Oracle Critical Patch Update Advisory - October 2018 - Oracle CVRF Oracle Critical Patch Update Advisory CPUOct2018 Final 6 6 2018-12-18T16:22:00-07:00 Updated affected versions for Oracle Outside In Technology vulnerabilities 2018-10-16T13:00:00-07:00 2018-12-18T16:22:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had security patches released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including security patch distribution information can be found at the Oracle sites referenced in this document. This document is published at: https://www.oracle.com/a/tech/docs/5115881.xml https://www.oracle.com/security-alerts/cpuoct2018.html URL to html version of Advisory Add of MeePwn working with Trend Micro's Zero Day Initiative Alexander Kornbrust Red Database Security Andrej Simko Accenture Andrej Simko of Accenture working with iDefense Labs Anonymous researcher working with Trend Micro's Zero Day Initiative Antonio Sanso Antonio Sanso Artem Smotrakov Artem Smotrakov Aurelien Salomon Pure Hacking Badcode Knownsec 404 Team Behzad Najjarpour Jabbari, Secunia Research at Flexera Software Cyril Vallicari ZIWIT/HTTPCS Devin Rosenbauer Identity Works LLC Felix Dörre Felix Dörre Giulio Comi Horizon Security Graham Steel Cryptosense Gregory Smiley Security Compass Hans-Martin Münch Hans-Martin Münch Hasan Alqawzai Hasan Alqawzai Huy Ngo of Viettel Cyber Security Hysterical Raisins working with Trend Micro's Zero Day Initiative HzH4k HzH4k Jacob Baines Tenable, Inc. Jakub Palaczynski Jason Lang TrustedSec Jayson Grace Sandia National Laboratories Jim LaValley, Towerwall, Inc. Jimi Sebree Tenable, Inc. Joby John Joby John John Moss IRM Security Jonas Mattsson of Outpost24 Ghost Labs Jon King of OPNAV N1, US Navy Jose Domingo Carrillo Lencina (0xd0m7) Kamlapati Choubey of Trend Micro working with Trend Micro's Zero Day Initiative Koustav Sadhukhan Koustav Sadhukhan Kranthi Kumar Kranthi Kumar Krzysztof Szafrański Krzysztof Szafrański Li Qiang of the Qihoo 360 Gear Team Li Zhengdong Hitax Liam Glanfield IRM Security Liao Xinxi NSFocus Security Team Lilei Venustech ADLab Lukasz Mikula LUKASZ MIKULA Lukasz Plonka of ING Tech Poland Maciej Grabiec ING Tech Poland Marcin Wołoszyn ING Services Polska Mark Earnest Identity Works LLC Martin Buchholz Google Matthias Kaiser Code White Mauricio Correa Xlabs Mayank of Birla Institute of Technology, Mesra Michael Orlitzky Michael Orlitzky Mingxuan Song CNCERT Mohammed Fayadh Mohammed Fayadh Nelson William Gamazo Sanchez Trend Micro's Zero Day Initiative Or Hanuka Motorola Solutions Independent security researcher via Beyond Security's SecuriTeam Secure Disclosure program Pawel Gocyla Pawel Gocyla Pethuraj M (mr7) Ph0rse of Qihoo 360 Group 0kee Team Pranshu Tiwari Pranshu Tiwari Quang Nguyen of Viettel Cyber Security Rajat Sharma Rajat Sharma Richard Alvariez Root Object working with Trend Micro's Zero Day Initiative Samet Sahin Sarath Nair Sarath Nair Sean Metcalf Trimarc Security Lokesh Sharma Sébastien Kaul Tobias Ospelt modzero Tom Tervoort Secura Tzachy Horesh Motorola Solutions Vahagn Vardanyan Vahagn Vardanyan Hemanth Joseph of hemanthjoseph.com WenHui Wang WenHui Wang 360 A-TEAM Xiao Pingge Xiao Pingge Zach Edwards victorymedium.com Zekvan Arslan Zekvan Arslan Zhiyi Zhang of 360 ESG Codesafe Team loopx9 loopx9 Big Data Spatial and Graph Version 2.0 Big Data Spatial and Graph Version 2.1 Big Data Spatial and Graph Version 2.2 Communications Application Session Controller Version Prior to 3.7.1M0 Communications Performance Intelligence Center (PIC) Software Version Prior to 10.2.0 Communications Performance Intelligence Center (PIC) Software Version Prior to 10.2.1 Communications User Data Repository Version Prior to 12.2.0 Primavera P6 Enterprise Project Portfolio Management Version 15.1 Primavera P6 Enterprise Project Portfolio Management Version 15.2 Primavera P6 Enterprise Project Portfolio Management Version 16.1 Primavera P6 Enterprise Project Portfolio Management Version 16.2 Primavera P6 Enterprise Project Portfolio Management Version 17.7 - 17.12 Primavera P6 Enterprise Project Portfolio Management Version 18.8 Primavera P6 Enterprise Project Portfolio Management Version 8.4 Primavera Unifier Version 15.1 Primavera Unifier Version 15.2 Primavera Unifier Version 16.1 Primavera Unifier Version 16.2 Primavera Unifier Version 17.1-17.12 Primavera Unifier Version 18.1-18.8 Instantis EnterpriseTrack Version 17.1 Instantis EnterpriseTrack Version 17.2 Instantis EnterpriseTrack Version 17.3 Primavera Gateway Version 15.2 Primavera Gateway Version 16.2 Primavera Gateway Version 17.12 Database - Enterprise Edition Version 11.2.0.4 Database - Enterprise Edition Version 12.1.0.2 Database - Enterprise Edition Version 12.2.0.1 Database - Enterprise Edition Version 18c Text Version 11.2.0.4 Text Version 12.1.0.2 Text Version 12.2.0.1 Applications Manager Version 12.1.3 Applications Manager Version 12.2.3 Applications Manager Version 12.2.4 Applications Manager Version 12.2.5 Applications Manager Version 12.2.6 Applications Manager Version 12.2.7 E-Business Intelligence Version 12.1.1 E-Business Intelligence Version 12.1.2 E-Business Intelligence Version 12.1.3 Marketing Version 12.1.1 Marketing Version 12.1.2 Marketing Version 12.1.3 Marketing Version 12.2.3 Marketing Version 12.2.4 Marketing Version 12.2.5 Marketing Version 12.2.6 Marketing Version 12.2.7 iStore Version 12.1.1 iStore Version 12.1.2 iStore Version 12.1.3 iStore Version 12.2.3 iStore Version 12.2.4 iStore Version 12.2.5 iStore Version 12.2.6 iStore Version 12.2.7 iProcurement Version 12.1.1 iProcurement Version 12.1.2 iProcurement Version 12.1.3 iProcurement Version 12.2.3 iProcurement Version 12.2.4 iProcurement Version 12.2.5 iProcurement Version 12.2.6 iProcurement Version 12.2.7 Application Object Library Version 12.1.3 Application Object Library Version 12.2.3 Application Object Library Version 12.2.4 Application Object Library Version 12.2.5 Application Object Library Version 12.2.6 Application Object Library Version 12.2.7 Trade Management Version 12.1.1 Trade Management Version 12.1.2 Trade Management Version 12.1.3 Trade Management Version 12.2.3 Trade Management Version 12.2.4 Trade Management Version 12.2.5 Trade Management Version 12.2.6 Trade Management Version 12.2.7 Email Center Version 12.1.1 Email Center Version 12.1.2 Email Center Version 12.1.3 Email Center Version 12.2.3 Email Center Version 12.2.4 Email Center Version 12.2.5 Email Center Version 12.2.6 Email Center Version 12.2.7 Partner Management Version 12.1.1 Partner Management Version 12.1.2 Partner Management Version 12.1.3 Partner Management Version 12.2.3 Partner Management Version 12.2.4 Partner Management Version 12.2.5 Partner Management Version 12.2.6 Partner Management Version 12.2.7 Customer Interaction History Version 12.1.1 Customer Interaction History Version 12.1.2 Customer Interaction History Version 12.1.3 Applications Framework Version 12.1.3 Applications Framework Version 12.2.3 Applications Framework Version 12.2.4 Applications Framework Version 12.2.5 Applications Framework Version 12.2.6 Applications Framework Version 12.2.7 User Management Version 12.1.3 User Management Version 12.2.3 User Management Version 12.2.4 User Management Version 12.2.5 User Management Version 12.2.6 User Management Version 12.2.7 Application Management Pack for Oracle E-Business Suite Version 12.1.3 Application Management Pack for Oracle E-Business Suite Version 12.2.3 Application Management Pack for Oracle E-Business Suite Version 12.2.4 Application Management Pack for Oracle E-Business Suite Version 12.2.5 Application Management Pack for Oracle E-Business Suite Version 12.2.6 Application Management Pack for Oracle E-Business Suite Version 12.2.7 Enterprise Manager Base Platform Version 12.1.0.5 Enterprise Manager Base Platform Version 13.2 Configuration Manager Version 12.1.2.0.2 Configuration Manager Version 12.1.2.0.5 Enterprise Manager Ops Center Version 12.2.2 Enterprise Manager Ops Center Version 12.3.3 Enterprise Manager for MySQL Database Version 13.2 Banking Platform Version 2.5.0 Banking Platform Version 2.6.0 Banking Platform Version 2.6.1 Banking Platform Version 2.6.2 Hospitality Reporting and Analytics Version 9.0 Hospitality Reporting and Analytics Version 9.1 Hospitality Gift and Loyalty Version 9.0 Hospitality Gift and Loyalty Version 9.1 MICROS PC Workstation 2015 Version Prior to BIOS 01.3.0.2i Hospitality Materials Control Version 18.1 HTTP Server Version 12.2.1.3 Fusion Middleware MapViewer Version 12.1.3.0 Fusion Middleware MapViewer Version 12.2.1.3 BI Publisher (formerly XML Publisher) Version 11.1.1.7.0 BI Publisher (formerly XML Publisher) Version 11.1.1.9.0 BI Publisher (formerly XML Publisher) Version 12.2.1.3.0 BI Publisher (formerly XML Publisher) Version 12.2.1.4.0 WebCenter Portal Version 11.1.1.9.0 WebCenter Portal Version 12.2.1.3.0 Virtual Directory Version 11.1.1.7.0 Virtual Directory Version 11.1.1.9.0 Identity Manager Version 11.1.2.3.0 Identity Manager Version 12.2.1.3.0 Business Intelligence Enterprise Edition Version 11.1.1.7.0 Business Intelligence Enterprise Edition Version 11.1.1.9.0 Business Intelligence Enterprise Edition Version 12.2.1.3.0 Business Intelligence Enterprise Edition Version 12.2.1.4.0 Real-Time Decision Server Version 3.2.1 Outside In Technology Version 8.5.3 Outside In Technology Version 8.5.4 Adaptive Access Manager Version 11.1.1.7.0 Adaptive Access Manager Version 11.1.2.3.0 WebLogic Server Version 10.3.6.0 WebLogic Server Version 12.1.3.0 WebLogic Server Version 12.2.1.3 WebLogic Server Version prior to Docker 12.2.1.3.20180913 Service Bus Version 12.1.3.0.0 Service Bus Version 12.2.1.3.0 Enterprise Repository Version 11.1.1.7.0 Enterprise Repository Version 12.1.3.0.0 Tuxedo Version 12.1.1.0 GoldenGate Big Data and Application Adapters Version 12.2.0.1 GoldenGate Big Data and Application Adapters Version 12.3.1.1 GoldenGate Big Data and Application Adapters Version 12.3.2.1 GlassFish Server Version 3.1.2 Directory Server Enterprise Edition Version 11.1.1.7 Identity Analytics Version 11.1.1.5.8 API Gateway Version 11.1.2.4.0 WebCenter Sites Version 11.1.1.8.0 WebCenter Sites Version 12.2.1.3.0 Endeca Information Discovery Studio Version 3.1.0 Endeca Information Discovery Studio Version 3.2.0 Endeca Server Version 7.6.1 Endeca Server Version 7.7.0 Endeca Information Discovery Integrator Version 3.1.0 Endeca Information Discovery Integrator Version 3.2.0 Big Data Discovery Version 1.6.0 GoldenGate Version 12.1.2.1.0 GoldenGate Version 12.2.0.2.0 GoldenGate Version 12.3.0.1.0 Healthcare Translational Research Version 3.1.0 Hospitality Cruise Shipboard Property Management System Version 8.0 Hospitality Cruise Fleet Management Version 9.0 Hospitality Guest Access Version 4.2.0 Hospitality Guest Access Version 4.2.1 