Oracle Critical Patch Update Advisory - January 2018 - Oracle CVRF Oracle Critical Patch Update Advisory CPUJan2018 Final 1.0 1.0 2018-01-16T13:00:00-07:00 Initial Distribution 2018-01-16T13:00:00-07:00 2018-01-16T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had fixes released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including fix distribution information can be found at the Oracle sites referenced in this document. This document is published at: http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/4110638.xml https://www.oracle.com/security-alerts/cpujan2018.html URL to html version of Advisory Adam Willard Blue Canopy Alexander Mirosh Hewlett Packard Enterprise Ali Wamim Khan Ali Wamim Khan Allen Reese Allen Reese Alvaro Munoz Hewlett Packard Enterprise Andrea Micalizzi aka rgod, working with Trend Micro's Zero Day Initiative Apostolos Giannakidis Waratek Brandon Vincent Cameron Dawe Spam404.com Chacko K Abraham Chacko K Abraham Cole Woods Cole Woods Daniel Bleichenbacher of Google Devin Rosenbauer Identity Works LLC Dhiraj Mishra Dhiraj Mishra Dmitrii Iudin aka @ret5et of ERPScan Dmitry Chastuhin ERPScan Egidio Romano Karma(In)Security Florian Ohlms Daimler TSS Gourav Kumar Jha Gourav Kumar Jha Greg Hudson MIT Kerberos team Himanshu Mehta Himanshu Mehta Ifrah Iman Ifrah Iman Jeremy Buis softwaresecured.com Joao F M Figueiredo Joao F M Figueiredo John Page (hyp3rlinx) Juan Pablo Perez Etchegoyen Onapsis Kenan Can Kenan Can Kenan Genc Kenan Genç Li ChaoHan Bon Li ChaoHan Bon Lukasz Mikula LUKASZ MIKULA Lukasz Plonka ING Services Polska Marc Heuse Marc Heuse Marcin Wołoszyn ING Services Polska Marek Janiczek Prevenity Matej Tymes Matej Tymes Michal Rydlo Michal Rydlo Mohammad Shah Bin Mohammad Esa SEC Consult Vulnerability Lab Mohammed Nazim Rafiq Mohit Rawat Mohit Rawat Moritz Bechler Moritz Bechler (eenterphace.org) Muhammad Uwais Muhammad Uwais Niklas Baumstark Niklas Baumstark Niklas Baumstark via Beyond Security's SecuriTeam Secure Disclosure program Olaf Kummer CoreMedia Paolo Stagno aka VoidSec Reha Esen from VeraSafe.com Reno Robert Reno Robert Richard Alviarez Richard Alviarez Rohit Varude Rohit Varude SaifAllah benMassaoud SaifAllah benMassaoud Appidi Saikumar Reddy Samandeep Singh SEC Consult Vulnerability Lab Sebastian Fuchs NTT Security Sergius Low Jun Kai Sergius Low Jun Kai Sherif Koussa softwaresecured.com Spyridon Chatzimichail of OTE Hellenic Telecommunications Organization S.A. Sreedeep Ck Alavil of Kerala Police Cyber Dome Volunteers Commander Sumit Khandelwal Sumit Khandelwal Red Hat Product Security Travis Emmert Exodus Intelligence Ugur Can Atasoy Ugur Can Atasoy Unmesh Jore Unmesh Jore Vasily Vasiliev Trend Micro's Zero Day Initiative Vijay Saindane Vijay Saindane Vladimir Parfinenko Excelsior-usa Zuozhi Fan Communications Order and Service Management Version 7.2.4.1.x Communications Order and Service Management Version 7.2.4.2.x Communications Order and Service Management Version 7.3.0.1.x Communications Order and Service Management Version 7.3.0.x.x Communications Unified Inventory Management Version 7.2.4.2.x Communications Unified Inventory Management Version 7.3 Communications Network Charging and Control Version 6.0 Communications Services Gatekeeper Version 5.1 Communications Services Gatekeeper Version 6.0 Communications BRM - Elastic Charging Engine Version 7.5 Communications Application Session Controller Version 3.x Communications User Data Repository Version 10.x Communications User Data Repository Version 12.x Communications Convergent Charging Controller Version 6.0 Primavera Unifier Version 10.x Primavera Unifier Version 15.x Primavera Unifier Version 16.x Primavera Unifier Version 17.x Oracle Database Version 11.2.0.4 Oracle Database Version 12.1.0.2 Oracle Database Version 12.2.0.1 Application Express Version Prior to 5.1.4.00.08 Applications DBA Version 12.1.3 Applications DBA Version 12.2.3 Applications DBA Version 12.2.4 Applications DBA Version 12.2.5 Applications DBA Version 12.2.6 Applications DBA Version 12.2.7 General Ledger Version 12.1.1 General Ledger Version 12.1.2 General Ledger Version 12.1.3 General Ledger Version 12.2.3 General Ledger Version 12.2.4 General Ledger Version 12.2.5 General Ledger Version 12.2.6 General Ledger Version 12.2.7 Application Object Library Version 12.1.3 Application Object Library Version 12.2.3 Application Object Library Version 12.2.4 Application Object Library Version 12.2.5 Application Object Library Version 12.2.6 Application Object Library Version 12.2.7 Work in Process Version 12.1.1 Work in Process Version 12.1.2 Work in Process Version 12.1.3 Work in Process Version 12.2.3 Work in Process Version 12.2.4 Work in Process Version 12.2.5 Work in Process Version 12.2.6 Work in Process Version 12.2.7 User Management Version 12.1.3 User Management Version 12.2.3 User Management Version 12.2.4 User Management Version 12.2.5 User Management Version 12.2.6 User Management Version 12.2.7 E-Business Suite Technology Stack Version 12.1.3 Financial Services Profitability Management Version 6.1.x Financial Services Profitability Management Version 8.0.x Financial Services Funds Transfer Pricing Version 6.1.x Financial Services Funds Transfer Pricing Version 8.0.x Financial Services Asset Liability Management Version 6.1.x Financial Services Asset Liability Management Version 8.0.x Financial Services Balance Sheet Planning Version 8.0.x Financial Services Analytical Applications Infrastructure Version 7.3.5.x Financial Services Analytical Applications Infrastructure Version 8.0.x Financial Services Analytical Applications Reconciliation Framework Version 8.0.x Financial Services Price Creation and Discovery Version 8.0.5 FLEXCUBE Universal Banking Version 11.3.0 FLEXCUBE Universal Banking Version 11.4.0 FLEXCUBE Universal Banking Version 11.5.0 FLEXCUBE Universal Banking Version 11.6.0 FLEXCUBE Universal Banking Version 11.7.0 FLEXCUBE Universal Banking Version 12.0.1 FLEXCUBE Universal Banking Version 12.0.2 FLEXCUBE Universal Banking Version 12.0.3 FLEXCUBE Universal Banking Version 12.1.0 FLEXCUBE Universal Banking Version 12.2.0 FLEXCUBE Universal Banking Version 12.3.0 FLEXCUBE Universal Banking Version 12.4.0 Financial Services Liquidity Risk Management Version 8.0.x FLEXCUBE Direct Banking Version 12.0.2 FLEXCUBE Direct Banking Version 12.0.3 Financial Services Hedge Management and IFRS Valuations Version 8.0.x Financial Services Loan Loss Forecasting and Provisioning Version 8.0.x Financial Services Market Risk Version 8.0.x Banking Corporate Lending Version 12.3.0 Banking Corporate Lending Version 12.4.0 Banking Payments Version 12.3.0 Banking Payments Version 12.4.0 Financial Services Market Risk Measurement and Management Version 8.0.5 Internet Directory Version 11.1.1.7.0 Internet Directory Version 11.1.1.9.0 Internet Directory Version 12.2.1.3.0 JDeveloper Version 11.1.1.2.4 JDeveloper Version 11.1.1.7.0 JDeveloper Version 11.1.1.7.1 JDeveloper Version 11.1.1.9.0 JDeveloper Version 11.1.2.4.0 JDeveloper Version 12.1.3.0.0 JDeveloper Version 12.2.1.2.0 HTTP Server Version 11.1.1.7.0 HTTP Server Version 11.1.1.9.0 HTTP Server Version 12.1.3.0.0 HTTP Server Version 12.2.1.2.0 HTTP Server Version 12.2.1.3.0 WebCenter Portal Version 11.1.1.9.0 WebCenter Portal Version 12.2.1.2.0 WebCenter Portal Version 12.2.1.3.0 COREid Access Version 10.1.4.3.0 Identity Manager Version 11.1.2.3.0 Identity Manager Connector Version 9.0.4.20.6 Identity Manager Connector Version 9.0.4.21.0 Identity Manager Connector Version 9.0.4.25.4 Business Intelligence Enterprise Edition Version 11.1.1.7.0 Business Intelligence Enterprise Edition Version 11.1.1.9.0 Business Intelligence Enterprise Edition Version 12.2.1.2.0 Business Intelligence Enterprise Edition Version 12.2.1.3.0 WebCenter Content Version 11.1.1.9.0 WebCenter Content Version 12.2.1.2.0 WebCenter Content Version 12.2.1.3.0 WebLogic Server Version 10.3.6.0.0 WebLogic Server Version 12.1.3.0.0 WebLogic Server Version 12.2.1.2.0 WebLogic Server Version 12.2.1.3.0 Tuxedo System and Applications Monitor (TSAM) Version 12.1.3.0.0 Access Manager Version 11.1.2.3.0 Directory Server Enterprise Edition Version 11.1.1.7.0 iPlanet Web Server Version 7.0 WebCenter Sites Version 11.1.1.8.0 Endeca Information Discovery Integrator Version 3.1.0 Endeca Information Discovery Integrator Version 3.2.0 Mobile Security Suite Version 3.0.1 Argus Safety Version 7.x Argus Safety Version 8.0.x Argus Safety Version 8.1 Health Sciences Empirica Signal Version 8.0.1.0 Health Sciences Empirica Inspections Version 1.0.1.1 Hospitality Simphony Version 2.7 Hospitality Simphony Version 2.8 Hospitality Simphony Version 2.9 Hospitality Reporting and Analytics Version 8.5.1 Hospitality Reporting and Analytics Version 9.0.0 Hospitality Labor Management Version 8.5.1 Hospitality Labor Management Version 9.0.0 Hospitality Cruise Dining Room Management Version 8.0.78 Hospitality Cruise Shipboard Property Management System Version 7.3.874 Hospitality Cruise Fleet Management Version 9.0.4.0 Hospitality Guest Access Version 4.2.0 Hospitality Guest Access Version 4.2.1 MICROS Handheld Terminal Version Prior to BSP 02.13.0701 (070116) Hyperion BI+ Version 11.1.2.4 Hyperion Data Relationship Management Version 11.1.2.4.330 Hyperion Planning Version 11.1.2.4.007 JD Edwards EnterpriseOne Tools Version 9.2 Java ME - Specifications Version 8.3 Java Version 7u161 Java Version 7u161; JRockit: R28.3.16 Java Version 8u152 Java Version 9.0.1 Java Version 9.0.1; Java SE Embedded: 8u151 Java Version 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Java Version Java Advanced Management Console: 2.8 Java Version Java SE: 6u171 Java Version Java SE: 7u161 Java Version Java SE: 8u152 MySQL Server Version 5.5.58 and prior MySQL Server Version 5.6.38 and prior MySQL Server Version 5.7.19 and prior MySQL Server Version 5.7.20 and prior MySQL Enterprise Monitor Version 3.3.6.3293 and prior MySQL Enterprise Monitor Version 3.4.4.4226 and prior MySQL Enterprise Monitor Version 4.0.0.5135 and prior MySQL Connectors Version 5.3.9 and prior MySQL Connectors Version 6.10.4 and prior MySQL Connectors Version 6.9.9 and prior PeopleSoft Enterprise HCM Human Resources Version 9.1 PeopleSoft Enterprise HCM Human Resources Version 9.2 PeopleSoft Enterprise PT PeopleTools Version 8.54 PeopleSoft Enterprise PT PeopleTools Version 8.55 PeopleSoft Enterprise PT PeopleTools Version 8.56 PeopleSoft Enterprise PT PeopleTools Version 9.1.00 PeopleSoft Enterprise SCM eProcurement Version 9.1 PeopleSoft Enterprise SCM eProcurement Version 9.2 PeopleSoft Enterprise SCM Purchasing Version 9.2 PeopleSoft Enterprise SCM Strategic Sourcing Version 9.2 PeopleSoft Enterprise FIN Supply Chain Portal Pack Argentina Version 9.1 PeopleSoft Enterprise FIN Supply Chain Portal Pack Brazil Version 9.1 Retail Assortment Planning Version 14.1.3 Retail Assortment Planning Version 15.0.3 Retail Assortment Planning Version 16.0.1 Retail Merchandising System Version 16.0 Retail Workforce Management Version 1.60.7 Retail Workforce Management Version 1.64.0 Retail Fiscal Management Version 14.1 Converged Commerce Version 16.0.1 XBRi Cloud Service Version 10.0.1 XBRi Cloud Service Version 10.5.0 XBRi Cloud Service Version 10.6.0 XBRi Cloud Service Version 10.7.0 XBRi Cloud Service Version 10.8.0 XBRi Cloud Service Version 10.8.1 Retail Convenience and Fuel POS Software Version 2.1.132 MICROS Relate CRM Software Version 10.8.x MICROS Relate CRM Software Version 11.4.x Retail Customer Management and Segmentation Foundation Version 16.0.x Siebel CRM Desktop Version 16.0 Siebel CRM Desktop Version 17.0 Siebel Engineering - Installer and Deployment Version 16.0 Siebel Engineering - Installer and Deployment Version 17.0 SSM - (hot-tamale) ILOM: Integrated Lights Out Manager Version 3.x SSM - (hot-tamale) ILOM: Integrated Lights Out Manager Version 4.x Solaris Operating System Version 10 Solaris Operating System Version 11.3 Sun ZFS Storage Appliance Kit (AK) Software Version Prior to 8.7.13 X86 - Oracle Server X7-2c Version SW 1.x X86 - Oracle Server X7-2c Version SW 2.x Transportation Management Version 6.2.11 Transportation Management Version 6.3.1 Transportation Management Version 6.3.2 Transportation Management Version 6.3.3 Transportation Management Version 6.3.4 Transportation Management Version 6.3.5 Transportation Management Version 6.3.6 Transportation Management Version 6.3.7 Transportation Management Version 6.4.1 Transportation Management Version 6.4.2 Transportation Management Version 6.4.3 Autovue for Agile Product Lifecycle Management Version 21.0.0 Autovue for Agile Product Lifecycle Management Version 21.0.1 Agile Engineering Data Management Version 6.1.3 Agile Engineering Data Management Version 6.2.0 Agile Engineering Data Management Version 6.2.1 Agile PLM MCAD Connector Version 3.3 Agile PLM MCAD Connector Version 3.4 Agile PLM MCAD Connector Version 3.5 Agile PLM MCAD Connector Version 3.6 Agile PLM Framework Version 9.3.3 Agile PLM Framework Version 9.3.4 Agile PLM Framework Version 9.3.5 Agile PLM Framework Version 9.3.6 Agile Material and Equipment Management for Pharmaceuticals Version 9.3.3 Agile Material and Equipment Management for Pharmaceuticals Version 9.3.4 OSS Support Tools Version Prior to 2.11.33 VM VirtualBox Version Prior to 5.1.32 VM VirtualBox Version Prior to 5.2.4 VM VirtualBox Version Prior to 5.2.6 Secure Global Desktop Version 5.3 Vulnerability in the Oracle Communications Application Session Controller component of Oracle Communications Applications (subcomponent: Security). The supported version that is affected is 3.x. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Application Session Controller. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Application Session Controller accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2013-2566 P-10769V-3.x 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10769V-3.x Vulnerability in the Oracle Communications BRM - Elastic Charging Engine component of Oracle Communications Applications (subcomponent: Security (Apache Groovy)). The supported version that is affected is 7.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-3253 P-9742V-7.5 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9742V-7.5 Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Security (Apache Commons Collections)). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Identity Manager. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2015-7501 P-1980V-11.1.2.3.0 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1980V-11.1.2.3.0 Vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: CA ACF2 (Apache Commons Collections)). Supported versions that are affected are 9.0.4.20.6, 9.0.4.21.0 and 9.0.4.25.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-1999V-9.0.4.20.6 P-1999V-9.0.4.21.0 P-1999V-9.0.4.25.4 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1999V-9.0.4.20.6 P-1999V-9.0.4.21.0 P-1999V-9.0.4.25.4 Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products (subcomponent: Install (Bouncy Castle Java package)). Supported versions that are affected are 9.1 and 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-5071V-9.1 P-5071V-9.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5071V-9.1 P-5071V-9.2 Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: Security Framework (Bouncy Castle Java package)). Supported versions that are affected are 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-1696V-11.1.1.9.0 P-1696V-12.2.1.2.0 P-1696V-12.2.1.3.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1696V-11.1.1.9.0 P-1696V-12.2.1.2.0 P-1696V-12.2.1.3.0 Vulnerability in the Converged Commerce component of Oracle Retail Applications (subcomponent: Foundation Data). The supported version that is affected is 16.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Converged Commerce. Successful attacks of this vulnerability can result in takeover of Converged Commerce. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-11258V-16.0.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11258V-16.0.1 Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Security). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-1980V-11.1.2.3.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1980V-11.1.2.3.0 Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management (Glibc, OpenSSL)). Supported versions that are affected are 3.x and 4.x. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Integrated Lights Out Manager (ILOM). Successful attacks of this vulnerability can result in takeover of Integrated Lights Out Manager (ILOM). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0704 P-9849V-3.x P-9849V-4.x 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9849V-3.x P-9849V-4.x Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: Security Framework (Apache Struts 1)). Supported versions that are affected are 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Portal as well as unauthorized update, insert or delete access to some of Oracle WebCenter Portal accessible data. CVSS 3.0 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2016-1182 P-1696V-11.1.1.9.0 P-1696V-12.2.1.2.0 P-1696V-12.2.1.3.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1696V-11.1.1.9.0 P-1696V-12.2.1.2.0 P-1696V-12.2.1.3.0 Vulnerability in the Oracle Mobile Security Suite component of Oracle Fusion Middleware (subcomponent: Internal Development (OpenSSL)). The supported version that is affected is 3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Mobile Security Suite. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Security Suite and unauthorized read access to a subset of Oracle Mobile Security Suite accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2107 P-10913V-3.0.1 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10913V-3.0.1 Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Server (OpenSSL)). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2016-2179 P-2025V-11.1.1.7.0 P-2025V-11.1.1.9.0 P-2025V-12.2.1.2.0 P-2025V-12.2.1.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-2025V-11.1.1.7.0 P-2025V-11.1.1.9.0 P-2025V-12.2.1.2.0 P-2025V-12.2.1.3.0 Vulnerability in the Oracle Communications User Data Repository component of Oracle Communications Applications (subcomponent: Security (PM&C)). Supported versions that are affected are 10.x and 12.x. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications User Data Repository. Successful attacks of this vulnerability can result in takeover of Oracle Communications User Data Repository. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5385 P-11108V-10.x P-11108V-12.x 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11108V-10.x P-11108V-12.x Vulnerability in the Oracle Retail Assortment Planning component of Oracle Retail Applications (subcomponent: Operations & Maintenance (Spring Framework)). Supported versions that are affected are 14.1.3, 15.0.3 and 16.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Assortment Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Assortment Planning. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-9878 P-1788V-14.1.3 P-1788V-15.0.3 P-1788V-16.0.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1788V-14.1.3 P-1788V-15.0.3 P-1788V-16.0.1 Vulnerability in the MICROS Handheld Terminal component of Oracle Hospitality Applications (subcomponent: MC40 Zebra Handheld unit). The supported version that is affected is Prior to BSP 02.13.0701 (070116). Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MICROS Handheld Terminal executes to compromise MICROS Handheld Terminal. Successful attacks of this vulnerability can result in takeover of MICROS Handheld Terminal. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-0781 P-13399V-Prior to BSP 02.13.0701 (070116) 8.8 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-13399V-Prior to BSP 02.13.0701 (070116) Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web Dashboards). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-10068 P-2025V-12.2.1.3.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-2025V-12.2.1.3.0 Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 11.1.2.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-10262 P-5565V-11.1.2.3.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5565V-11.1.2.3.0 Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment). Supported versions that are affected are 11.1.1.7.0, 11.1.1.7.1, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle JDeveloper, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data as well as unauthorized read access to a subset of Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.0 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L). Fix has been released CVE-2017-10273 P-807V-11.1.1.7.0 P-807V-11.1.1.7.1 P-807V-11.1.1.9.0 P-807V-11.1.2.4.0 P-807V-12.1.3.0.0 P-807V-12.2.1.2.0 4.7 AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-807V-11.1.1.7.0 P-807V-11.1.1.7.1 P-807V-11.1.1.9.0 P-807V-11.1.2.4.0 P-807V-12.1.3.0.0 P-807V-12.2.1.2.0 Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-10282 P-5V-12.1.0.2 P-5V-12.2.0.1 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5V-12.1.0.2 P-5V-12.2.0.1 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Enterprise Portal). The supported version that is affected is 9.1.00. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-10301 P-5085V-9.1.00 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5085V-9.1.00 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-10352 P-5242V-12.2.1.3.0 9.9 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5242V-12.2.1.3.0 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Folders, Files & Attachments (Apache Tomcat)). Supported versions that are affected are 9.3.3, 9.3.4, 9.3.5 and 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-12617 P-4461V-9.3.3 P-4461V-9.3.4 P-4461V-9.3.5 P-4461V-9.3.6 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4461V-9.3.3 P-4461V-9.3.4 P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Oracle Endeca Information Discovery Integrator component of Oracle Fusion Middleware (subcomponent: Other Issues (Apache Tomcat)). Supported versions that are affected are 3.1.0 and 3.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Endeca Information Discovery Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Endeca Information Discovery Integrator. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-12617 P-10561V-3.1.0 P-10561V-3.2.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10561V-3.1.0 P-10561V-3.2.0 Vulnerability in the Oracle Health Sciences Empirica Inspections component of Oracle Health Sciences Applications (subcomponent: Base (Apache Tomcat)). The supported version that is affected is 1.0.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Health Sciences Empirica Inspections. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Health Sciences Empirica Inspections accessible data as well as unauthorized read access to a subset of Oracle Health Sciences Empirica Inspections accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-12617 P-10381V-1.0.1.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10381V-1.0.1.1 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base (Apache Tomcat)). Supported versions that are affected are 4.2.0 and 4.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Guest Access. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-12617 P-12617V-4.2.0 P-12617V-4.2.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: General (Apache Tomcat)). Supported versions that are affected are 3.3.6.3293 and prior, 3.4.4.4226 and prior and 4.0.0.5135 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS (HTTP over TLS) to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-12617 P-8480V-3.3.6.3293 and prior P-8480V-3.4.4.4226 and prior P-8480V-4.0.0.5135 and prior 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8480V-3.3.6.3293 and prior P-8480V-3.4.4.4226 and prior P-8480V-4.0.0.5135 and prior Vulnerability in the WLM (Apache Tomcat) component of Oracle Database Server. The supported version that is affected is 12.2.