Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Primavera Unifier. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-10354V-9.13 P-10354V-9.14 P-10354V-10.x P-10354V-15.x P-10354V-16.x 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10354V-9.13 P-10354V-9.14 P-10354V-10.x P-10354V-15.x P-10354V-16.x Vulnerability in the Oracle Retail Convenience and Fuel POS Software component of Oracle Retail Applications (subcomponent: OPT Server (Apache Groovy)). The supported version that is affected is 2.1.132. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Convenience and Fuel POS Software. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Convenience and Fuel POS Software, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Retail Convenience and Fuel POS Software. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-11515V-2.1.132 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11515V-2.1.132 Vulnerability in the Oracle Retail Store Inventory Management component of Oracle Retail Applications (subcomponent: SIM Integration (Apache Groovy)). Supported versions that are affected are 13.2.9, 14.0.4, 14.1.3, 15.0.1 and 16.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Store Inventory Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Store Inventory Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Retail Store Inventory Management. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2016-6814 P-1838V-13.2.9 P-1838V-14.0.4 P-1838V-14.1.3 P-1838V-15.0.1 P-1838V-16.0.1 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1838V-13.2.9 P-1838V-14.0.4 P-1838V-14.1.3 P-1838V-15.0.1 P-1838V-16.0.1 Vulnerability in the Oracle Communications Diameter Signaling Router (DSR) component of Oracle Communications Applications (subcomponent: OAM and Signaling (OpenSSL)). The supported version that is affected is 7.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Diameter Signaling Router (DSR). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Diameter Signaling Router (DSR). CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-7052 P-10899V-7.x 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10899V-7.x Vulnerability in the Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware (NTP)). Supported versions that are affected are Prior to XCP2340 and Prior to XCP3030. Easily exploitable vulnerability allows unauthenticated attacker with network access via NTP to compromise Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-7431 P-10656V-Prior to XCP2340 and Prior to XCP3030 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10656V-Prior to XCP2340 and Prior to XCP3030 Vulnerability in the SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers component of Oracle Sun Systems Products Suite (subcomponent: XCP Firmware (NTP)). The supported version that is affected is Prior to XCP1123. Easily exploitable vulnerability allows unauthenticated attacker with network access via NTP to compromise SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-7431 P-9845V-Prior to XCP1123 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9845V-Prior to XCP1123 Vulnerability in the WLM (Apache Tomcat) component of Oracle Database Server. The supported version that is affected is 12.2.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise WLM (Apache Tomcat). Successful attacks of this vulnerability can result in takeover of WLM (Apache Tomcat). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-8735 P-5V-12.2.0.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5V-12.2.0.1 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Util (zlib)). Supported versions that are affected are Java SE: 6u161, 7u151 and 8u144; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2016-9841 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144; Java SE Embedded: 8u144 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144; Java SE Embedded: 8u144 Vulnerability in the Oracle Hospitality Hotel Mobile component of Oracle Hospitality Applications (subcomponent: Suite8/RESTAPI). The supported version that is affected is 1.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Hotel Mobile. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Hotel Mobile accessible data. CVSS 3.0 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10014 P-13023V-1.1 3.5 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-13023V-1.1 Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10026 P-1162V-11.1.1.7.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1162V-11.1.1.7.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools). Supported versions that are affected are 11.1.1.8.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Sites executes to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of Oracle WebCenter Sites accessible data. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2318213.1">My Oracle Support Note 2318213.1</a> for instructions on how to address this issue. CVSS 3.0 Base Score 4.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10033 P-9617V-11.1.1.8.0 P-9617V-12.2.1.2.0 4.0 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware (subcomponent: Core Formatting API). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10034 P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Service API). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10037 P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Suite8, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Suite8 accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10050 P-12619V-8.10.1 P-12619V-8.10.2 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10051 P-2276V-8.5.3.0 5.7 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-2276V-8.5.3.0 Vulnerability in the Oracle Hospitality Cruise Materials Management component of Oracle Hospitality Applications (subcomponent: MMS). The supported version that is affected is 7.30.564.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Cruise Materials Management executes to compromise Oracle Hospitality Cruise Materials Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Materials Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Materials Management accessible data. CVSS 3.0 Base Score 5.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10054 P-11604V-7.30.564.0 5.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11604V-7.30.564.0 Vulnerability in the Oracle iPlanet Web Server component of Oracle Fusion Middleware (subcomponent: Admin Graphical User Interface). The supported version that is affected is 7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iPlanet Web Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iPlanet Web Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iPlanet Web Server accessible data as well as unauthorized read access to a subset of Oracle iPlanet Web Server accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10055 P-8543V-7.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8543V-7.0 Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web General). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10060 P-2025V-11.1.1.7.0 P-2025V-11.1.1.9.0 P-2025V-12.2.1.1.0 P-2025V-12.2.1.2.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-2025V-11.1.1.7.0 P-2025V-11.1.1.9.0 P-2025V-12.2.1.1.0 P-2025V-12.2.1.2.0 Vulnerability in the Oracle Retail Point-of-Service component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.2, 13.3, 13.4, 14.0 and 14.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Point-of-Service. While the vulnerability is in Oracle Retail Point-of-Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail Point-of-Service accessible data as well as unauthorized read access to a subset of Oracle Retail Point-of-Service accessible data. CVSS 3.0 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N). Fix has been released CVE-2017-10065 P-2017V-13.2 P-2017V-13.3 P-2017V-13.4 P-2017V-14.0 P-2017V-14.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-2017V-13.2 P-2017V-13.3 P-2017V-13.4 P-2017V-14.0 P-2017V-14.1 Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite (subcomponent: Oracle Forms). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Technology Stack accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10066 P-1745V-12.1.3 P-1745V-12.2.3 P-1745V-12.2.4 P-1745V-12.2.5 P-1745V-12.2.6 P-1745V-12.2.7 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1745V-12.1.3 P-1745V-12.2.3 P-1745V-12.2.4 P-1745V-12.2.5 P-1745V-12.2.6 P-1745V-12.2.7 Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-10077 P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 P-166V-12.2.7 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 P-166V-12.2.7 Vulnerability in the SPARC M7, T7, S7 based Servers component of Oracle Sun Systems Products Suite (subcomponent: Firmware). The supported version that is affected is Prior to 9.7.6.b. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where SPARC M7, T7, S7 based Servers executes to compromise SPARC M7, T7, S7 based Servers. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of SPARC M7, T7, S7 based Servers. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10099 P-9847V-Prior to 9.7.6.b 4.4 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9847V-Prior to 9.7.6.b Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10152 P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Gson)). Supported versions that are affected are 7.0, 7.1 and 7.2. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Communications WebRTC Session Controller. While the vulnerability is in Oracle Communications WebRTC Session Controller, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications WebRTC Session Controller. CVSS 3.0 Base Score 6.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H). Fix has been released CVE-2017-10153 P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 6.3 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10811V-7.0 P-10811V-7.1 P-10811V-7.2 Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10154 P-5565V-11.1.2.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5565V-11.1.2.3.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10155 P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Core). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10158 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Portal, CMP). Supported versions that are affected are 11.5 and 12.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Policy Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as unauthorized read access to a subset of Oracle Communications Policy Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10159 P-10900V-11.5 P-10900V-12.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10900V-11.5 P-10900V-12.x Vulnerability in the Oracle Engineering Data Management component of Oracle Supply Chain Products Suite (subcomponent: Web Services Security). Supported versions that are affected are 6.1.3.0 and 6.2.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Engineering Data Management accessible data as well as unauthorized read access to a subset of Oracle Engineering Data Management accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10161 P-4436V-6.1.3.0 P-4436V-6.2.2.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4436V-6.1.3.0 P-4436V-6.2.2.0 Vulnerability in the Siebel Core - Server Framework component of Oracle Siebel CRM (subcomponent: Services). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Core - Server Framework. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Core - Server Framework accessible data as well as unauthorized read access to a subset of Siebel Core - Server Framework accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10162 P-9001V-16.0 P-9001V-17.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9001V-16.0 P-9001V-17.0 Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10164 P-5026V-9.2 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5026V-9.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10165 P-8478V-5.7.19 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.7.19 and earlier Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware (subcomponent: C Oracle SSL API). Supported versions that are affected are FMW: 11.1.1.9.0 and 12.1.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Security Service. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Security Service accessible data. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10166 P-991V-FMW: 11.1.1.9.0 P-991V-12.1.3.0.0 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-991V-FMW: 11.1.1.9.0 P-991V-12.1.3.0.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10167 P-8478V-5.7.19 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.7.19 and earlier Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Session, Create Procedure privilege with logon to the infrastructure where Java VM executes to compromise Java VM. While the vulnerability is in Java VM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10190 P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 8.2 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management). The supported version that is affected is Prior to 3.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Integrated Lights Out Manager (ILOM). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Integrated Lights Out Manager (ILOM) accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10194 P-9849V-Prior to 3.2.6 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9849V-Prior to 3.2.6 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Folios). The supported version that is affected is 5.4.2.x through 5.5.1.x. Easily exploitable vulnerability allows physical access to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10197 P-11580V-5.4.2.x through 5.5.1.x 4.6 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11580V-5.4.2.x through 5.5.1.x Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Net). Supported versions that are affected are 6.9.9 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10203 P-8576V-6.9.9 and earlier 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8576V-6.9.9 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10227 P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10259 P-1773V-11.1.2.3.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1773V-11.1.2.3.0 Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management). The supported version that is affected is Prior to 3.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Integrated Lights Out Manager (ILOM). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Integrated Lights Out Manager (ILOM). CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10260 P-9849V-Prior to 3.2.6 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9849V-Prior to 3.2.6 Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with logon to the infrastructure where XML Database executes to compromise XML Database. While the vulnerability is in XML Database, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all XML Database accessible data. Note: This score is for Windows platform version 11.2.0.4 of Database. For Windows platform version 12.1.0.2 and Linux, the score is 5.5 with scope Unchanged. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2017-10261 P-5V-11.2.0.4 P-5V-12.1.0.2 6.5 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5V-11.2.0.4 P-5V-12.1.0.2 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: UIF Open UI). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel UI Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel UI Framework accessible data as well as unauthorized update, insert or delete access to some of Siebel UI Framework accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10263 P-9011V-16.0 P-9011V-17.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9011V-16.0 P-9011V-17.0 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: UIF Open UI). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel UI Framework. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10264 P-9011V-16.0 P-9011V-17.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9011V-16.0 P-9011V-17.0 Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management). The supported version that is affected is Prior to 3.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Integrated Lights Out Manager (ILOM). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Integrated Lights Out Manager (ILOM) accessible data as well as unauthorized read access to a subset of Oracle Integrated Lights Out Manager (ILOM) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Integrated Lights Out Manager (ILOM). CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-10265 P-9849V-Prior to 3.2.6 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9849V-Prior to 3.2.6 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10268 P-8478V-5.5.57 and earlier P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 4.