Hyperion BI+ Version 11.1.2.4 Hyperion Common Events Version 11.1.2.4 Hyperion Data Relationship Management Version 11.1.2.4.345 Hyperion Essbase Administration Services Version 11.1.2.4 Insurance Rules Palette Version 10.0 Insurance Rules Palette Version 10.1 Insurance Rules Palette Version 10.2 Insurance Rules Palette Version 11.0 Insurance Rules Palette Version 11.1 Insurance Calculation Engine Version 10.1.1 Insurance Calculation Engine Version 10.2.1 JD Edwards EnterpriseOne Tools Version 9.2 JD Edwards EnterpriseOne Orchestrator Version 9.2 Java SE JDK and JRE Version 11; Java SE Embedded: 8u181 Java SE JDK and JRE Version 11; Java SE Embedded: 8u181; JRockit: R28.3.19 Java SE JDK and JRE Version 7u191 Java SE JDK and JRE Version 8u181 Java SE JDK and JRE Version 8u181; Java SE Embedded: 8u181; JRockit: R28.3.19 Java SE JDK and JRE Version Java SE: 11 Java SE JDK and JRE Version Java SE: 6u201 Java SE JDK and JRE Version Java SE: 7u191 Java SE JDK and JRE Version Java SE: 8u181 MySQL Server Version 5.5.61 and prior MySQL Server Version 5.6.41 and prior MySQL Server Version 5.7.23 and prior MySQL Server Version 8.0.12 and prior MySQL Enterprise Monitor Version 3.4.9.4237 and prior MySQL Enterprise Monitor Version 4.0.6.5281 and prior MySQL Enterprise Monitor Version 8.0.2.8191 and prior MySQL Connectors Version 8.0.12 and prior PeopleSoft Enterprise PT PeopleTools Version 8.55 PeopleSoft Enterprise PT PeopleTools Version 8.56 PeopleSoft Enterprise PT PeopleTools Version 8.57 PeopleSoft Enterprise PRTL Interaction Hub Version 9.1.0.0 Retail Allocation Version 15.0 Retail Allocation Version 16.0 Retail Assortment Planning Version 14.1 Retail Assortment Planning Version 15.0 Retail Assortment Planning Version 16.0 Retail Extract Tranform and Load Version 13.0 Retail Extract Tranform and Load Version 13.1 Retail Extract Tranform and Load Version 13.2 Retail Integration Bus Version 14.1.2 Retail Predictive Application Server Version 14.0 Retail Predictive Application Server Version 14.1 Retail Predictive Application Server Version 15.0 Retail Predictive Application Server Version 16.0 Retail Sales Audit Version 15.0 Retail Sales Audit Version 16.0 Retail Back Office Version 13.3 Retail Back Office Version 13.4 Retail Back Office Version 14 Retail Back Office Version 14.1 Retail Central Office Version 14.1 Retail Point-of-Service Version 13.4 Retail Point-of-Service Version 14.0 Retail Point-of-Service Version 14.1 Retail Returns Management Version 14.1 Retail Financial Integration Version 13.2 Retail Financial Integration Version 14.0 Retail Financial Integration Version 14.1 Retail Financial Integration Version 15.0 Retail Financial Integration Version 16.0 XBRi Cloud Service Version 10.5.0 XBRi Cloud Service Version 10.6.0 XBRi Cloud Service Version 10.7.0 XBRi Cloud Service Version 10.8.1 XBRi Cloud Service Version 10.8.2 XBRi Cloud Service Version 10.8.3 Retail Xstore Point of Service Version 15.0.2 Retail Xstore Point of Service Version 16.0.4 Retail Xstore Point of Service Version 17.0.2 Retail Xstore Point of Service Version 6.5.12 Retail Xstore Point of Service Version 7.0.7 Retail Xstore Point of Service Version 7.1.7 Retail Order Broker Cloud Service Version 15.0 Retail Order Broker Cloud Service Version 16.0 Retail Order Broker Cloud Service Version 5.0 Retail Order Broker Cloud Service Version 5.1 Retail Order Broker Cloud Service Version 5.2 Retail Open Commerce Platform Cloud Service Version 5.3 Retail Open Commerce Platform Cloud Service Version 5.3.0 Retail Open Commerce Platform Cloud Service Version 6.0 Retail Open Commerce Platform Cloud Service Version 6.0.0 Retail Open Commerce Platform Cloud Service Version 6.0.1 MICROS Relate CRM Software Version 10.8 MICROS Relate CRM Software Version 11.4 MICROS Retail-J Version 12.1.2 MICROS Retail-J Version 13.0.0 MICROS Lucas Version 2.9.5 Retail Customer Management and Segmentation Foundation Version 16.0 Retail Customer Management and Segmentation Foundation Version 17.0 Siebel Apps - Marketing Version 18.7 Siebel Apps - Marketing Version 18.8 Siebel Apps - Marketing Version 18.9 Siebel UI Framework Version 18.7 Siebel UI Framework Version 18.8 Siebel UI Framework Version 18.9 Transportation Management Version 6.3.7 Demantra Demand Management Version 12.2 Demantra Demand Management Version 7.3.5 Agile Engineering Data Management Version 6.1.3 Agile Engineering Data Management Version 6.2.0 Agile Engineering Data Management Version 6.2.1 Agile Product Lifecycle Management for Process Version 6.2.0.0 Agile PLM Framework Version 9.3.3 Agile PLM Framework Version 9.3.4 Agile PLM Framework Version 9.3.5 Agile PLM Framework Version 9.3.6 OSS Support Tools Version Prior to 18.4 SPARC - OPL Service Processor (XCP) Version Prior to XCP1123 Solaris Operating System Version 10 Solaris Operating System Version 11.3 Solaris Operating System Version 11.4 Fujitsu SPARC Servers Firmware Version Prior to XCP2352 Fujitsu SPARC Servers Firmware Version Prior to XCP3050 VM VirtualBox Version Prior to 5.2.20 iLearning Version 6.1 iLearning Version 6.2 Vulnerability in the Oracle Communications Performance Intelligence Center (PIC) Software product of Oracle Communications (component: Security (resteasy-jaxrs)). The supported version that is affected is Prior to 10.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Performance Intelligence Center (PIC) Software. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Performance Intelligence Center (PIC) Software. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2014-3490 P-11044V-Prior to 10.2.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11044V-Prior to 10.2.0 Vulnerability in the Oracle Communications Application Session Controller product of Oracle Communications (component: Security (Glibc)). The supported version that is affected is Prior to 3.7.1M0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Application Session Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications Application Session Controller. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2015-0235 P-10769V-Prior to 3.7.1M0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10769V-Prior to 3.7.1M0 Vulnerability in the Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2015-6937 P-10006V-11.4 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.4 Vulnerability in the Oracle Communications Application Session Controller product of Oracle Communications (component: Security (Apache Commons Collections)). The supported version that is affected is Prior to 3.7.1M0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Application Session Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications Application Session Controller. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2015-7501 P-10769V-Prior to 3.7.1M0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10769V-Prior to 3.7.1M0 Vulnerability in the Oracle Communications Performance Intelligence Center (PIC) Software product of Oracle Communications (component: Security (Apache Commons Collections)). The supported version that is affected is Prior to 10.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Performance Intelligence Center (PIC) Software. Successful attacks of this vulnerability can result in takeover of Oracle Communications Performance Intelligence Center (PIC) Software. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2015-7501 P-11044V-Prior to 10.2.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11044V-Prior to 10.2.1 Vulnerability in the Oracle Banking Platform product of Oracle Financial Services Applications (component: UI (jQuery)). Supported versions that are affected are 2.6.0, 2.6.1 and 2.6.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Platform, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Platform accessible data as well as unauthorized read access to a subset of Oracle Banking Platform accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2015-9251 P-9178V-2.6.0 P-9178V-2.6.1 P-9178V-2.6.2 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9178V-2.6.0 P-9178V-2.6.1 P-9178V-2.6.2 Vulnerability in the Oracle Endeca Information Discovery Studio product of Oracle Fusion Middleware (component: Studio (jQuery)). Supported versions that are affected are 3.1.0 and 3.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Endeca Information Discovery Studio. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Endeca Information Discovery Studio, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Endeca Information Discovery Studio accessible data as well as unauthorized read access to a subset of Oracle Endeca Information Discovery Studio accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2015-9251 P-9634V-3.1.0 P-9634V-3.2.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9634V-3.1.0 P-9634V-3.2.0 Vulnerability in the Oracle Healthcare Translational Research product of Oracle Health Sciences Applications (component: Cohort Explorer (jQuery)). The supported version that is affected is 3.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Translational Research. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Healthcare Translational Research, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Healthcare Translational Research accessible data as well as unauthorized read access to a subset of Oracle Healthcare Translational Research accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2015-9251 P-9427V-3.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9427V-3.1.0 Vulnerability in the Oracle Hospitality Guest Access product of Oracle Hospitality Applications (component: Base (jQuery)). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Guest Access, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Guest Access accessible data as well as unauthorized read access to a subset of Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2015-9251 P-12617V-4.2.0 P-12617V-4.2.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the Oracle Hospitality Materials Control product of Oracle Food and Beverage Applications (component: MobileAuthWebService (jQuery)). The supported version that is affected is 18.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Materials Control. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Materials Control, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Materials Control accessible data as well as unauthorized read access to a subset of Oracle Hospitality Materials Control accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2015-9251 P-12573V-18.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-12573V-18.1 Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (jQuery)). Supported versions that are affected are 15.2, 16.2 and 17.