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WLM (Apache Tomcat). Successful attacks of this vulnerability can result in takeover of WLM (Apache Tomcat). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-12617 P-5V-12.2.0.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5V-12.2.0.1 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Install (Apache Tomcat)). Supported versions that are affected are 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6 and 6.3.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in takeover of Oracle Transportation Management. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-12617 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 Vulnerability in the Oracle Tuxedo System and Applications Monitor component of Oracle Fusion Middleware (subcomponent: tsam-General (Apache Tomcat)). The supported version that is affected is 12.1.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Tuxedo System and Applications Monitor. Successful attacks of this vulnerability can result in takeover of Oracle Tuxedo System and Applications Monitor. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-12617 P-5436V-12.1.3.0.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5436V-12.1.3.0.0 Vulnerability in the MICROS Retail XBRi Loss Prevention component of Oracle Retail Applications (subcomponent: Retail (Apache Tomcat)). Supported versions that are affected are 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0 and 10.8.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail XBRi Loss Prevention. Successful attacks of this vulnerability can result in takeover of MICROS Retail XBRi Loss Prevention. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-12617 P-11506V-10.0.1 P-11506V-10.5.0 P-11506V-10.6.0 P-11506V-10.7.0 P-11506V-10.8.0 P-11506V-10.8.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11506V-10.0.1 P-11506V-10.5.0 P-11506V-10.6.0 P-11506V-10.7.0 P-11506V-10.8.0 P-11506V-10.8.1 Vulnerability in the MICROS Handheld Terminal component of Oracle Hospitality Applications (subcomponent: MC40 Zebra Handheld unit). The supported version that is affected is Prior to BSP 02.13.0701 (070116). Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MICROS Handheld Terminal executes to compromise MICROS Handheld Terminal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MICROS Handheld Terminal accessible data as well as unauthorized access to critical data or complete access to all MICROS Handheld Terminal accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-13077 P-13399V-Prior to BSP 02.13.0701 (070116) 8.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-13399V-Prior to BSP 02.13.0701 (070116) Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin (OpenSSL)). The supported version that is affected is 10.1.4.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-1773V-10.1.4.3.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1773V-10.1.4.3.0 Vulnerability in the Application Server component of Oracle E-Business Suite (subcomponent: Tech Stack (OpenSSL)). The supported version that is affected is 12.1.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Application Server accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3736 P-1745V-12.1.3 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1745V-12.1.3 Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/ODBC (OpenSSL)). Supported versions that are affected are 5.3.9 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3736 P-8576V-5.3.9 and prior 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8576V-5.3.9 and prior Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: General (OpenSSL)). Supported versions that are affected are 3.3.6.3293 and prior, 3.4.4.4226 and prior and 4.0.0.5135 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS (HTTP over TLS) to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Enterprise Monitor accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3736 P-8480V-3.3.6.3293 and prior P-8480V-3.4.4.4226 and prior P-8480V-4.0.0.5135 and prior 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8480V-3.3.6.3293 and prior P-8480V-3.4.4.4226 and prior P-8480V-4.0.0.5135 and prior Vulnerability in the Oracle Secure Global Desktop (SGD) component of Oracle Virtualization (subcomponent: Core (OpenSSL)). The supported version that is affected is 5.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Secure Global Desktop (SGD). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Secure Global Desktop (SGD) accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3736 P-8539V-5.3 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8539V-5.3 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core (OpenSSL)). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3736 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.4 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.4 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging (OpenSSL)). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3737 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Oracle Directory Server Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Admin Console (Sun Security Libraries)). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Directory Server Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Directory Server Enterprise Edition. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5461 P-8512V-11.1.1.7.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8512V-11.1.1.7.0 Vulnerability in the Oracle iPlanet Web Server component of Oracle Fusion Middleware (subcomponent: Security (NSS)). The supported version that is affected is 7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle iPlanet Web Server. Successful attacks of this vulnerability can result in takeover of Oracle iPlanet Web Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5461 P-8543V-7.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8543V-7.0 Vulnerability in the Oracle Agile Engineering Data Management component of Oracle Supply Chain Products Suite (subcomponent: Internal Operations (Apache Log4j)). Supported versions that are affected are 6.1.3, 6.2.0 and 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-4436V-6.1.3 P-4436V-6.2.0 P-4436V-6.2.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4436V-6.1.3 P-4436V-6.2.0 P-4436V-6.2.1 Vulnerability in the Agile Material and Equipment Management for Pharmaceuticals component of Oracle Supply Chain Products Suite (subcomponent: Administration (Apache Log4j)). Supported versions that are affected are 9.3.3 and 9.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Agile Material and Equipment Management for Pharmaceuticals. Successful attacks of this vulnerability can result in takeover of Agile Material and Equipment Management for Pharmaceuticals. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-5756V-9.3.3 P-5756V-9.3.4 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5756V-9.3.3 P-5756V-9.3.4 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security (Apache Log4j)). Supported versions that are affected are 9.3.3, 9.3.4, 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-4461V-9.3.3 P-4461V-9.3.4 P-4461V-9.3.5 P-4461V-9.3.6 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4461V-9.3.3 P-4461V-9.3.4 P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Oracle Agile PLM MCAD Connector component of Oracle Supply Chain Products Suite (subcomponent: CAX Client (Apache Log4j)). Supported versions that are affected are 3.3, 3.4, 3.5 and 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-4440V-3.3 P-4440V-3.4 P-4440V-3.5 P-4440V-3.6 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4440V-3.3 P-4440V-3.4 P-4440V-3.5 P-4440V-3.6 Vulnerability in the Oracle Autovue for Agile Product Lifecycle Management component of Oracle Supply Chain Products Suite (subcomponent: Internal Operations (Apache Log4j)). Supported versions that are affected are 21.0.0 and 21.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Autovue for Agile Product Lifecycle Management. Successful attacks of this vulnerability can result in takeover of Oracle Autovue for Agile Product Lifecycle Management. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-4434V-21.0.0 P-4434V-21.0.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4434V-21.0.0 P-4434V-21.0.1 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine component of Oracle Communications Applications (subcomponent: Security (Apache Log4j)). The supported version that is affected is 7.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-9742V-7.5 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9742V-7.5 Vulnerability in the Oracle Communications Convergent Charging Controller component of Oracle Communications Applications (subcomponent: Notifications Gateway (Apache Log4j)). The supported version that is affected is 6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications Convergent Charging Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergent Charging Controller. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-12985V-6.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12985V-6.0 Vulnerability in the Oracle Communications Network Charging and Control component of Oracle Communications Applications (subcomponent: Notifications Gateway (Apache Log4j)). The supported version that is affected is 6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications Network Charging and Control. Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Charging and Control. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-4623V-6.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4623V-6.0 Vulnerability in the Oracle Communications Services Gatekeeper component of Oracle Communications Applications (subcomponent: Security (Apache Log4j)). Supported versions that are affected are 5.1 and 6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Services Gatekeeper. Successful attacks of this vulnerability can result in takeover of Oracle Communications Services Gatekeeper. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-5381V-5.1 P-5381V-6.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5381V-5.1 P-5381V-6.0 Vulnerability in the MICROS Relate CRM Software component of Oracle Retail Applications (subcomponent: Internal Operations (Apache Log4j)). Supported versions that are affected are 10.8.x, 11.4.x and . Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Relate CRM Software. Successful attacks of this vulnerability can result in takeover of MICROS Relate CRM Software. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-11566V-10.8.x P-11566V-11.4.x 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11566V-10.8.x P-11566V-11.4.x Vulnerability in the PeopleSoft Enterprise FIN Supply Chain Portal Pack Argentina component of Oracle PeopleSoft Products (subcomponent: Supply Chain Portal Pack (Apache Log4j)). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Supply Chain Portal Pack Argentina. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Supply Chain Portal Pack Argentina. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-8843V-9.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8843V-9.1 Vulnerability in the PeopleSoft Enterprise FIN Supply Chain Portal Pack Brazil component of Oracle PeopleSoft Products (subcomponent: Supply Chain Portal Pack (Apache Log4j)). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Supply Chain Portal Pack Brazil. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Supply Chain Portal Pack Brazil. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-8883V-9.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8883V-9.1 Vulnerability in the Oracle Retail Assortment Planning component of Oracle Retail Applications (subcomponent: Application Core (Apache Log4j)). Supported versions that are affected are 14.1.3, 15.0.3 and 16.