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.5.57 and earlier P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory). The supported version that is affected is 9.1.1.5.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Identity Manager Connector. CVSS 3.0 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H). Fix has been released CVE-2017-10270 P-1999V-9.1.1.5.0 8.2 AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1999V-9.1.1.5.0 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10271 P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.1.0 P-5242V-12.2.1.2.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.1.0 P-5242V-12.2.1.2.0 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-10274 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9 6.8 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Filesystem). The supported version that is affected is AK 2013. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Sun ZFS Storage Appliance Kit (AK) executes to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10275 P-10006V-AK 2013 5.0 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10006V-AK 2013 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10276 P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Net). Supported versions that are affected are 6.9.9 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10277 P-8576V-6.9.9 and earlier 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8576V-6.9.9 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10279 P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.36 and earlier P-8478V-5.7.18 and earlier Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Test Framework). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10280 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10281 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Performance Schema). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10283 P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Stored Procedure). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10284 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.7.18 and earlier Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10285 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10286 P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10287 P-5136V-9.2 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5136V-9.2 Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create User privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS Security accessible data. CVSS 3.0 Base Score 2.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10292 P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 2.3 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10293 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10294 P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N). Fix has been released CVE-2017-10295 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 4.0 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10296 P-8478V-5.7.18 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.7.18 and earlier Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10299 P-4461V-9.3.5 P-4461V-9.3.6 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Siebel CRM Desktop component of Oracle Siebel CRM (subcomponent: Siebel Business Service Issues). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Desktop. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Desktop accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10300 P-7306V-16.0 P-7306V-17.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-7306V-16.0 P-7306V-17.0 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: UIF Open UI). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel UI Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel UI Framework accessible data as well as unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10302 P-9011V-16.0 P-9011V-17.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9011V-16.0 P-9011V-17.0 Vulnerability in the Oracle Interaction Center Intelligence component of Oracle E-Business Suite (subcomponent: Setup). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Interaction Center Intelligence. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Interaction Center Intelligence, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Interaction Center Intelligence accessible data as well as unauthorized update, insert or delete access to some of Oracle Interaction Center Intelligence accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10303 P-298V-12.1.1 P-298V-12.1.2 P-298V-12.1.3 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-298V-12.1.1 P-298V-12.1.2 P-298V-12.1.3 Vulnerability in the PeopleSoft Enterprise HCM component of Oracle PeopleSoft Products (subcomponent: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10304 P-5071V-9.2 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5071V-9.2 Vulnerability in the PeopleSoft Enterprise HCM component of Oracle PeopleSoft Products (subcomponent: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10306 P-5071V-9.2 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5071V-9.2 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Performance). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows physical access to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 3.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10308 P-4461V-9.3.5 P-4461V-9.3.6 3.5 AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u144 and 9. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10309 P-856V-Java SE: 8u144 P-856V-9 7.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 8u144 P-856V-9 Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). The supported version that is affected is 11.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10310 P-8776V-11.1.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8776V-11.1.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS). Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10311 P-8478V-5.7.19 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.7.19 and earlier Vulnerability in the Oracle Hyperion BI+ component of Oracle Hyperion (subcomponent: UI and Visualization). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion BI+. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion BI+ accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion BI+ accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-10312 P-4361V-11.1.2.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4361V-11.1.2.4 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Group Replication GCS). Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10313 P-8478V-5.7.19 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.7.19 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10314 P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: UIF Open UI). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel UI Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel UI Framework accessible data as well as unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10315 P-9011V-16.0 P-9011V-17.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9011V-16.0 P-9011V-17.0 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10316 P-12619V-8.10.1 P-12619V-8.10.2 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Suite8 executes to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10317 P-12619V-8.10.1 P-12619V-8.10.2 4.0 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Suite8, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N). Fix has been released CVE-2017-10318 P-12619V-8.10.1 P-12619V-8.10.2 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10319 P-12619V-8.10.1 P-12619V-8.10.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10320 P-8478V-5.7.19 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.7.19 and earlier Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows low privileged attacker having Create session privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Core RDBMS. Note: This score is for Windows platform version 11.2.0.4 of Database. For Windows platform version 12.1.0.2 and Linux, the score is 7.8 with scope Unchanged. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10321 P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 Vulnerability in the Oracle Common Applications Calendar component of Oracle E-Business Suite (subcomponent: Applications Calendar). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications Calendar. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Common Applications Calendar accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10322 P-1528V-12.1.1 P-1528V-12.1.2 P-1528V-12.1.3 P-1528V-12.2.3 P-1528V-12.2.4 P-1528V-12.2.5 P-1528V-12.2.6 P-1528V-12.2.7 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1528V-12.1.1 P-1528V-12.1.2 P-1528V-12.1.3 P-1528V-12.2.3 P-1528V-12.2.4 P-1528V-12.2.5 P-1528V-12.2.6 P-1528V-12.2.7 Vulnerability in the Oracle Web Applications Desktop Integrator component of Oracle E-Business Suite (subcomponent: Application Service). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Applications Desktop Integrator, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Applications Desktop Integrator accessible data as well as unauthorized update, insert or delete access to some of Oracle Web Applications Desktop Integrator accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10323 P-1171V-12.1.1 P-1171V-12.1.2 P-1171V-12.1.3 P-1171V-12.2.3 P-1171V-12.2.4 P-1171V-12.2.5 P-1171V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1171V-12.1.1 P-1171V-12.1.2 P-1171V-12.1.3 P-1171V-12.2.3 P-1171V-12.2.4 P-1171V-12.2.5 P-1171V-12.2.6 Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite (subcomponent: Oracle Forms). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Technology Stack accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10324 P-1745V-12.1.3 P-1745V-12.2.3 P-1745V-12.2.4 P-1745V-12.2.5 P-1745V-12.2.6 P-1745V-12.2.7 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1745V-12.1.3 P-1745V-12.2.3 P-1745V-12.2.4 P-1745V-12.2.5 P-1745V-12.2.6 P-1745V-12.2.7 Vulnerability in the Oracle Common Applications Calendar component of Oracle E-Business Suite (subcomponent: Applications Calendar). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications Calendar. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications Calendar, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications Calendar accessible data as well as unauthorized update, insert or delete access to some of Oracle Common Applications Calendar accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10325 P-1528V-12.1.1 P-1528V-12.1.2 P-1528V-12.1.3 P-1528V-12.2.3 P-1528V-12.2.4 P-1528V-12.2.5 P-1528V-12.2.6 P-1528V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1528V-12.1.1 P-1528V-12.1.2 P-1528V-12.1.3 P-1528V-12.2.3 P-1528V-12.2.4 P-1528V-12.2.5 P-1528V-12.2.6 P-1528V-12.2.7 Vulnerability in the Oracle Common Applications Calendar component of Oracle E-Business Suite (subcomponent: Applications Calendar). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications Calendar. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications Calendar, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications Calendar accessible data as well as unauthorized update, insert or delete access to some of Oracle Common Applications Calendar accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10326 P-1528V-12.1.1 P-1528V-12.1.2 P-1528V-12.1.3 P-1528V-12.2.3 P-1528V-12.2.4 P-1528V-12.2.5 P-1528V-12.2.6 P-1528V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1528V-12.1.1 P-1528V-12.1.2 P-1528V-12.1.3 P-1528V-12.2.3 P-1528V-12.2.4 P-1528V-12.2.5 P-1528V-12.2.6 P-1528V-12.2.7 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Query). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10327 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10328 P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 P-510V-12.2.7 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 P-510V-12.2.7 Vulnerability in the Oracle Global Order Promising component of Oracle E-Business Suite (subcomponent: Reschedule Sales Orders). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Order Promising. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Order Promising accessible data as well as unauthorized access to critical data or complete access to all Oracle Global Order Promising accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-10329 P-729V-12.1.1 P-729V-12.1.2 P-729V-12.1.3 P-729V-12.2.3 P-729V-12.2.4 P-729V-12.2.5 P-729V-12.2.6 P-729V-12.2.7 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-729V-12.1.1 P-729V-12.1.2 P-729V-12.1.3 P-729V-12.2.3 P-729V-12.2.4 P-729V-12.2.5 P-729V-12.2.6 P-729V-12.2.7 Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Gantt Server). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications accessible data as well as unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-10330 P-1198V-12.1.3 P-1198V-12.2.3 P-1198V-12.2.4 P-1198V-12.2.5 P-1198V-12.2.6 P-1198V-12.2.7 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1198V-12.1.3 P-1198V-12.2.3 P-1198V-12.2.4 P-1198V-12.2.5 P-1198V-12.2.6 P-1198V-12.2.7 Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10331 P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 P-510V-12.2.7 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 P-510V-12.2.7 Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10332 P-778V-12.1.1 P-778V-12.1.2 P-778V-12.1.3 P-778V-12.2.3 P-778V-12.2.4 P-778V-12.2.5 P-778V-12.2.6 P-778V-12.2.7 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-778V-12.1.1 P-778V-12.1.2 P-778V-12.1.3 P-778V-12.2.3 P-778V-12.2.4 P-778V-12.2.5 P-778V-12.2.6 P-778V-12.2.7 Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: EAI). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel UI Framework. While the vulnerability is in Siebel UI Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel UI Framework accessible data as well as unauthorized read access to a subset of Siebel UI Framework accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel UI Framework. CVSS 3.0 Base Score 7.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10333 P-9011V-16.0 P-9011V-17.0 7.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9011V-16.0 P-9011V-17.0 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10334 P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.1.0 P-5242V-12.2.1.2.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.1.0 P-5242V-12.2.1.2.0 Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Elastic Search). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PT PeopleTools accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10335 P-5085V-8.55 P-5085V-8.56 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10336 P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.1.0 P-5242V-12.2.1.2.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.1.0 P-5242V-12.2.1.2.0 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Suite8. CVSS 3.0 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L). Fix has been released CVE-2017-10337 P-12619V-8.10.1 P-12619V-8.10.2 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Enterprise Portal). The supported version that is affected is 9.1.00. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10338 P-5090V-9.1.00 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5090V-9.1.00 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect). Supported versions that are affected are 8.10.1 and 8.10.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10339 P-12619V-8.10.1 P-12619V-8.10.2 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Import/Export). Supported versions that are affected are 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data as well as unauthorized read access to a subset of Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10340 P-11594V-2.8 P-11594V-2.9 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11594V-2.8 P-11594V-2.9 Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java Advanced Management Console. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java Advanced Management Console accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10341 P-856V-Java Advanced Management Console: 2.7 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java Advanced Management Console: 2.7 Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java Advanced Management Console. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java Advanced Management Console. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10342 P-856V-Java Advanced Management Console: 2.7 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java Advanced Management Console: 2.7 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Import/Export). Supported versions that are affected are 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10343 P-11594V-2.8 P-11594V-2.9 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11594V-2.8 P-11594V-2.9 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Import/Export). Supported versions that are affected are 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-10344 P-11594V-2.8 P-11594V-2.9 6.5 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11594V-2.8 P-11594V-2.9 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10345 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10346 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10347 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10348 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10349 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE: 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10350 P-856V-Java SE: 7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Application Server). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PT PeopleTools accessible data. CVSS 3.0 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10351 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 6.2 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS-WebServices). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10352 P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.1.0 P-5242V-12.2.1.2.0 P-5242V-12.2.1.3.0 9.9 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.1.0 P-5242V-12.2.1.2.0 P-5242V-12.2.1.3.0 Vulnerability in the Oracle Hospitality Hotel Mobile component of Oracle Hospitality Applications (subcomponent: Suite8/RESTAPI). The supported version that is affected is 1.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Hotel Mobile. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Hotel Mobile accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Hotel Mobile. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Fix has been released CVE-2017-10353 P-13023V-1.1 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-13023V-1.1 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Enterprise Portal). The supported version that is affected is 9.1.00. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10354 P-5090V-9.1.00 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5090V-9.1.00 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10355 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10356 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 6.2 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144; JRockit: R28.3.15 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10357 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Workspace). The supported version that is affected is 11.1.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10358 P-8776V-11.1.2 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8776V-11.1.2 Vulnerability in the Oracle Hyperion BI+ component of Oracle Hyperion (subcomponent: UI and Visualization). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion BI+. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion BI+ accessible data as well as unauthorized read access to a subset of Oracle Hyperion BI+ accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10359 P-4361V-11.1.2.4 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4361V-11.1.2.4 Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N). Fix has been released CVE-2017-10360 P-2271V-11.1.1.9.0 P-2271V-12.2.1.1.0 P-2271V-12.2.1.2.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-2271V-11.1.1.9.0 P-2271V-12.2.1.1.0 P-2271V-12.2.1.2.0 Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: OHC DRS). The supported version that is affected is 8.0.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management System. While the vulnerability is in Oracle Hospitality Cruise Shipboard Property Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management System accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Cruise Shipboard Property Management System. CVSS 3.0 Base Score 6.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L). Fix has been released CVE-2017-10361 P-11607V-8.0.2.0 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11607V-8.0.2.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Sawbridge). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 7.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L). Fix has been released CVE-2017-10362 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 7.2 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Security). Supported versions that are affected are 11.3, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data. Note: Contact Support for fixes. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-10363 P-9052V-11.3 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 P-9052V-12.4.0 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9052V-11.3 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 P-9052V-12.4.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Updates Environment Mgmt). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-10364 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 3.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2017-10365 P-8478V-5.7.18 and earlier 3.8 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.7.18 and earlier Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-10366 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Engagement). Supported versions that are affected are 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data as well as unauthorized read access to a subset of Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10367 P-11594V-2.8 P-11594V-2.9 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11594V-2.8 P-11594V-2.9 Vulnerability in the PeopleSoft Enterprise SCM eProcurement component of Oracle PeopleSoft Products (subcomponent: Manage Requisition Status). Supported versions that are affected are 9.1.00 and 9.2.00. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise SCM eProcurement, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM eProcurement accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10368 P-5118V-9.1.00 P-5118V-9.2.00 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5118V-9.1.00 P-5118V-9.2.00 Vulnerability in the Oracle Virtual Directory component of Oracle Fusion Middleware (subcomponent: Virtual Directory Server). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-10369 P-1978V-11.1.1.7.0 P-1978V-11.1.1.9.0 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1978V-11.1.1.7.0 P-1978V-11.1.1.9.0 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Guest Access, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Guest Access accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10370 P-12617V-4.2.0 P-12617V-4.2.1 6.9 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. While the vulnerability is in Oracle Hospitality Guest Access, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Guest Access accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Guest Access. CVSS 3.0 Base Score 8.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H). Fix has been released CVE-2017-10372 P-12617V-4.2.0 P-12617V-4.2.1 8.7 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Health Center). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PT PeopleTools accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10373 P-5085V-8.55 P-5085V-8.56 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Guest Access accessible data as well as unauthorized read access to a subset of Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10375 P-12617V-4.2.0 P-12617V-4.2.1 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10378 P-8478V-5.5.57 and earlier P-8478V-5.6.37 and earlier P-8478V-5.7.11 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.5.57 and earlier P-8478V-5.6.37 and earlier P-8478V-5.7.11 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10379 P-8478V-5.5.57 and earlier P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.5.57 and earlier P-8478V-5.6.37 and earlier P-8478V-5.7.19 and earlier Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java Advanced Management Console. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java Advanced Management Console, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java Advanced Management Console accessible data as well as unauthorized read access to a subset of Java Advanced Management Console accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10380 P-856V-Java Advanced Management Console: 2.7 4.7 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java Advanced Management Console: 2.7 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10381 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). Fix has been released CVE-2017-10382 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Interface). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10383 P-12617V-4.2.0 P-12617V-4.2.1 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.57 and earlier 5.6.37 and earlier 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-10384 P-8478V-5.5.57 and earlier5.6.37 and earlier5.7.19 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.5.57 and earlier5.6.37 and earlier5.7.19 and earlier Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-10385 P-8493V-3.0.1 P-8493V-3.1.2 6.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8493V-3.0.1 P-8493V-3.1.2 Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.7. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Java Advanced Management Console. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java Advanced Management Console, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java Advanced Management Console accessible data as well as unauthorized read access to a subset of Java Advanced Management Console accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10386 P-856V-Java Advanced Management Console: 2.7 4.8 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java Advanced Management Console: 2.7 Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-10387 P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 P-1199V-12.2.7 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1199V-12.1.3 P-1199V-12.2.3 P-1199V-12.2.4 P-1199V-12.2.5 P-1199V-12.2.6 P-1199V-12.2.7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-10388 P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-856V-Java SE: 6u161 P-856V-7u151 P-856V-8u144 P-856V-9; Java SE Embedded: 8u144 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: PMS). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Suite8 executes to compromise Oracle Hospitality Suite8. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Suite8, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Suite8 accessible data as well as unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Suite8. CVSS 3.0 Base Score 5.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10389 P-12619V-8.10.1 P-12619V-8.10.2 5.7 AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-10391 P-8493V-3.0.1 P-8493V-3.1.2 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8493V-3.0.1 P-8493V-3.1.2 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10392 P-8370V-Prior to 5.1.30 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8370V-Prior to 5.1.30 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-10393 P-8493V-3.0.1 P-8493V-3.1.2 6.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8493V-3.0.1 P-8493V-3.1.2 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Security). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2017-10394 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: GangwayActivityWebApp). The supported version that is affected is 9.0.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10395 P-11608V-9.0.2.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11608V-9.0.2.0 Vulnerability in the Oracle Hospitality Cruise AffairWhere component of Oracle Hospitality Applications (subcomponent: AffairWhere). Supported versions that are affected are 2.2.5.0, 2.2.6.0 and 2.2.7.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise AffairWhere executes to compromise Oracle Hospitality Cruise AffairWhere. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise AffairWhere, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Cruise AffairWhere. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10396 P-11611V-2.2.5.0 P-11611V-2.2.6.0 P-11611V-2.2.7.0 8.2 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11611V-2.2.5.0 P-11611V-2.2.6.0 P-11611V-2.2.7.0 Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: BaseMasterPage). The supported version that is affected is 9.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise Fleet Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10397 P-11608V-9.0.2.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11608V-9.0.2.0 Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: BaseMasterPage). The supported version that is affected is 9.0.2.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise Fleet Management executes to compromise Oracle Hospitality Cruise Fleet Management. While the vulnerability is in Oracle Hospitality Cruise Fleet Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Fix has been released CVE-2017-10398 P-11608V-9.0.2.0 8.4 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11608V-9.0.2.0 Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: GangwayActivityWebApp). The supported version that is affected is 9.0.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Cruise Fleet Management. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-10399 P-11608V-9.0.2.0 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11608V-9.0.2.0 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration Graphical User Interface). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10400 P-8493V-3.1.2 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8493V-3.1.2 Vulnerability in the Oracle Hospitality Cruise Materials Management component of Oracle Hospitality Applications (subcomponent: MMSUpdater). The supported version that is affected is 7.30.564.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise Materials Management executes to compromise Oracle Hospitality Cruise Materials Management. While the vulnerability is in Oracle Hospitality Cruise Materials Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Cruise Materials Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Materials Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Cruise Materials Management. CVSS 3.0 Base Score 8.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H). Fix has been released CVE-2017-10401 P-11604V-7.30.564.0 8.7 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11604V-7.30.564.0 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Report). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. While the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10402 P-11599V-8.5.1 P-11599V-9.0.0 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: iQuery). Supported versions that are affected are 8.5.1 and 9.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10403 P-11599V-8.5.1 P-11599V-9.0.0 8.0 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: iQuery). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Fix has been released CVE-2017-10404 P-11599V-8.5.1 P-11599V-9.0.0 8.3 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Report). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L). Fix has been released CVE-2017-10405 P-11599V-8.5.1 P-11599V-9.0.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10406 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10407 P-8370V-Prior to 5.1.30 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8370V-Prior to 5.1.30 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10408 P-8370V-Prior to 5.1.30 7.3 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8370V-Prior to 5.1.30 Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Merchant UI). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10409 P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 P-384V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 P-384V-12.2.7 Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: Search). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Knowledge Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Knowledge Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10410 P-1351V-12.1.1 P-1351V-12.1.2 P-1351V-12.1.3 P-1351V-12.2.3 P-1351V-12.2.4 P-1351V-12.2.5 P-1351V-12.2.6 P-1351V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1351V-12.1.1 P-1351V-12.1.2 P-1351V-12.1.3 P-1351V-12.2.3 P-1351V-12.2.4 P-1351V-12.2.5 P-1351V-12.2.6 P-1351V-12.2.7 Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Knowledge Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Knowledge Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10411 P-1351V-12.1.1 P-1351V-12.1.2 P-1351V-12.1.3 P-1351V-12.2.3 P-1351V-12.2.4 P-1351V-12.2.5 P-1351V-12.2.6 P-1351V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1351V-12.1.1 P-1351V-12.1.2 P-1351V-12.1.3 P-1351V-12.2.3 P-1351V-12.2.4 P-1351V-12.2.5 P-1351V-12.2.6 P-1351V-12.2.7 Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Knowledge Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Knowledge Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10412 P-1351V-12.1.1 P-1351V-12.1.2 P-1351V-12.1.3 P-1351V-12.2.3 P-1351V-12.2.4 P-1351V-12.2.5 P-1351V-12.2.6 P-1351V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1351V-12.1.1 P-1351V-12.1.2 P-1351V-12.1.3 P-1351V-12.2.3 P-1351V-12.2.4 P-1351V-12.2.5 P-1351V-12.2.6 P-1351V-12.2.7 Vulnerability in the Oracle Mobile Field Service component of Oracle E-Business Suite (subcomponent: Multiplatform Based on HTML5). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Mobile Field Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data as well as unauthorized update, insert or delete access to some of Oracle Mobile Field Service accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10413 P-753V-12.1.1 P-753V-12.1.2 P-753V-12.1.3 P-753V-12.2.3 P-753V-12.2.4 P-753V-12.2.5 P-753V-12.2.6 P-753V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-753V-12.1.1 P-753V-12.1.2 P-753V-12.1.3 P-753V-12.2.3 P-753V-12.2.4 P-753V-12.2.5 P-753V-12.2.6 P-753V-12.2.7 Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Checkout and Order Placement). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10414 P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 P-384V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 P-384V-12.2.7 Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Others). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data as well as unauthorized update, insert or delete access to some of Oracle iSupport accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10415 P-381V-12.1.1 P-381V-12.1.2 P-381V-12.1.3 P-381V-12.2.3 P-381V-12.2.4 P-381V-12.2.5 P-381V-12.2.6 P-381V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-381V-12.1.1 P-381V-12.1.2 P-381V-12.1.3 P-381V-12.2.3 P-381V-12.2.4 P-381V-12.2.5 P-381V-12.2.6 P-381V-12.2.7 Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: Setup and Configuration). Supported versions that are affected are 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10416 P-785V-12.2.3 P-785V-12.2.4 P-785V-12.2.5 P-785V-12.2.6 P-785V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-785V-12.2.3 P-785V-12.2.4 P-785V-12.2.5 P-785V-12.2.6 P-785V-12.2.7 Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: Setup and Configuration). Supported versions that are affected are 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10417 P-785V-12.2.3 P-785V-12.2.4 P-785V-12.2.5 P-785V-12.2.6 P-785V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-785V-12.2.3 P-785V-12.2.4 P-785V-12.2.5 P-785V-12.2.6 P-785V-12.2.7 Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: PeopleSoft CDA). The supported version that is affected is 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. While the vulnerability is in PeopleSoft Enterprise PT PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PT PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-10418 P-5085V-8.56 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.56 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: PMS). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Suite8 executes to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Suite8 accessible data as well as unauthorized read access to a subset of Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 5.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10419 P-12619V-8.10.1 P-12619V-8.10.2 5.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Suite8. While the vulnerability is in Oracle Hospitality Suite8, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Suite8 accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Suite8. CVSS 3.0 Base Score 6.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L). Fix has been released CVE-2017-10420 P-12619V-8.10.1 P-12619V-8.10.2 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: Leisure). Supported versions that are affected are 8.10.1 and 8.10.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Suite8. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Suite8 accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10421 P-12619V-8.10.1 P-12619V-8.10.2 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12619V-8.10.1 P-12619V-8.10.2 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Updates Change Assistant). The supported version that is affected is 8.54. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10422 P-5085V-8.54 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5085V-8.54 Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Web). Supported versions that are affected are 3.2.8.2223 and earlier, 3.3.4.3247 and earlier and 3.4.2.4181 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-10424 P-8480V-3.2.8.2223 and earlier P-8480V-3.3.4.3247 and earlier P-8480V-3.4.2.4181 and earlier 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8480V-3.2.8.2223 and earlier P-8480V-3.3.4.3247 and earlier P-8480V-3.4.2.4181 and earlier Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Service Host). Supported versions that are affected are 2.6, 2.7, 2.8 and 2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data as well as unauthorized read access to a subset of Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-10425 P-11594V-2.6 P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11594V-2.6 P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-10426 P-5026V-9.2 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-5026V-9.2 Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Point of Sale). Supported versions that are affected are 6.0.11, 6.5.11, 7.0.6, 7.1.6 and 15.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. While the vulnerability is in Oracle Retail Xstore Point of Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Xstore Point of Service. CVSS 3.0 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10427 P-11513V-6.0.11 P-11513V-6.5.11 P-11513V-7.0.6 P-11513V-7.1.6 P-11513V-15.0.1 6.5 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11513V-6.0.11 P-11513V-6.5.11 P-11513V-7.0.6 P-11513V-7.1.6 P-11513V-15.0.1 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10428 P-8370V-Prior to 5.1.30 5.0 AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8370V-Prior to 5.1.30 Vulnerability in the Oracle Secure Global Desktop (SGD) component of Oracle Virtualization (subcomponent: Web Server (Apache HTTP Server)). The supported version that is affected is 5.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Secure Global Desktop (SGD). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Secure Global Desktop (SGD) accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Global Desktop (SGD). CVSS 3.0 Base Score 7.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H). Fix has been released CVE-2017-3167 P-8539V-5.3 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8539V-5.3 Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Trade Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3444 P-765V-12.1.1 P-765V-12.1.2 P-765V-12.1.3 P-765V-12.2.3 P-765V-12.2.4 P-765V-12.2.5 P-765V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-765V-12.1.1 P-765V-12.1.2 P-765V-12.1.3 P-765V-12.2.3 P-765V-12.2.4 P-765V-12.2.5 P-765V-12.2.6 Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Trade Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3445 P-765V-12.1.1 P-765V-12.1.2 P-765V-12.1.3 P-765V-12.2.3 P-765V-12.2.4 P-765V-12.2.5 P-765V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-765V-12.1.1 P-765V-12.1.2 P-765V-12.1.3 P-765V-12.2.3 P-765V-12.2.4 P-765V-12.2.5 P-765V-12.2.6 Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Trade Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3446 P-765V-12.1.1 P-765V-12.1.2 P-765V-12.1.3 P-765V-12.2.3 P-765V-12.2.4 P-765V-12.2.5 P-765V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-765V-12.1.1 P-765V-12.1.2 P-765V-12.1.3 P-765V-12.2.3 P-765V-12.2.4 P-765V-12.2.5 P-765V-12.2.6 Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: HA for MySQL). Supported versions that are affected are 3.3 and 4.