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Gateway accessible data as well as unauthorized read access to a subset of Primavera Gateway accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2015-9251 P-10605V-15.2 P-10605V-16.2 P-10605V-17.12 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10605V-15.2 P-10605V-16.2 P-10605V-17.12 Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality (jQuery)). Supported versions that are affected are 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Service Bus, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Service Bus accessible data as well as unauthorized read access to a subset of Oracle Service Bus accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2015-9251 P-5308V-12.1.3.0.0 P-5308V-12.2.1.3.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5308V-12.1.3.0.0 P-5308V-12.2.1.3.0 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI (jQuery)). The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2015-9251 P-9617V-11.1.1.8.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9617V-11.1.1.8.0 Vulnerability in the Oracle Communications Performance Intelligence Center (PIC) Software product of Oracle Communications (component: Security (Spring Framework)). The supported version that is affected is Prior to 10.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Performance Intelligence Center (PIC) Software. Successful attacks of this vulnerability can result in takeover of Oracle Communications Performance Intelligence Center (PIC) Software. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-0635 P-11044V-Prior to 10.2.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11044V-Prior to 10.2.1 Vulnerability in the Oracle Communications User Data Repository product of Oracle Communications (component: Security (Apache Xerces)). The supported version that is affected is Prior to 12.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications User Data Repository. Successful attacks of this vulnerability can result in takeover of Oracle Communications User Data Repository. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-0729 P-11108V-Prior to 12.2.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11108V-Prior to 12.2.0 Vulnerability in the MICROS Relate CRM Software product of Oracle Retail Applications (component: Web Services (Apache Commons)). Supported versions that are affected are 10.8 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Relate CRM Software. Successful attacks of this vulnerability can result in takeover of MICROS Relate CRM Software. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-1000031 P-11566V-10.8 P-11566V-11.4 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11566V-10.8 P-11566V-11.4 Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Internal Operations (Apache Commons)). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Management and Segmentation Foundation. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-1000031 P-13388V-16.0 P-13388V-17.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-13388V-16.0 P-13388V-17.0 Vulnerability in the Oracle Adaptive Access Manager product of Oracle Fusion Middleware (component: OAAM Server (Apache Struts 1)). Supported versions that are affected are 11.1.1.7.0 and 11.1.2.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Adaptive Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Adaptive Access Manager as well as unauthorized update, insert or delete access to some of Oracle Adaptive Access Manager accessible data. CVSS 3.0 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2016-1182 P-4419V-11.1.1.7.0 P-4419V-11.1.2.3.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4419V-11.1.1.7.0 P-4419V-11.1.2.3.0 Vulnerability in the Oracle Communications Performance Intelligence Center (PIC) Software product of Oracle Communications (component: Security (Apache Struts 1)). The supported version that is affected is Prior to 10.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Performance Intelligence Center (PIC) Software. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Performance Intelligence Center (PIC) Software as well as unauthorized update, insert or delete access to some of Oracle Communications Performance Intelligence Center (PIC) Software accessible data. CVSS 3.0 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2016-1182 P-11044V-Prior to 10.2.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11044V-Prior to 10.2.0 Vulnerability in the Oracle Real-Time Decision Server product of Oracle Fusion Middleware (component: Platform Installation (Apache Struts 1)). The supported version that is affected is 3.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Real-Time Decision Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Real-Time Decision Server as well as unauthorized update, insert or delete access to some of Oracle Real-Time Decision Server accessible data. CVSS 3.0 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2016-1182 P-2104V-3.2.1 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2104V-3.2.1 Vulnerability in the Oracle Communications Application Session Controller product of Oracle Communications (component: Security (OpenSSL)). The supported version that is affected is Prior to 3.7.1M0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Application Session Controller. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Application Session Controller accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2016-2107 P-10769V-Prior to 3.7.1M0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10769V-Prior to 3.7.1M0 Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Networking (Jython)). Supported versions that are affected are 12.2.2 and 12.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops Center. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-4000 P-9835V-12.2.2 P-9835V-12.3.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9835V-12.2.2 P-9835V-12.3.3 Vulnerability in the Oracle Communications Performance Intelligence Center (PIC) Software product of Oracle Communications (component: Security (Apache Trinidad)). The supported version that is affected is Prior to 10.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Performance Intelligence Center (PIC) Software. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications Performance Intelligence Center (PIC) Software accessible data as well as unauthorized read access to a subset of Oracle Communications Performance Intelligence Center (PIC) Software accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Performance Intelligence Center (PIC) Software. CVSS 3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H). Security patch has been released CVE-2016-5019 P-11044V-Prior to 10.2.1 6.7 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11044V-Prior to 10.2.1 Vulnerability in the Oracle Communications Performance Intelligence Center (PIC) Software product of Oracle Communications (component: Security (Objective System ASN1C)). The supported version that is affected is Prior to 10.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle Communications Performance Intelligence Center (PIC) Software. Successful attacks of this vulnerability can result in takeover of Oracle Communications Performance Intelligence Center (PIC) Software. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-5080 P-11044V-Prior to 10.2.1 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11044V-Prior to 10.2.1 Vulnerability in the Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2016-5244 P-10006V-11.4 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.4 Vulnerability in the Spatial product of Oracle Big Data Graph (component: Big Data Graph (Apache Groovy)). Supported versions that are affected are 2.0, 2.1 and 2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Spatial. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Spatial, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Spatial. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2016-6814 P-11528V-2.0 P-11528V-2.1 P-11528V-2.2 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11528V-2.0 P-11528V-2.1 P-11528V-2.2 Vulnerability in the Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers product of Oracle Systems (component: XCP Firmware (curl)). Supported versions that are affected are Prior to XCP2352 and Prior to XCP3050. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. Successful attacks of this vulnerability can result in takeover of Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-7167 P-10656V-Prior to XCP2352 P-10656V-Prior to XCP3050 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10656V-Prior to XCP2352 P-10656V-Prior to XCP3050 Vulnerability in the SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers product of Oracle Systems (component: XCP Firmware (curl)). The supported version that is affected is Prior to XCP1123. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers. Successful attacks of this vulnerability can result in takeover of SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers. Note: SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers are not affected by CVE-2017-7407 and CVE-2016-7141. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-7167 P-9845V-Prior to XCP1123 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9845V-Prior to XCP1123 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB (zlib)). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2016-9843 P-8478V-5.5.61 and prior P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.5.61 and prior P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Oracle Fusion Middleware MapViewer product of Oracle Fusion Middleware (component: Install (AntiSamy)). Supported versions that are affected are 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Fusion Middleware MapViewer, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Fusion Middleware MapViewer accessible data as well as unauthorized read access to a subset of Oracle Fusion Middleware MapViewer accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2017-14735 P-1215V-12.1.3.0 P-1215V-12.2.1.3 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1215V-12.1.3.0 P-1215V-12.2.1.3 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (jackson-databind)). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-15095 P-1980V-11.1.2.3.0 P-1980V-12.2.1.3.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1980V-11.1.2.3.0 P-1980V-12.2.1.3.0 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Inf (jackson-databind)). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-15095 P-4781V-9.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4781V-9.2 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics (jackson-databind)). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-15095 P-4781V-9.