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Assortment Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Assortment Planning. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-1788V-14.1.3 P-1788V-15.0.3 P-1788V-16.0.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1788V-14.1.3 P-1788V-15.0.3 P-1788V-16.0.1 Vulnerability in the Oracle Retail Convenience and Fuel POS Software component of Oracle Retail Applications (subcomponent: OPT Server (Apache Log4j)). The supported version that is affected is 2.1.132. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Convenience and Fuel POS Software. Successful attacks of this vulnerability can result in takeover of Oracle Retail Convenience and Fuel POS Software. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-11515V-2.1.132 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11515V-2.1.132 Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation component of Oracle Retail Applications (subcomponent: Internal Operations(Apache Log4j)). The supported version that is affected is 16.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Management and Segmentation Foundation. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-13388V-16.0.x 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-13388V-16.0.x Vulnerability in the Oracle Retail Fiscal Management component of Oracle Retail Applications (subcomponent: NF Issuing (Apache Log4j)). The supported version that is affected is 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Fiscal Management. Successful attacks of this vulnerability can result in takeover of Oracle Retail Fiscal Management. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-9038V-14.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9038V-14.1 Vulnerability in the Oracle Retail Workforce Management component of Oracle Retail Applications (subcomponent: Configuration Issues (Apache Log4j)). Supported versions that are affected are 1.60.7 and 1.64.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Workforce Management. Successful attacks of this vulnerability can result in takeover of Oracle Retail Workforce Management. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-2019V-1.60.7 P-2019V-1.64.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-2019V-1.60.7 P-2019V-1.64.0 Vulnerability in the Oracle Secure Global Desktop (SGD) component of Oracle Virtualization (subcomponent: Core (Apache Log4j)). The supported version that is affected is 5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Secure Global Desktop (SGD). Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop (SGD). CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-8539V-5.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8539V-5.3 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Business Process Automation (Apache Log4j)). Supported versions that are affected are 6.2.11, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7 and 6.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in takeover of Oracle Transportation Management. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-1991V-6.2.11 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 P-1991V-6.4.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1991V-6.2.11 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 P-1991V-6.4.1 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Sample apps (Apache Log4j)). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP/UDP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.2.0 P-5242V-12.2.1.3.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5242V-10.3.6.0.0 P-5242V-12.1.3.0.0 P-5242V-12.2.1.2.0 P-5242V-12.2.1.3.0 Vulnerability in the MICROS Retail XBRi Loss Prevention component of Oracle Retail Applications (subcomponent: Retail (Apache Log4j)). Supported versions that are affected are 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0 and 10.8.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail XBRi Loss Prevention. Successful attacks of this vulnerability can result in takeover of MICROS Retail XBRi Loss Prevention. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5645 P-11506V-10.0.1 P-11506V-10.5.0 P-11506V-10.6.0 P-11506V-10.7.0 P-11506V-10.8.0 P-11506V-10.8.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11506V-10.0.1 P-11506V-10.5.0 P-11506V-10.6.0 P-11506V-10.7.0 P-11506V-10.8.0 P-11506V-10.8.1 Vulnerability in the Oracle Agile Engineering Data Management component of Oracle Supply Chain Products Suite (subcomponent: Install (Apache Tomcat)). Supported versions that are affected are 6.1.3, 6.2.0 and 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-5664 P-4436V-6.1.3 P-4436V-6.2.0 P-4436V-6.2.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4436V-6.1.3 P-4436V-6.2.0 P-4436V-6.2.1 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Folders, Files & Attachments (Apache Tomcat)). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-5664 P-4461V-9.3.5 P-4461V-9.3.6 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the MICROS Relate CRM Software component of Oracle Retail Applications (subcomponent: Web Services (Apache Tomcat)). Supported versions that are affected are 10.8.x and 11.4.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Relate CRM Software. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MICROS Relate CRM Software accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-5664 P-11566V-10.8.x P-11566V-11.4.x 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11566V-10.8.x P-11566V-11.4.x Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2017-5715 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 5.6 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Oracle X86 Servers component of Oracle Sun Systems Products Suite (subcomponent: BIOS). Supported versions that are affected are SW 1.x and SW 2.x. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle X86 Servers executes to compromise Oracle X86 Servers. While the vulnerability is in Oracle X86 Servers, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle X86 Servers accessible data. Note: This includes Intel microcode that enables OS and VM level mitigations for CVE-2017-5715. Application of firmware patches to pick up the Intel microcode is required only for Oracle x86 servers using non Oracle OS and Virtualization software. Oracle OS and Oracle VM patches for CVE-2017-5715 will include updated Intel microcode. CVSS 3.0 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2017-5715 P-12974V-SW 1.x P-12974V-SW 2.x 5.6 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12974V-SW 1.x P-12974V-SW 2.x Vulnerability in the Oracle Health Sciences Empirica Inspections component of Oracle Health Sciences Applications (subcomponent: UI (Calendar)). The supported version that is affected is 1.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Health Sciences Empirica Inspections. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Health Sciences Empirica Inspections, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Health Sciences Empirica Inspections accessible data as well as unauthorized read access to a subset of Oracle Health Sciences Empirica Inspections accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-9072 P-10381V-1.0.1.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10381V-1.0.1.1 Vulnerability in the Oracle Health Sciences Empirica Signal component of Oracle Health Sciences Applications (subcomponent: UI (Calendar)). The supported version that is affected is 8.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Health Sciences Empirica Signal. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Health Sciences Empirica Signal, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Health Sciences Empirica Signal accessible data as well as unauthorized read access to a subset of Oracle Health Sciences Empirica Signal accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-9072 P-9646V-8.0.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9646V-8.0.1.0 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-9798 P-1042V-11.1.1.7.0 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 P-1042V-12.2.1.2.0 P-1042V-12.2.1.3.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1042V-11.1.1.7.0 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 P-1042V-12.2.1.2.0 P-1042V-12.2.1.3.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N). Fix has been released CVE-2018-2560 P-10006V-11.3 5.0 AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10006V-11.3 Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2018-2561 P-1042V-11.1.1.7.0 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 P-1042V-12.2.1.2.0 P-1042V-12.2.1.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1042V-11.1.1.7.0 P-1042V-11.1.1.9.0 P-1042V-12.1.3.0.0 P-1042V-12.2.1.2.0 P-1042V-12.2.1.3.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2018-2562 P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.19 and prior 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.19 and prior Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N). Fix has been released CVE-2018-2564 P-2271V-11.1.1.9.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-2271V-11.1.1.9.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2565 P-8478V-5.7.20 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.7.20 and prior Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application). Supported versions that are affected are 3.x and 4.x. Difficult to exploit vulnerability allows low privileged attacker with network access via TLS to compromise Integrated Lights Out Manager (ILOM). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Integrated Lights Out Manager (ILOM), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Integrated Lights Out Manager (ILOM) accessible data as well as unauthorized access to critical data or complete access to all Integrated Lights Out Manager (ILOM) accessible data. CVSS 3.0 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N). Fix has been released CVE-2018-2566 P-9849V-3.x P-9849V-4.x 7.7 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9849V-3.x P-9849V-4.x Vulnerability in the Oracle Communications Order and Service Management component of Oracle Communications Applications (subcomponent: Portal). Supported versions that are affected are 7.2.4.1.x, 7.2.4.2.x, 7.3.0.x.x and 7.3.0.1.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Order and Service Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Order and Service Management accessible data as well as unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2567 P-2270V-7.2.4.1.x P-2270V-7.2.4.2.x P-2270V-7.3.0.x.x P-2270V-7.3.0.1.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-2270V-7.2.4.1.x P-2270V-7.2.4.2.x P-2270V-7.3.0.x.x P-2270V-7.3.0.1.x Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application). Supported versions that are affected are 3.x and 4.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Integrated Lights Out Manager (ILOM). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Integrated Lights Out Manager (ILOM) accessible data as well as unauthorized read access to a subset of Integrated Lights Out Manager (ILOM) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Integrated Lights Out Manager (ILOM). CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2018-2568 P-9849V-3.x P-9849V-4.x 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9849V-3.x P-9849V-4.x Vulnerability in the Java ME SDK component of Oracle Java Micro Edition (subcomponent: Installer). The supported version that is affected is 8.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Java ME SDK executes to compromise Java ME SDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java ME SDK. Note: This applies to the Windows platform only. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2018-2569 P-9324V-8.3 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9324V-8.3 Vulnerability in the Oracle Communications Unified Inventory Management component of Oracle Communications Applications (subcomponent: Portal). Supported versions that are affected are 7.2.4.2.x and 7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Unified Inventory Management accessible data as well as unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Unified Inventory Management. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2018-2570 P-4516V-7.2.4.2.x P-4516V-7.3 6.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4516V-7.2.4.2.x P-4516V-7.3 Vulnerability in the Oracle Communications Unified Inventory Management component of Oracle Communications Applications (subcomponent: Portal). Supported versions that are affected are 7.2.4.2.x and 7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Unified Inventory Management accessible data as well as unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2018-2571 P-4516V-7.2.4.2.x P-4516V-7.3 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4516V-7.2.4.2.x P-4516V-7.3 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: GIS). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2573 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Siebel CRM Desktop component of Oracle Siebel CRM (subcomponent: Outlook Client). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Desktop. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Desktop accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Desktop accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2574 P-7306V-16.0 P-7306V-17.0 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-7306V-16.0 P-7306V-17.0 Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Difficult to exploit vulnerability allows high privileged attacker having Local Logon privilege with network access via multiple protocols to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. Note: Applicable only to Windows platform. CVSS 3.0 Base Score 2.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2575 P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 2.0 AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2576 P-8478V-5.7.20 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.7.20 and prior Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2577 P-10006V-11.3 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10006V-11.3 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2578 P-10006V-11.3 7.2 AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10006V-11.3 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2579 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: ADPatch). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Applications DBA executes to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2580 P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 P-166V-12.2.7 4.4 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-166V-12.1.3 P-166V-12.2.3 P-166V-12.2.4 P-166V-12.2.5 P-166V-12.2.6 P-166V-12.2.7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u161, 8u152 and 9.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N). Fix has been released CVE-2018-2581 P-856V-Java SE: 7u161 P-856V-8u152 P-856V-9.0.1 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 7u161 P-856V-8u152 P-856V-9.0.1 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). Fix has been released CVE-2018-2582 P-856V-Java SE: 8u152 P-856V-9.0.1; Java SE Embedded: 8u151 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 8u152 P-856V-9.0.1; Java SE Embedded: 8u151 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Stored Procedure). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.8 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H). Fix has been released CVE-2018-2583 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 6.8 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2584 P-9617V-11.1.1.8.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9617V-11.1.1.8.0 Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Net). Supported versions that are affected are 6.9.9 and prior and 6.10.4 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2585 P-8576V-6.9.9 and prior P-8576V-6.10.4 and prior 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8576V-6.9.9 and prior P-8576V-6.10.4 and prior Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2586 P-8478V-5.7.20 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.7.20 and prior Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: LDAP). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2588 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Enterprise Server). Supported versions that are affected are 2.7, 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2589 P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Performance Schema). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2590 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.6.38 and prior and 5.7.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2591 P-8478V-5.6.38 and prior P-8478V-5.7.19 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.19 and prior Vulnerability in the Oracle Financial Services Balance Sheet Planning component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Balance Sheet Planning. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Balance Sheet Planning accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Balance Sheet Planning accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2592 P-5663V-8.0.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5663V-8.0.x Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core Technology). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2018-2593 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Hyperion BI+ component of Oracle Hyperion (subcomponent: Foundation UI & Servlets). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion BI+. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion BI+ accessible data as well as unauthorized read access to a subset of Hyperion BI+ accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Hyperion BI+. CVSS 3.0 Base Score 4.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L). Fix has been released CVE-2018-2594 P-4361V-11.1.2.4 4.3 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4361V-11.1.2.4 Vulnerability in the Hyperion BI+ component of Oracle Hyperion (subcomponent: Foundation UI & Servlets). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion BI+. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion BI+ accessible data as well as unauthorized read access to a subset of Hyperion BI+ accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Hyperion BI+. CVSS 3.0 Base Score 4.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L). Fix has been released CVE-2018-2595 P-4361V-11.1.2.4 4.3 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4361V-11.1.2.4 Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N). Fix has been released CVE-2018-2596 P-2271V-11.1.1.9.0 P-2271V-12.2.1.2.0 P-2271V-12.2.1.3.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-2271V-11.1.1.9.0 P-2271V-12.2.1.2.0 P-2271V-12.2.1.3.0 Vulnerability in the Oracle Hospitality Cruise Dining Room Management component of Oracle Hospitality Applications (subcomponent: SilverWhere). The supported version that is affected is 8.0.78. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Dining Room Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise Dining Room Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Dining Room Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Dining Room Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2018-2597 P-11605V-8.0.78 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11605V-8.0.78 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2018-2599 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2600 P-8478V-5.7.20 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.7.20 and prior Vulnerability in the Oracle Internet Directory component of Oracle Fusion Middleware (subcomponent: Oracle Directory Services Manager). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Internet Directory. While the vulnerability is in Oracle Internet Directory, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.0 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2601 P-355V-11.1.1.7.0 P-355V-11.1.1.9.0 P-355V-12.2.1.3.0 8.0 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-355V-11.1.1.7.0 P-355V-11.1.1.9.0 P-355V-12.2.1.3.0 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: I18n). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded executes to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). Fix has been released CVE-2018-2602 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151 4.5 AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2018-2603 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). The supported version that is affected is 4.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2604 P-12617V-4.2.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12617V-4.2.1 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2605 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Guest Access executes to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2606 P-12617V-4.2.0 P-12617V-4.2.1 6.2 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). The supported version that is affected is 4.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Guest Access. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2607 P-12617V-4.2.1 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12617V-4.2.1 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). The supported version that is affected is 2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. While the vulnerability is in Oracle Hospitality Simphony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2018-2608 P-11594V-2.7 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11594V-2.7 Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2609 P-4461V-9.3.5 P-4461V-9.3.6 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion (subcomponent: Access and security). The supported version that is affected is 11.1.2.4.330. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Hyperion Data Relationship Management accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2610 P-4375V-11.1.2.4.330 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4375V-11.1.2.4.330 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services). The supported version that is affected is Prior to 8.7.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2611 P-10026V-Prior to 8.7.13 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10026V-Prior to 8.7.13 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H). Fix has been released CVE-2018-2612 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Login). Supported versions that are affected are 7.x, 8.0.x and 8.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Argus Safety. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Argus Safety accessible data as well as unauthorized update, insert or delete access to some of Oracle Argus Safety accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2018-2613 P-5710V-7.x P-5710V-8.0.x P-5710V-8.1 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5710V-7.x P-5710V-8.0.x P-5710V-8.1 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0 and 12.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2614 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 P-9052V-12.4.0 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 P-9052V-12.4.0 Vulnerability in the OSS Support Tools component of Oracle Support Tools (subcomponent: Diagnostic Assistant). The supported version that is affected is Prior to 2.11.33. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks of this vulnerability can result in takeover of OSS Support Tools. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2018-2615 P-1330V-Prior to 2.11.33 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1330V-Prior to 2.11.33 Vulnerability in the OSS Support Tools component of Oracle Support Tools (subcomponent: Diagnostic Assistant). The supported version that is affected is Prior to 2.11.33. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks of this vulnerability can result in takeover of OSS Support Tools. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2018-2616 P-1330V-Prior to 2.11.33 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1330V-Prior to 2.11.33 Vulnerability in the OSS Support Tools component of Oracle Support Tools (subcomponent: Diagnostic Assistant). The supported version that is affected is Prior to 2.11.33. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all OSS Support Tools accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2617 P-1330V-Prior to 2.11.33 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1330V-Prior to 2.11.33 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2618 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). The supported version that is affected is 2.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2619 P-11594V-2.7 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11594V-2.7 Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Platform). Supported versions that are affected are 10.x, 15.x, 16.x and 17.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2620 P-10354V-10.x P-10354V-15.x P-10354V-16.x P-10354V-17.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10354V-10.x P-10354V-15.x P-10354V-16.x P-10354V-17.x Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Mobile Gangway and Mustering). The supported version that is affected is 7.3.874. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Shipboard Property Management System accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2018-2621 P-11607V-7.3.874 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11607V-7.3.874 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2622 P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: User Interface). The supported version that is affected is Prior to 8.7.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Sun ZFS Storage Appliance Kit (AK) accessible data as well as unauthorized update, insert or delete access to some of Sun ZFS Storage Appliance Kit (AK) accessible data. CVSS 3.0 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N). Fix has been released CVE-2018-2623 P-10026V-Prior to 8.7.13 9.3 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10026V-Prior to 8.7.13 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: User Interface). The supported version that is affected is Prior to 8.7.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Sun ZFS Storage Appliance Kit (AK) accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2018-2624 P-10026V-Prior to 8.7.13 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10026V-Prior to 8.7.13 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2625 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.2.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.2.0 Vulnerability in the Oracle Financial Services Balance Sheet Planning component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Balance Sheet Planning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Balance Sheet Planning, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Balance Sheet Planning accessible data as well as unauthorized read access to a subset of Oracle Financial Services Balance Sheet Planning accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2626 P-5663V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5663V-8.0.x Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer). Supported versions that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to the Windows installer only. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2627 P-856V-Java SE: 8u152 P-856V-9.0.1 7.5 AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 8u152 P-856V-9.0.1 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). Fix has been released CVE-2018-2629 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 5.3 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Security Management System). Supported versions that are affected are 11.5.0, 11.6.0 and 11.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2018-2630 P-9052V-11.5.0 P-9052V-11.6.0 P-9052V-11.7.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9052V-11.5.0 P-9052V-11.6.0 P-9052V-11.7.0 Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.2.11, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.1, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2631 P-1991V-6.2.11 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 P-1991V-6.4.1 P-1991V-6.4.2 P-1991V-6.4.3 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1991V-6.2.11 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 P-1991V-6.4.1 P-1991V-6.4.2 P-1991V-6.4.3 Vulnerability in the Siebel Engineering - Installer and Deployment component of Oracle Siebel CRM (subcomponent: Siebel Approval Manager). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Engineering - Installer and Deployment. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Engineering - Installer and Deployment accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2632 P-9023V-16.0 P-9023V-17.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9023V-16.0 P-9023V-17.0 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2633 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE: 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). Fix has been released CVE-2018-2634 P-856V-Java SE: 7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151 6.8 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151 Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Login). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2018-2635 P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 P-510V-12.2.7 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 P-510V-12.2.7 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2018-2636 P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2637 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2638 P-856V-Java SE: 8u152 P-856V-9.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 8u152 P-856V-9.0.1 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2639 P-856V-Java SE: 8u152 P-856V-9.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 8u152 P-856V-9.0.1 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2640 P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N). Fix has been released CVE-2018-2641 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151 6.1 AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151 Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: File Upload). Supported versions that are affected are 7.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Argus Safety. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Argus Safety, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Argus Safety accessible data as well as unauthorized read access to a subset of Oracle Argus Safety accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Argus Safety. CVSS 3.0 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Fix has been released CVE-2018-2642 P-5710V-7.x P-5710V-8.0.x 6.5 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5710V-7.x P-5710V-8.0.x Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Case Selection). Supported versions that are affected are 7.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Argus Safety. While the vulnerability is in Oracle Argus Safety, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Argus Safety accessible data as well as unauthorized read access to a subset of Oracle Argus Safety accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2643 P-5710V-7.x P-5710V-8.0.x 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5710V-7.x P-5710V-8.0.x Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Worklist). Supported versions that are affected are 7.x, 8.0.x and 8.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Argus Safety. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Argus Safety, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Argus Safety accessible data as well as unauthorized read access to a subset of Oracle Argus Safety accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2644 P-5710V-7.x P-5710V-8.0.x P-5710V-8.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5710V-7.x P-5710V-8.0.x P-5710V-8.1 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Performance Schema). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2645 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2646 P-8478V-5.7.20 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.7.20 and prior Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2018-2647 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2018-2648 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 P-9052V-12.4.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 P-9052V-12.4.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Fix has been released CVE-2018-2649 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 P-9052V-12.4.0 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 P-9052V-12.4.0 Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Report). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2018-2650 P-11599V-8.5.1 P-11599V-9.0.0 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: XML Publisher). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2651 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2652 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Connected Query). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2653 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products (subcomponent: Company Dir / Org Chart Viewer). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Human Resources, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2654 P-5071V-9.2 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5071V-9.2 Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Assemble/Configure to Order). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2655 P-572V-12.1.1 P-572V-12.1.2 P-572V-12.1.3 P-572V-12.2.3 P-572V-12.2.4 P-572V-12.2.5 P-572V-12.2.6 P-572V-12.2.7 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-572V-12.1.1 P-572V-12.1.2 P-572V-12.1.3 P-572V-12.2.3 P-572V-12.2.4 P-572V-12.2.5 P-572V-12.2.6 P-572V-12.2.7 Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Data Manager Server). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2656 P-500V-12.1.1 P-500V-12.1.2 P-500V-12.1.3 P-500V-12.2.3 P-500V-12.2.4 P-500V-12.2.5 P-500V-12.2.6 P-500V-12.2.7 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-500V-12.1.1 P-500V-12.1.2 P-500V-12.1.3 P-500V-12.2.3 P-500V-12.2.4 P-500V-12.2.5 P-500V-12.2.6 P-500V-12.2.7 Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u171 and 7u161; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2018-2657 P-856V-Java SE: 6u171 P-856V-7u161; JRockit: R28.3.16 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161; JRockit: R28.3.16 Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime SEC). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2658 P-4781V-9.2 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4781V-9.2 Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime SEC). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2659 P-4781V-9.2 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4781V-9.2 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 7.3.5.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. While the vulnerability is in Oracle Financial Services Analytical Applications Infrastructure, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Analytical Applications Infrastructure accessible data as well as unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.0 Base Score 7.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2018-2660 P-5680V-7.3.5.x P-5680V-8.0.x 7.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5680V-7.3.5.x P-5680V-8.0.x Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 7.3.5.