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris Cluster executes to compromise Solaris Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris Cluster accessible data as well as unauthorized access to critical data or complete access to all Solaris Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris Cluster. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L). Fix has been released CVE-2017-3588 P-10005V-3.3 P-10005V-4.3 7.3 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-10005V-3.3 P-10005V-4.3 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption (OpenSSL)). Supported versions that are affected are 5.6.35 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3731 P-8478V-5.6.35 and earlier P-8478V-5.7.18 and earlier 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8478V-5.6.35 and earlier P-8478V-5.7.18 and earlier Vulnerability in the Oracle Agile Engineering Data Management component of Oracle Supply Chain Products Suite (subcomponent: Install (OpenSSL)). Supported versions that are affected are 6.1.3 and 6.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-4436V-6.1.3 P-4436V-6.2.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4436V-6.1.3 P-4436V-6.2.0 Vulnerability in the Oracle Communications EAGLE LNP Application Processor component of Oracle Communications Applications (subcomponent: Patches (OpenSSL)). The supported version that is affected is 10.x. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications EAGLE LNP Application Processor. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications EAGLE LNP Application Processor accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-11118V-10.x 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11118V-10.x Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Enterprise Infrastructure SEC (OpenSSL)). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-4781V-9.2 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4781V-9.2 Vulnerability in the JD Edwards World Security component of Oracle JD Edwards Products (subcomponent: GUI / World Vision (OpenSSL)). Supported versions that are affected are A9.1, A9.2, A9.3 and A9.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards World Security. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards World Security accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-4839V-A9.1 P-4839V-A9.2 P-4839V-A9.3 P-4839V-A9.4 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-4839V-A9.1 P-4839V-A9.2 P-4839V-A9.3 P-4839V-A9.4 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core (OpenSSL)). The supported version that is affected is Prior to 5.1.30. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3733 P-8370V-Prior to 5.1.30 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8370V-Prior to 5.1.30 Vulnerability in the Oracle Communications Messaging Server component of Oracle Communications Applications (subcomponent: Security (NSS)). The supported version that is affected is 8.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Messaging Server. Successful attacks of this vulnerability can result in takeover of Oracle Communications Messaging Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5461 P-8496V-8.x 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8496V-8.x Vulnerability in the Oracle API Gateway component of Oracle Fusion Middleware (subcomponent: Oracle API Gateway (Apache Batik)). The supported version that is affected is 11.1.2.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle API Gateway. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle API Gateway accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle API Gateway. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2313917.1">My Oracle Support Note 2313917.1</a> for instructions on how to address this issue. CVSS 3.0 Base Score 7.3 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H). Fix has been released CVE-2017-5662 P-9195V-11.1.2.4.0 7.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-9195V-11.1.2.4.0 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base (Apache Batik)). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Guest Access accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Guest Access. CVSS 3.0 Base Score 7.3 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H). Fix has been released CVE-2017-5662 P-12617V-4.2.0 P-12617V-4.2.1 7.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the MICROS Retail XBRi Loss Prevention component of Oracle Retail Applications (subcomponent: Retail (Apache Batik)). Supported versions that are affected are 10.0.1, 10.5.0, 10.6.0, 10.7.7, 10.8.0 and 10.8.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MICROS Retail XBRi Loss Prevention. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MICROS Retail XBRi Loss Prevention accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MICROS Retail XBRi Loss Prevention. CVSS 3.0 Base Score 7.3 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H). Fix has been released CVE-2017-5662 P-11564V-10.0.1 P-11564V-10.5.0 P-11564V-10.6.0 P-11564V-10.7.7 P-11564V-10.8.0 P-11564V-10.8.1 7.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11564V-10.0.1 P-11564V-10.5.0 P-11564V-10.6.0 P-11564V-10.7.7 P-11564V-10.8.0 P-11564V-10.8.1 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base (Apache Tomcat)). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Guest Access. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5664 P-12617V-4.2.0 P-12617V-4.2.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: General (Apache Tomcat)). Supported versions that are affected are 3.2.8.2223 and earlier, 3.3.4.3247 and earlier and 3.4.2.4181 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Enterprise Monitor accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-5664 P-8480V-3.2.8.2223 and earlier P-8480V-3.3.4.3247 and earlier P-8480V-3.4.2.4181 and earlier 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-8480V-3.2.8.2223 and earlier P-8480V-3.3.4.3247 and earlier P-8480V-3.4.2.4181 and earlier Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Install (Apache Tomcat)). Supported versions that are affected are 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6 and 6.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Transportation Management accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-5664 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 Vulnerability in the MICROS Retail XBRi Loss Prevention component of Oracle Retail Applications (subcomponent: Retail (Apache Tomcat)). Supported versions that are affected are 10.0.1, 10.5.0, 10.6.0, 10.7.7, 10.8.0 and 10.8.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail XBRi Loss Prevention. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MICROS Retail XBRi Loss Prevention accessible data as well as unauthorized access to critical data or complete access to all MICROS Retail XBRi Loss Prevention accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-5664 P-11506V-10.0.1 P-11506V-10.5.0 P-11506V-10.6.0 P-11506V-10.7.7 P-11506V-10.8.0 P-11506V-10.8.1 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-11506V-10.0.1 P-11506V-10.5.0 P-11506V-10.6.0 P-11506V-10.7.7 P-11506V-10.8.0 P-11506V-10.8.1 Vulnerability in the Oracle Server X7-2/2L, X7-8 component of Oracle Sun Systems Products Suite (subcomponent: Firmware). Supported versions that are affected are 1.0 and 1.0.1 and 1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Server X7-2/2L, X7-8 executes to compromise Oracle Server X7-2/2L, X7-8. While the vulnerability is in Oracle Server X7-2/2L, X7-8, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Server X7-2/2L, X7-8. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5706 P-12974V-1.0 and 1.0.1 P-12974V-1.0 8.2 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CPUOct2017 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2017.html P-12974V-1.0 and 1.0.1 P-12974V-1.0