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4781V-9.2 Vulnerability in the Oracle Retail Open Commerce Platform product of Oracle Retail Applications (component: Framework (jackson-databind)). Supported versions that are affected are 5.3.0, 6.0.0 and 6.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Retail Open Commerce Platform. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-15095 P-11521V-5.3.0 P-11521V-6.0.0 P-11521V-6.0.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11521V-5.3.0 P-11521V-6.0.0 P-11521V-6.0.1 Vulnerability in the Oracle Communications Performance Intelligence Center (PIC) Software product of Oracle Communications (component: Security (OpenSSL)). The supported version that is affected is Prior to 10.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Performance Intelligence Center (PIC) Software. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Performance Intelligence Center (PIC) Software accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2017-3736 P-11044V-Prior to 10.2.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11044V-Prior to 10.2.1 Vulnerability in the Oracle Retail Open Commerce Platform product of Oracle Retail Applications (component: Framework (JasperReports)). Supported versions that are affected are 5.3.0, 6.0.0 and 6.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Retail Open Commerce Platform. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5533 P-11521V-5.3.0 P-11521V-6.0.0 P-11521V-6.0.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11521V-5.3.0 P-11521V-6.0.0 P-11521V-6.0.1 Vulnerability in the Oracle Retail Order Broker product of Oracle Retail Applications (component: Order Broker Foundation (JasperReports)). The supported version that is affected is 5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Order Broker. Successful attacks of this vulnerability can result in takeover of Oracle Retail Order Broker. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5533 P-11520V-5.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11520V-5.0 Vulnerability in the Oracle API Gateway product of Oracle Fusion Middleware (component: Oracle API Gateway (Apache Log4j)). The supported version that is affected is 11.1.2.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle API Gateway. Successful attacks of this vulnerability can result in takeover of Oracle API Gateway. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-9195V-11.1.2.4.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9195V-11.1.2.4.0 Vulnerability in the BI Publisher (formerly XML Publisher) product of Oracle Fusion Middleware (component: BI Publisher Security (Apache Log4j)). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in takeover of BI Publisher (formerly XML Publisher). CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 P-1479V-12.2.1.3.0 P-1479V-12.2.1.4.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1479V-11.1.1.7.0 P-1479V-11.1.1.9.0 P-1479V-12.2.1.3.0 P-1479V-12.2.1.4.0 Vulnerability in the Oracle Configuration Manager product of Oracle Enterprise Manager (component: Collector of Config and Diag (Apache Log4j)). Supported versions that are affected are 12.1.2.0.2 and 12.1.2.0.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configuration Manager. Successful attacks of this vulnerability can result in takeover of Oracle Configuration Manager. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-1967V-12.1.2.0.2 P-1967V-12.1.2.0.5 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1967V-12.1.2.0.2 P-1967V-12.1.2.0.5 Vulnerability in the Oracle Identity Analytics product of Oracle Fusion Middleware (component: Security (Apache Log4j)). The supported version that is affected is 11.1.1.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Analytics. Successful attacks of this vulnerability can result in takeover of Oracle Identity Analytics. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-8522V-11.1.1.5.8 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8522V-11.1.1.5.8 Vulnerability in the Oracle Identity Management Suite product of Oracle Fusion Middleware (component: Suite Level Patch Issues (Apache Log4j)). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Identity Management Suite. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-1980V-11.1.2.3.0 P-1980V-12.2.1.3.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1980V-11.1.2.3.0 P-1980V-12.2.1.3.0 Vulnerability in the Oracle Insurance Calculation Engine product of Oracle Insurance Applications (component: Calculation engine (Apache Log4j)). Supported versions that are affected are 10.1.1 and 10.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Calculation Engine. Successful attacks of this vulnerability can result in takeover of Oracle Insurance Calculation Engine. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-10837V-10.1.1 P-10837V-10.2.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10837V-10.1.1 P-10837V-10.2.1 Vulnerability in the Oracle Insurance Rules Palette product of Oracle Insurance Applications (component: Rules Palette (Apache Log4j)). Supported versions that are affected are 10.0, 10.1, 10.2, 11.0 and 11.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Rules Palette. Successful attacks of this vulnerability can result in takeover of Oracle Insurance Rules Palette. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-5288V-10.0 P-5288V-10.1 P-5288V-10.2 P-5288V-11.0 P-5288V-11.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5288V-10.0 P-5288V-10.1 P-5288V-10.2 P-5288V-11.0 P-5288V-11.1 Vulnerability in the Oracle Retail Extract Transform and Load product of Oracle Retail Applications (component: Mathematical Operators (Apache Log4j)). Supported versions that are affected are 13.0, 13.1 and 13.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Extract Transform and Load. Successful attacks of this vulnerability can result in takeover of Oracle Retail Extract Transform and Load. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-1803V-13.0 P-1803V-13.1 P-1803V-13.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1803V-13.0 P-1803V-13.1 P-1803V-13.2 Vulnerability in the Oracle Retail Open Commerce Platform product of Oracle Retail Applications (component: Framework (Apache Log4j)). Supported versions that are affected are 5.3.0, 6.0.0 and 6.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Retail Open Commerce Platform. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-11521V-5.3.0 P-11521V-6.0.0 P-11521V-6.0.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11521V-5.3.0 P-11521V-6.0.0 P-11521V-6.0.1 Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI (Apache Log4j)). Supported versions that are affected are 18.7, 18.8 and 18.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in takeover of Siebel UI Framework. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-5645 P-9011V-18.7 P-9011V-18.8 P-9011V-18.9 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9011V-18.7 P-9011V-18.8 P-9011V-18.9 Vulnerability in the MICROS PC Workstation 2015 product of Oracle Food and Beverage Applications (component: BIOS). The supported version that is affected is Prior to BIOS 01.3.0.2i. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MICROS PC Workstation 2015 executes to compromise MICROS PC Workstation 2015. While the vulnerability is in MICROS PC Workstation 2015, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MICROS PC Workstation 2015 accessible data. CVSS 3.0 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). Security patch has been released CVE-2017-5715 P-11637V-Prior to BIOS 01.3.0.2i 5.6 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11637V-Prior to BIOS 01.3.0.2i Vulnerability in the Oracle Directory Server Enterprise Edition product of Oracle Fusion Middleware (component: Admin Console (Sun Security Libraries)). The supported version that is affected is 11.1.1.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Directory Server Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Directory Server Enterprise Edition. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2017-7805 P-8512V-11.1.1.7 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8512V-11.1.1.7 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PeopleSoft CDA (Apache HTTP Server)). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2017-9798 P-5085V-8.55 P-5085V-8.56 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Tuxedo product of Oracle Fusion Middleware (component: Docs-ATMI-IB (OpenSSL)). The supported version that is affected is 12.1.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Tuxedo. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-0732 P-5433V-12.1.1.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5433V-12.1.1.0 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core (OpenSSL)). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-0732 P-8370V-Prior to 5.2.20 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle Endeca Server product of Oracle Fusion Middleware (component: Product Code (OpenSSL)). Supported versions that are affected are 7.6.1 and 7.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Endeca Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Endeca Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-0739 P-10217V-7.6.1 P-10217V-7.7.0 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10217V-7.6.1 P-10217V-7.7.0 Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (OpenSSL)). Supported versions that are affected are 12.1.0.5 and 13.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-0739 P-1370V-12.1.0.5 P-1370V-13.2 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1370V-12.1.0.5 P-1370V-13.2 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure (OpenSSL)). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-0739 P-4781V-9.2 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4781V-9.2 Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Services Tools Bundle (OpenSSL)). The supported version that is affected is Prior to 18.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise OSS Support Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of OSS Support Tools. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-0739 P-1330V-Prior to 18.4 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1330V-Prior to 18.4 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-0739 P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener (curl)). The supported version that is affected is 12.2.1.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1000300 P-1042V-12.2.1.3 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1042V-12.2.1.3 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access (Spring Framework)). The supported version that is affected is 18.