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Analytical Applications Infrastructure, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Analytical Applications Infrastructure accessible data as well as unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2661 P-5680V-7.3.5.x P-5680V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5680V-7.3.5.x P-5680V-8.0.x Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.2.11, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7 and 6.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Transportation Management accessible data as well as unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2018-2662 P-1991V-6.2.11 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 P-1991V-6.4.1 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1991V-6.2.11 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 P-1991V-6.4.1 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Fix has been released CVE-2018-2663 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: User Interface). The supported version that is affected is Prior to 8.7.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2664 P-10026V-Prior to 8.7.13 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10026V-Prior to 8.7.13 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2665 P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Oracle Hospitality Labor Management component of Oracle Hospitality Applications (subcomponent: Webservice Endpoint). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Labor Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Labor Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Labor Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2666 P-11601V-8.5.1 P-11601V-9.0.0 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11601V-8.5.1 P-11601V-9.0.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2667 P-8478V-5.7.20 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.7.20 and prior Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2668 P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.5.58 and prior P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Report). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2669 P-11599V-8.5.1 P-11599V-9.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11599V-8.5.1 P-11599V-9.0.0 Vulnerability in the Oracle Financial Services Profitability Management component of Oracle Financial Services Applications (subcomponent: User Interface). Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Profitability Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Profitability Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Profitability Management accessible data as well as unauthorized read access to a subset of Oracle Financial Services Profitability Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2670 P-5658V-6.1.x P-5658V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5658V-6.1.x P-5658V-8.0.x Vulnerability in the PeopleSoft Enterprise SCM Purchasing component of Oracle PeopleSoft Products (subcomponent: Supplier Registration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2671 P-5133V-9.2 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5133V-9.2 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: POS). Supported versions that are affected are 2.7, 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2672 P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: POS). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2673 P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Logoff). Supported versions that are affected are 12.0.2 and 12.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Direct Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Direct Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Direct Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Direct Banking accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2674 P-9111V-12.0.2 P-9111V-12.0.3 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9111V-12.0.2 P-9111V-12.0.3 Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java Advanced Management Console. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java Advanced Management Console accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2018-2675 P-856V-Java Advanced Management Console: 2.8 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java Advanced Management Console: 2.8 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2676 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.2 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Fix has been released CVE-2018-2677 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Fix has been released CVE-2018-2678 P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-856V-Java SE: 6u171 P-856V-7u161 P-856V-8u152 P-856V-9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16 Vulnerability in the Oracle Financial Services Profitability Management component of Oracle Financial Services Applications (subcomponent: User Interface). Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Profitability Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Profitability Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Profitability Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2679 P-5658V-6.1.x P-5658V-8.0.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5658V-6.1.x P-5658V-8.0.x Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java VM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java VM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2680 P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products (subcomponent: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2018-2681 P-5071V-9.2 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5071V-9.2 Vulnerability in the Oracle Financial Services Liquidity Risk Management component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Liquidity Risk Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Liquidity Risk Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Liquidity Risk Management accessible data as well as unauthorized read access to a subset of Oracle Financial Services Liquidity Risk Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2682 P-9096V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9096V-8.0.x Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: POS). Supported versions that are affected are 2.7, 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2683 P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11594V-2.7 P-11594V-2.8 P-11594V-2.9 Vulnerability in the Oracle User Management component of Oracle E-Business Suite (subcomponent: Registration Process). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle User Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle User Management accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2684 P-1475V-12.1.3 P-1475V-12.2.3 P-1475V-12.2.4 P-1475V-12.2.5 P-1475V-12.2.6 P-1475V-12.2.7 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1475V-12.1.3 P-1475V-12.2.3 P-1475V-12.2.4 P-1475V-12.2.5 P-1475V-12.2.6 P-1475V-12.2.7 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2685 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2686 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2687 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2688 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2689 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2690 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Oracle User Management component of Oracle E-Business Suite (subcomponent: Proxy User Delegation). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle User Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle User Management accessible data as well as unauthorized read access to a subset of Oracle User Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2018-2691 P-1475V-12.1.3 P-1475V-12.2.3 P-1475V-12.2.4 P-1475V-12.2.5 P-1475V-12.2.6 P-1475V-12.2.7 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1475V-12.1.3 P-1475V-12.2.3 P-1475V-12.2.4 P-1475V-12.2.5 P-1475V-12.2.6 P-1475V-12.2.7 Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications (subcomponent: User Interface). Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Asset Liability Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Asset Liability Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Asset Liability Management accessible data as well as unauthorized read access to a subset of Oracle Financial Services Asset Liability Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2692 P-5662V-6.1.x P-5662V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5662V-6.1.x P-5662V-8.0.x Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Guest Additions). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2693 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.2 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2694 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Query). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2695 P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5085V-8.54 P-5085V-8.55 P-5085V-8.56 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2696 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System). The supported version that is affected is 9.0.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2697 P-11608V-9.0.4.0 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11608V-9.0.4.0 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2698 P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8370V-Prior to 5.1.32 P-8370V-Prior to 5.2.6 Vulnerability in the Application Express component of Oracle Database Server. The supported version that is affected is Prior to 5.1.4.00.08. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Express accessible data as well as unauthorized read access to a subset of Application Express accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2699 P-1348V-Prior to 5.1.4.00.08 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1348V-Prior to 5.1.4.00.08 Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System). The supported version that is affected is 9.0.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2700 P-11608V-9.0.4.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11608V-9.0.4.0 Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System). The supported version that is affected is 9.0.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise Fleet Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2018-2701 P-11608V-9.0.4.0 7.6 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-11608V-9.0.4.0 Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2702 P-5136V-9.2 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5136V-9.2 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2703 P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-8478V-5.6.38 and prior P-8478V-5.7.20 and prior Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Payments accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking Payments. CVSS 3.0 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Fix has been released CVE-2018-2704 P-13011V-12.3.0 P-13011V-12.4.0 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-13011V-12.3.0 P-13011V-12.4.0 Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in takeover of Oracle Banking Payments. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2018-2705 P-13011V-12.3.0 P-13011V-12.4.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-13011V-12.3.0 P-13011V-12.4.0 Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in takeover of Oracle Banking Corporate Lending. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2018-2706 P-12989V-12.3.0 P-12989V-12.4.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12989V-12.3.0 P-12989V-12.4.0 Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Corporate Lending accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking Corporate Lending. CVSS 3.0 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Fix has been released CVE-2018-2707 P-12989V-12.3.0 P-12989V-12.4.0 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12989V-12.3.0 P-12989V-12.4.0 Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.3.0 and 12.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Payments accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2708 P-13011V-12.3.0 P-13011V-12.4.0 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-13011V-12.3.0 P-13011V-12.4.0 Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0 and 12.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2709 P-12989V-12.3.0 P-12989V-12.4.0 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-12989V-12.3.0 P-12989V-12.4.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 10. Easily exploitable vulnerability allows unauthenticated attacker with network access via ICMP to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2018-2710 P-10006V-10 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10006V-10 Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework). Supported versions that are affected are 11.1.1.2.4, 11.1.1.7.0, 11.1.1.7.1, 11.1.1.9.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle JDeveloper, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data as well as unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2018-2711 P-807V-11.1.1.2.4 P-807V-11.1.1.7.0 P-807V-11.1.1.7.1 P-807V-11.1.1.9.0 P-807V-12.1.3.0.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-807V-11.1.1.2.4 P-807V-11.1.1.7.0 P-807V-11.1.1.7.1 P-807V-11.1.1.9.0 P-807V-12.1.3.0.0 Vulnerability in the Oracle Financial Services Loan Loss Forecasting and Provisioning component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Loan Loss Forecasting and Provisioning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Loan Loss Forecasting and Provisioning, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Loan Loss Forecasting and Provisioning accessible data as well as unauthorized read access to a subset of Oracle Financial Services Loan Loss Forecasting and Provisioning accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2712 P-9474V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9474V-8.0.x Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: WebCenter Spaces Application). Supported versions that are affected are 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N). Fix has been released CVE-2018-2713 P-1696V-11.1.1.9.0 P-1696V-12.2.1.2.0 P-1696V-12.2.1.3.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1696V-11.1.1.9.0 P-1696V-12.2.1.2.0 P-1696V-12.2.1.3.0 Vulnerability in the Oracle Financial Services Market Risk component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Market Risk. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Market Risk, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Market Risk accessible data as well as unauthorized read access to a subset of Oracle Financial Services Market Risk accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2714 P-9478V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9478V-8.0.x Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: BI Platform Security). Supported versions that are affected are 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2018-2715 P-2025V-12.2.1.2.0 P-2025V-12.2.1.3.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-2025V-12.2.1.2.0 P-2025V-12.2.1.3.0 Vulnerability in the Oracle Financial Services Market Risk Measurement and Management component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Market Risk Measurement and Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Market Risk Measurement and Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Market Risk Measurement and Management accessible data as well as unauthorized read access to a subset of Oracle Financial Services Market Risk Measurement and Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2716 P-13111V-8.0.5 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-13111V-8.0.5 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: SPARC Platform). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris accessible data as well as unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 6.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2717 P-10006V-10 P-10006V-11.3 6.6 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-10006V-10 P-10006V-11.3 Vulnerability in the Oracle Financial Services Hedge Management and IFRS Valuations component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Hedge Management and IFRS Valuations. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Hedge Management and IFRS Valuations, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Hedge Management and IFRS Valuations accessible data as well as unauthorized read access to a subset of Oracle Financial Services Hedge Management and IFRS Valuations accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2719 P-9332V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9332V-8.0.x Vulnerability in the Oracle Financial Services Liquidity Risk Management component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Liquidity Risk Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Liquidity Risk Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Liquidity Risk Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2720 P-9096V-8.0.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9096V-8.0.x Vulnerability in the Oracle Financial Services Price Creation and Discovery component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Price Creation and Discovery. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Price Creation and Discovery accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Price Creation and Discovery accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2721 P-5749V-8.0.5 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5749V-8.0.5 Vulnerability in the Oracle Financial Services Price Creation and Discovery component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Price Creation and Discovery. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Price Creation and Discovery, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Price Creation and Discovery accessible data as well as unauthorized read access to a subset of Oracle Financial Services Price Creation and Discovery accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2722 P-5749V-8.0.5 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5749V-8.0.5 Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications (subcomponent: User Interface). Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Asset Liability Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Asset Liability Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Asset Liability Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2723 P-5662V-6.1.x P-5662V-8.0.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5662V-6.1.x P-5662V-8.0.x Vulnerability in the Oracle Financial Services Loan Loss Forecasting and Provisioning component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Loan Loss Forecasting and Provisioning. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Loan Loss Forecasting and Provisioning accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Loan Loss Forecasting and Provisioning accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2724 P-9474V-8.0.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9474V-8.0.x Vulnerability in the Oracle Financial Services Hedge Management and IFRS Valuations component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Hedge Management and IFRS Valuations. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Hedge Management and IFRS Valuations accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Hedge Management and IFRS Valuations accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2725 P-9332V-8.0.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9332V-8.0.x Vulnerability in the Oracle Financial Services Market Risk component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Market Risk. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Market Risk accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Market Risk accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2726 P-9478V-8.0.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-9478V-8.0.x Vulnerability in the Oracle Financial Services Market Risk Measurement and Management component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Market Risk Measurement and Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Market Risk Measurement and Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Market Risk Measurement and Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2727 P-13111V-8.0.5 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-13111V-8.0.5 Vulnerability in the Oracle Financial Services Funds Transfer Pricing component of Oracle Financial Services Applications (subcomponent: User Interface). Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Funds Transfer Pricing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Funds Transfer Pricing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Funds Transfer Pricing accessible data as well as unauthorized read access to a subset of Oracle Financial Services Funds Transfer Pricing accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2728 P-5659V-6.1.x P-5659V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5659V-6.1.x P-5659V-8.0.x Vulnerability in the Oracle Financial Services Funds Transfer Pricing component of Oracle Financial Services Applications (subcomponent: User Interface). Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Funds Transfer Pricing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Funds Transfer Pricing accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Funds Transfer Pricing accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2018-2729 P-5659V-6.1.x P-5659V-8.0.x 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5659V-6.1.x P-5659V-8.0.x Vulnerability in the Oracle Retail Merchandising System component of Oracle Retail Applications (subcomponent: Cross Pillar). The supported version that is affected is 16.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Merchandising System. While the vulnerability is in Oracle Retail Merchandising System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Merchandising System accessible data as well as unauthorized read access to a subset of Oracle Retail Merchandising System accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2730 P-1816V-16.0 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-1816V-16.0 Vulnerability in the PeopleSoft Enterprise SCM eProcurement component of Oracle PeopleSoft Products (subcomponent: Manage Requisition Status). Supported versions that are affected are 9.1 and 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM eProcurement accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2018-2731 P-5118V-9.1 P-5118V-9.2 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5118V-9.1 P-5118V-9.2 Vulnerability in the Oracle Financial Services Analytical Applications Reconciliation Framework component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Reconciliation Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Analytical Applications Reconciliation Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Analytical Applications Reconciliation Framework accessible data as well as unauthorized read access to a subset of Oracle Financial Services Analytical Applications Reconciliation Framework accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2018-2732 P-5748V-8.0.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-5748V-8.0.x Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4.007. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Planning, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Planning. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2018-2733 P-4402V-11.1.2.4.007 7.6 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H CPUJan2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpujan2018.html P-4402V-11.1.2.4.007