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-11039 P-5579V-18.8 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5579V-18.8 Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General (Apache Struts 2)). Supported versions that are affected are 3.4.9.4237 and prior, 4.0.6.5281 and prior and 8.0.2.8191 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-11776 P-8480V-3.4.9.4237 and prior P-8480V-4.0.6.5281 and prior P-8480V-8.0.2.8191 and prior 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8480V-3.4.9.4237 and prior P-8480V-4.0.6.5281 and prior P-8480V-8.0.2.8191 and prior Vulnerability in the Oracle Banking Platform product of Oracle Financial Services Applications (component: Infrastructure (jackson-databind)). Supported versions that are affected are 2.5.0, 2.6.0, 2.6.1 and 2.6.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Platform. Successful attacks of this vulnerability can result in takeover of Oracle Banking Platform. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-12023 P-9178V-2.5.0 P-9178V-2.6.0 P-9178V-2.6.1 P-9178V-2.6.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9178V-2.5.0 P-9178V-2.6.0 P-9178V-2.6.1 P-9178V-2.6.2 Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core (jackson-databind)). Supported versions that are affected are 15.1, 15.2, 16.1, 16.2, 17.1-17.12 and 18.1-18.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera Unifier. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-12023 P-10354V-15.1 P-10354V-15.2 P-10354V-16.1 P-10354V-16.2 P-10354V-17.1-17.12 P-10354V-18.1-18.8 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10354V-15.1 P-10354V-15.2 P-10354V-16.1 P-10354V-16.2 P-10354V-17.1-17.12 P-10354V-18.1-18.8 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server (Spring Framework)). Supported versions that are affected are 9.3.3, 9.3.4, 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-4461V-9.3.3 P-4461V-9.3.4 P-4461V-9.3.5 P-4461V-9.3.6 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4461V-9.3.3 P-4461V-9.3.4 P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Oracle Endeca Information Discovery Integrator product of Oracle Fusion Middleware (component: Other Issues (Spring Framework)). Supported versions that are affected are 3.1.0 and 3.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Endeca Information Discovery Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Endeca Information Discovery Integrator. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-10561V-3.1.0 P-10561V-3.2.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10561V-3.1.0 P-10561V-3.2.0 Vulnerability in the Enterprise Manager for MySQL Database product of Oracle Enterprise Manager (component: EM Plugin: General (Spring Framework)). The supported version that is affected is 13.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager for MySQL Database. Successful attacks of this vulnerability can result in takeover of Enterprise Manager for MySQL Database. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-11166V-13.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11166V-13.2 Vulnerability in the Oracle Hospitality Guest Access product of Oracle Hospitality Applications (component: Base (Spring Framework)). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Guest Access. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-12617V-4.2.0 P-12617V-4.2.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the MICROS Lucas product of Oracle Retail Applications (component: Security (Spring Framework)). The supported version that is affected is 2.9.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MICROS Lucas. Successful attacks of this vulnerability can result in takeover of MICROS Lucas. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-12633V-2.9.5 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-12633V-2.9.5 Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General (Spring Framework)). Supported versions that are affected are 3.4.9.4237 and prior, 4.0.6.5281 and prior and 8.0.2.8191 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-8480V-3.4.9.4237 and prior P-8480V-4.0.6.5281 and prior P-8480V-8.0.2.8191 and prior 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8480V-3.4.9.4237 and prior P-8480V-4.0.6.5281 and prior P-8480V-8.0.2.8191 and prior Vulnerability in the Oracle Retail Assortment Planning product of Oracle Retail Applications (component: Application Core (Spring Framework)). Supported versions that are affected are 14.1, 15.0 and 16.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Assortment Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Assortment Planning. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-1788V-14.1 P-1788V-15.0 P-1788V-16.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1788V-14.1 P-1788V-15.0 P-1788V-16.0 Vulnerability in the Oracle Retail Financial Integration product of Oracle Retail Applications (component: PeopleSoft Integration Bugs (Spring Framework)). Supported versions that are affected are 13.2, 14.0, 14.1, 15.0 and 16.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Financial Integration. Successful attacks of this vulnerability can result in takeover of Oracle Retail Financial Integration. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-10722V-13.2 P-10722V-14.0 P-10722V-14.1 P-10722V-15.0 P-10722V-16.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10722V-13.2 P-10722V-14.0 P-10722V-14.1 P-10722V-15.0 P-10722V-16.0 Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal (Spring Framework)). The supported version that is affected is 14.1.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Integration Bus. Successful attacks of this vulnerability can result in takeover of Oracle Retail Integration Bus. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-1807V-14.1.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1807V-14.1.2 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps (Spring Framework)). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1258 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.3 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.3 Vulnerability in the Oracle Big Data Discovery product of Oracle Fusion Middleware (component: Data Processing (Spring Framework)). The supported version that is affected is 1.6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Big Data Discovery. Successful attacks of this vulnerability can result in takeover of Oracle Big Data Discovery. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1275 P-11305V-1.6.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11305V-1.6.0 Vulnerability in the Oracle GoldenGate for Big Data product of Oracle Fusion Middleware (component: Other issues (Spring Framework)). Supported versions that are affected are 12.2.0.1, 12.3.1.1 and 12.3.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate for Big Data. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate for Big Data. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1275 P-5760V-12.2.0.1 P-5760V-12.3.1.1 P-5760V-12.3.2.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5760V-12.2.0.1 P-5760V-12.3.1.1 P-5760V-12.3.2.1 Vulnerability in the Oracle Insurance Calculation Engine product of Oracle Insurance Applications (component: Calculation engine (Spring Framework)). Supported versions that are affected are 10.1.1 and 10.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Calculation Engine. Successful attacks of this vulnerability can result in takeover of Oracle Insurance Calculation Engine. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1275 P-10837V-10.1.1 P-10837V-10.2.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10837V-10.1.1 P-10837V-10.2.1 Vulnerability in the Oracle Insurance Rules Palette product of Oracle Insurance Applications (component: Rules Palette (Spring Framework)). Supported versions that are affected are 10.0, 10.1, 10.2, 11.0 and 11.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Rules Palette. Successful attacks of this vulnerability can result in takeover of Oracle Insurance Rules Palette. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1275 P-5288V-10.0 P-5288V-10.1 P-5288V-10.2 P-5288V-11.0 P-5288V-11.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5288V-10.0 P-5288V-10.1 P-5288V-10.2 P-5288V-11.0 P-5288V-11.1 Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Web Access (Spring Framework)). Supported versions that are affected are 15.2, 16.2 and 17.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1275 P-10605V-15.2 P-10605V-16.2 P-10605V-17.12 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10605V-15.2 P-10605V-16.2 P-10605V-17.12 Vulnerability in the Oracle Retail Open Commerce Platform product of Oracle Retail Applications (component: Framework (Spring Framework)). Supported versions that are affected are 5.3.0, 6.0.0 and 6.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Retail Open Commerce Platform. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1275 P-11521V-5.3.0 P-11521V-6.0.0 P-11521V-6.0.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11521V-5.3.0 P-11521V-6.0.0 P-11521V-6.0.1 Vulnerability in the Oracle Retail Order Broker product of Oracle Retail Applications (component: System Administration (Spring Framework)). Supported versions that are affected are 5.1, 5.2, 15.0 and 16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Order Broker. Successful attacks of this vulnerability can result in takeover of Oracle Retail Order Broker. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1275 P-11520V-5.1 P-11520V-5.2 P-11520V-15.0 P-11520V-16.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11520V-5.1 P-11520V-5.2 P-11520V-15.0 P-11520V-16.0 Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Fusion Client (Spring Framework)). Supported versions that are affected are 14.0, 14.1, 15.0 and 16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1275 P-1823V-14.0 P-1823V-14.1 P-1823V-15.0 P-1823V-16.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1823V-14.0 P-1823V-14.1 P-1823V-15.0 P-1823V-16.0 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install (Apache Tomcat)). Supported versions that are affected are 6.1.3, 6.2.0 and 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-4436V-6.1.3 P-4436V-6.2.0 P-4436V-6.2.1 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4436V-6.1.3 P-4436V-6.2.0 P-4436V-6.2.1 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments (Apache Tomcat)). Supported versions that are affected are 9.3.3, 9.3.4, 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-4461V-9.3.3 P-4461V-9.3.4 P-4461V-9.3.5 P-4461V-9.3.6 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4461V-9.3.3 P-4461V-9.3.4 P-4461V-9.3.5 P-4461V-9.3.6 Vulnerability in the Oracle Hospitality Guest Access product of Oracle Hospitality Applications (component: Base (Apache Tomcat)). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-12617V-4.2.0 P-12617V-4.2.1 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-12617V-4.2.0 P-12617V-4.2.1 Vulnerability in the Instantis EnterpriseTrack product of Oracle Construction and Engineering (component: Generic (Apache Tomcat)). Supported versions that are affected are 17.1, 17.2 and 17.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Instantis EnterpriseTrack. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Instantis EnterpriseTrack accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-10563V-17.1 P-10563V-17.2 P-10563V-17.3 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10563V-17.1 P-10563V-17.2 P-10563V-17.3 Vulnerability in the Oracle Retail Order Broker product of Oracle Retail Applications (component: Upgrade Install (Apache Tomcat)). Supported versions that are affected are 5.1, 5.2 and 15.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Order Broker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Order Broker accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-11520V-5.1 P-11520V-5.2 P-11520V-15.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11520V-5.1 P-11520V-5.2 P-11520V-15.0 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mktg/Campaign Mgmt (Apache Tomcat)). Supported versions that are affected are 18.7, 18.8 and 18.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-8974V-18.7 P-8974V-18.8 P-8974V-18.9 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8974V-18.7 P-8974V-18.8 P-8974V-18.9 Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Install (Apache Tomcat)). The supported version that is affected is 6.3.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Transportation Management accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-1991V-6.3.7 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1991V-6.3.7 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI (Apache Tomcat)). Supported versions that are affected are 11.1.1.8.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-9617V-11.1.1.8.0 P-9617V-12.2.1.3.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.3.0 Vulnerability in the MICROS XBRi product of Oracle Retail Applications (component: Retail (Apache Tomcat)). Supported versions that are affected are 10.8.3, 10.8.2, 10.8.1, 10.7.0, 10.6.0 and 10.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MICROS XBRi. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MICROS XBRi accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-1305 P-11506V-10.8.3 P-11506V-10.8.2 P-11506V-10.8.1 P-11506V-10.7.0 P-11506V-10.6.0 P-11506V-10.5.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11506V-10.8.3 P-11506V-10.8.2 P-11506V-10.8.1 P-11506V-10.7.0 P-11506V-10.6.0 P-11506V-10.5.0 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Deployment (libpng)). Supported versions that are affected are Java SE: 6u201, 7u191, 8u181 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2018-13785 P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters (ODA Module)). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-18223 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters (ODA Module)). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-18224 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the MICROS Retail-J product of Oracle Retail Applications (component: Back Office). Supported versions that are affected are 13.0.0 and 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MICROS Retail-J accessible data as well as unauthorized read access to a subset of MICROS Retail-J accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2018-2887 P-11567V-13.0.0 P-11567V-12.1.2 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11567V-13.0.0 P-11567V-12.1.2 Vulnerability in the MICROS Retail-J product of Oracle Retail Applications (component: Internal Operations). The supported version that is affected is 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MICROS Retail-J accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-2889 P-11567V-12.1.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11567V-12.1.2 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-2902 P-5242V-10.3.6.0 P-5242V-12.1.3.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-2909 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle GlassFish Server product of Oracle Fusion Middleware (component: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle GlassFish Server accessible data as well as unauthorized access to critical data or complete access to all Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L). Security patch has been released CVE-2018-2911 P-8493V-3.1.2 8.3 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8493V-3.1.2 Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Manager). Supported versions that are affected are 12.1.2.1.0, 12.2.0.2.0 and 12.3.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-2912 P-5757V-12.1.2.1.0 P-5757V-12.2.0.2.0 P-5757V-12.3.0.1.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5757V-12.1.2.1.0 P-5757V-12.2.0.2.0 P-5757V-12.3.0.1.0 Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Monitoring Manager). Supported versions that are affected are 12.1.2.1.0, 12.2.0.2.0 and 12.3.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle GoldenGate. While the vulnerability is in Oracle GoldenGate, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. Note: For Linux and Windows platforms, the CVSS score is 9.0 with Access Complexity as High. For all other platforms, the cvss score is 10.0. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-2913 P-5757V-12.1.2.1.0 P-5757V-12.2.0.2.0 P-5757V-12.3.0.1.0 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5757V-12.1.2.1.0 P-5757V-12.2.0.2.0 P-5757V-12.3.0.1.0 Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Manager). Supported versions that are affected are 12.1.2.1.0, 12.2.0.2.0 and 12.3.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-2914 P-5757V-12.1.2.1.0 P-5757V-12.2.0.2.0 P-5757V-12.3.0.1.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5757V-12.1.2.1.0 P-5757V-12.2.0.2.0 P-5757V-12.3.0.1.0 Vulnerability in the Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-2922 P-10006V-11.3 2.5 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: REST Services). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-2971 P-1472V-12.1.3 P-1472V-12.2.3 P-1472V-12.2.4 P-1472V-12.2.5 P-1472V-12.2.6 P-1472V-12.2.7 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1472V-12.1.3 P-1472V-12.2.3 P-1472V-12.2.4 P-1472V-12.2.5 P-1472V-12.2.6 P-1472V-12.2.7 Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Trade Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3011 P-765V-12.1.1 P-765V-12.1.2 P-765V-12.1.3 P-765V-12.2.3 P-765V-12.2.4 P-765V-12.2.5 P-765V-12.2.6 P-765V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-765V-12.1.1 P-765V-12.1.2 P-765V-12.1.3 P-765V-12.2.3 P-765V-12.2.4 P-765V-12.2.5 P-765V-12.2.6 P-765V-12.2.7 Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: UIF Open UI). Supported versions that are affected are 18.7, 18.8 and 18.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel UI Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel UI Framework accessible data as well as unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3059 P-9011V-18.7 P-9011V-18.8 P-9011V-18.9 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9011V-18.7 P-9011V-18.8 P-9011V-18.9 Vulnerability in the Oracle Retail Sales Audit product of Oracle Retail Applications (component: Operational Insights). Supported versions that are affected are 15.0 and 16.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Sales Audit. While the vulnerability is in Oracle Retail Sales Audit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Sales Audit accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Sales Audit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Sales Audit. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L). Security patch has been released CVE-2018-3115 P-1834V-15.0 P-1834V-16.0 7.7 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1834V-15.0 P-1834V-16.0 Vulnerability in the Oracle Retail Open Commerce Platform product of Oracle Retail Applications (component: Integrations). Supported versions that are affected are 6.0, 6.0.1 and 5.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail Open Commerce Platform accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail Open Commerce Platform accessible data. CVSS 3.0 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N). Security patch has been released CVE-2018-3122 P-11521V-6.0 P-11521V-6.0.1 P-11521V-5.3 6.8 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11521V-6.0 P-11521V-6.0.1 P-11521V-5.3 Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment). Supported versions that are affected are 15.0.2, 16.0.4 and 17.0.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in takeover of Oracle Retail Xstore Point of Service. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3126 P-11513V-15.0.2 P-11513V-16.0.4 P-11513V-17.0.2 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11513V-15.0.2 P-11513V-16.0.4 P-11513V-17.0.2 Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 7.3.5 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demantra Demand Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Demantra Demand Management accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Security patch has been released CVE-2018-3127 P-2100V-7.3.5 P-2100V-12.2 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2100V-7.3.5 P-2100V-12.2 Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Report). Supported versions that are affected are 9.0 and 9.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Security patch has been released CVE-2018-3128 P-11599V-9.0 P-11599V-9.1 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11599V-9.0 P-11599V-9.1 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Security patch has been released CVE-2018-3129 P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 Vulnerability in the PeopleSoft Enterprise Interaction Hub product of Oracle PeopleSoft (component: Application Portal). The supported version that is affected is 9.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise Interaction Hub. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise Interaction Hub accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2018-3130 P-5090V-9.1.0.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5090V-9.1.0.0 Vulnerability in the Oracle Hospitality Gift and Loyalty product of Oracle Food and Beverage Applications (component: Report). Supported versions that are affected are 9.0 and 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Gift and Loyalty executes to compromise Oracle Hospitality Gift and Loyalty. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Gift and Loyalty accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Gift and Loyalty accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Security patch has been released CVE-2018-3131 P-11600V-9.0 P-11600V-9.1 6.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11600V-9.0 P-11600V-9.1 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3132 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3133 P-8478V-5.5.61 and prior P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.5.61 and prior P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: User Group Management). The supported version that is affected is 6.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Product Lifecycle Management for Process executes to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.0 Base Score 5.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N). Security patch has been released CVE-2018-3134 P-4445V-6.2.0.0 5.0 AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4445V-6.2.0.0 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). Security patch has been released CVE-2018-3135 P-5085V-8.55 P-5085V-8.56 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 6u201, 7u191, 8u181 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.4 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N). Security patch has been released CVE-2018-3136 P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181 3.4 AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3137 P-8478V-8.0.12 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Attachments / File Upload). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3138 P-1472V-12.1.3 P-1472V-12.2.3 P-1472V-12.2.4 P-1472V-12.2.5 P-1472V-12.2.6 P-1472V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1472V-12.1.3 P-1472V-12.2.3 P-1472V-12.2.4 P-1472V-12.2.5 P-1472V-12.2.6 P-1472V-12.2.7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 6u201, 7u191, 8u181 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3139 P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181 Vulnerability in the Hyperion Essbase Administration Services product of Oracle Hyperion (component: EAS Console). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Essbase Administration Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hyperion Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion Essbase Administration Services accessible data as well as unauthorized read access to a subset of Hyperion Essbase Administration Services accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3140 P-4380V-11.1.2.4 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4380V-11.1.2.4 Vulnerability in the Hyperion Essbase Administration Services product of Oracle Hyperion (component: EAS Console). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Essbase Administration Services. While the vulnerability is in Hyperion Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion Essbase Administration Services accessible data. CVSS 3.0 Base Score 5.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N). Security patch has been released CVE-2018-3141 P-4380V-11.1.2.4 5.8 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4380V-11.1.2.4 Vulnerability in the Hyperion Essbase Administration Services product of Oracle Hyperion (component: EAS Console). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hyperion Essbase Administration Services. While the vulnerability is in Hyperion Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hyperion Essbase Administration Services accessible data. CVSS 3.0 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Security patch has been released CVE-2018-3142 P-4380V-11.1.2.4 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4380V-11.1.2.4 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3143 P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Audit). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3144 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3145 P-8478V-8.0.12 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the Oracle iLearning product of Oracle iLearning (component: Learner Administration). Supported versions that are affected are 6.1 and 6.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iLearning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iLearning, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iLearning accessible data as well as unauthorized update, insert or delete access to some of Oracle iLearning accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3146 P-902V-6.1 P-902V-6.2 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-902V-6.1 P-902V-6.2 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3147 P-2276V-8.5.3 P-2276V-8.5.4 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 15.1, 15.2, 16.1, 16.2, 17.1-17.12 and 18.1-18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3148 P-10354V-15.1 P-10354V-15.2 P-10354V-16.1 P-10354V-16.2 P-10354V-17.1-17.12 P-10354V-18.1-18.8 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10354V-15.1 P-10354V-15.2 P-10354V-16.1 P-10354V-16.2 P-10354V-17.1-17.12 P-10354V-18.1-18.8 Vulnerability in the Java SE, Java SE Embedded, JRockit product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u181 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3149 P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181; JRockit: R28.3.19 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181; JRockit: R28.3.19 Vulnerability in the Java SE product of Oracle Java SE (component: Utility). The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2018-3150 P-856V-Java SE: 11 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 11 Vulnerability in the Oracle iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iProcurement. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iProcurement accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-3151 P-398V-12.1.1 P-398V-12.1.2 P-398V-12.1.3 P-398V-12.2.3 P-398V-12.2.4 P-398V-12.2.5 P-398V-12.2.6 P-398V-12.2.7 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-398V-12.1.1 P-398V-12.1.2 P-398V-12.1.3 P-398V-12.2.3 P-398V-12.2.4 P-398V-12.2.5 P-398V-12.2.6 P-398V-12.2.7 Vulnerability in the Oracle GlassFish Server product of Oracle Fusion Middleware (component: Administration). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3152 P-8493V-3.1.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8493V-3.1.2 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3153 P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3154 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Security patch has been released CVE-2018-3155 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3156 P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Java SE product of Oracle Java SE (component: Sound). The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3157 P-856V-Java SE: 11 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 11 Vulnerability in the Oracle Hospitality Cruise Fleet Management product of Oracle Hospitality Applications (component: Emergency Response System). The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Security patch has been released CVE-2018-3158 P-11608V-9.0 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11608V-9.0 Vulnerability in the Oracle Hospitality Cruise Fleet Management product of Oracle Hospitality Applications (component: Sender and Receiver). The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise Fleet Management executes to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Security patch has been released CVE-2018-3159 P-11608V-9.0 6.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11608V-9.0 Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System product of Oracle Hospitality Applications (component: OHC Admin, OHC Management). The supported version that is affected is 8.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise Shipboard Property Management System executes to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise Shipboard Property Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Cruise Shipboard Property Management System. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3160 P-11607V-8.0 7.7 AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11607V-8.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3161 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3162 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Oracle Hospitality Cruise Fleet Management product of Oracle Hospitality Applications (component: Emergency Response System). The supported version that is affected is 9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Cruise Fleet Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Cruise Fleet Management. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Security patch has been released CVE-2018-3163 P-11608V-9.0 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11608V-9.0 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3164 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3165 P-5085V-8.55 P-5085V-8.56 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Hospitality Cruise Fleet Management product of Oracle Hospitality Applications (component: Emergency Response System). The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2018-3166 P-11608V-9.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11608V-9.0 Vulnerability in the Application Management Pack for Oracle E-Business Suite product of Oracle E-Business Suite (component: User Monitoring). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3167 P-2294V-12.1.3 P-2294V-12.2.3 P-2294V-12.2.4 P-2294V-12.2.5 P-2294V-12.2.6 P-2294V-12.2.7 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2294V-12.1.3 P-2294V-12.2.3 P-2294V-12.2.4 P-2294V-12.2.5 P-2294V-12.2.6 P-2294V-12.2.7 Vulnerability in the Oracle Identity Analytics product of Oracle Fusion Middleware (component: Core Components). The supported version that is affected is 11.1.1.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Analytics accessible data as well as unauthorized read access to a subset of Oracle Identity Analytics accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). Security patch has been released CVE-2018-3168 P-8522V-11.1.1.5.8 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8522V-11.1.1.5.8 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u191, 8u181 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3169 P-856V-Java SE: 7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3170 P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2018-3171 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 5.0 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Solaris product of Oracle Systems (component: RPC). Supported versions that are affected are 10 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via Portmap v3 to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2018-3172 P-10006V-10 P-10006V-11.4 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-10 P-10006V-11.4 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3173 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H). Security patch has been released CVE-2018-3174 P-8478V-5.5.61 and prior P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 5.3 AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.5.61 and prior P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Hyperion Common Events product of Oracle Hyperion (component: User Interface). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Common Events. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hyperion Common Events, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion Common Events accessible data as well as unauthorized read access to a subset of Hyperion Common Events accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3175 P-4368V-11.1.2.4 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4368V-11.1.2.4 Vulnerability in the Hyperion Common Events product of Oracle Hyperion (component: User Interface). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Common Events. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hyperion Common Events, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion Common Events accessible data as well as unauthorized read access to a subset of Hyperion Common Events accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3176 P-4368V-11.1.2.4 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4368V-11.1.2.4 Vulnerability in the Hyperion Common Events product of Oracle Hyperion (component: User Interface). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Common Events. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hyperion Common Events, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion Common Events accessible data as well as unauthorized read access to a subset of Hyperion Common Events accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3177 P-4368V-11.1.2.4 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4368V-11.1.2.4 Vulnerability in the Hyperion Common Events product of Oracle Hyperion (component: User Interface). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Common Events. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hyperion Common Events, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion Common Events accessible data as well as unauthorized read access to a subset of Hyperion Common Events accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3178 P-4368V-11.1.2.4 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4368V-11.1.2.4 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Advanced Console). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Identity Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Identity Manager. CVSS 3.0 Base Score 7.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L). Security patch has been released CVE-2018-3179 P-1980V-11.1.2.3.0 P-1980V-12.2.1.3.0 7.2 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1980V-11.1.2.3.0 P-1980V-12.2.1.3.0 Vulnerability in the Java SE, Java SE Embedded, JRockit product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 6u201, 7u191, 8u181 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-3180 P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181; JRockit: R28.3.19 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181 P-856V-11; Java SE Embedded: 8u181; JRockit: R28.3.19 Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System product of Oracle Hospitality Applications (component: OHC ENOAD). The supported version that is affected is 8.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise Shipboard Property Management System executes to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-3181 P-11607V-8.0 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11607V-8.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3182 P-8478V-8.0.12 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the Java SE, Java SE Embedded, JRockit product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u181 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3183 P-856V-Java SE: 8u181 P-856V-11; Java SE Embedded: 8u181; JRockit: R28.3.19 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 8u181 P-856V-11; Java SE Embedded: 8u181; JRockit: R28.3.19 Vulnerability in the Hyperion BI+ product of Oracle Hyperion (component: IQR - Foundation Services). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion BI+. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Hyperion BI+ accessible data. CVSS 3.0 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3184 P-4361V-11.1.2.4 2.4 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4361V-11.1.2.4 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2018-3185 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3186 P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2018-3187 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Web interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3188 P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 P-384V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-384V-12.1.1 P-384V-12.1.2 P-384V-12.1.3 P-384V-12.2.3 P-384V-12.2.4 P-384V-12.2.5 P-384V-12.2.6 P-384V-12.2.7 Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Customer Interaction History, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Customer Interaction History accessible data as well as unauthorized update, insert or delete access to some of Oracle Customer Interaction History accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3189 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Overview Page/Report Rendering). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Intelligence. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle E-Business Intelligence, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Intelligence accessible data as well as unauthorized update, insert or delete access to some of Oracle E-Business Intelligence accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3190 P-163V-12.1.1 P-163V-12.1.2 P-163V-12.1.3 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-163V-12.1.1 P-163V-12.1.2 P-163V-12.1.3 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3191 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.3 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3192 P-5085V-8.55 P-5085V-8.56 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Activity Guide). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3193 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Activity Guide). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3194 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2018-3195 P-8478V-8.0.12 and prior 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Partner Dashboard). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Partner Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Partner Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3196 P-1065V-12.1.1 P-1065V-12.1.2 P-1065V-12.1.3 P-1065V-12.2.3 P-1065V-12.2.4 P-1065V-12.2.5 P-1065V-12.2.6 P-1065V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1065V-12.1.1 P-1065V-12.1.2 P-1065V-12.1.3 P-1065V-12.2.3 P-1065V-12.2.4 P-1065V-12.2.5 P-1065V-12.2.6 P-1065V-12.2.7 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). The supported version that is affected is 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3197 P-5242V-12.1.3.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-12.1.3.0 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3198 P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3200 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3201 P-5242V-12.2.1.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-12.2.1.3 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3202 P-5085V-8.55 P-5085V-8.56 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3203 P-8478V-8.0.12 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3204 P-2025V-12.2.1.3.0 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2025V-12.2.1.3.0 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3205 P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3206 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3207 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). The supported version that is affected is 11.1.2.4.345. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hyperion Data Relationship Management. While the vulnerability is in Hyperion Data Relationship Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Hyperion Data Relationship Management accessible data. CVSS 3.0 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Security patch has been released CVE-2018-3208 P-4375V-11.1.2.4.345 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4375V-11.1.2.4.345 Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3209 P-856V-Java SE: 8u181 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 8u181 Vulnerability in the Oracle GlassFish Server product of Oracle Fusion Middleware (component: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3210 P-8493V-3.1.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8493V-3.1.2 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serviceability). Supported versions that are affected are Java SE: 8u181 and 11; Java SE Embedded: 8u181. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Java SE, Java SE Embedded executes to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data as well as unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). This vulnerability can only be exploited when Java Usage Tracker functionality is being used. CVSS 3.0 Base Score 6.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). Security patch has been released CVE-2018-3211 P-856V-Java SE: 8u181 P-856V-11; Java SE Embedded: 8u181 6.6 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 8u181 P-856V-11; Java SE Embedded: 8u181 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3212 P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Docker Images). The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-3213 P-5242V-prior to Docker 12.2.1.3.20180913 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-prior to Docker 12.2.1.3.20180913 Vulnerability in the Java SE, Java SE Embedded, JRockit product of Oracle Java SE (component: Sound). Supported versions that are affected are Java SE: 6u201, 7u191 and 8u181; Java SE Embedded: 8u181; JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2018-3214 P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181; Java SE Embedded: 8u181; JRockit: R28.3.19 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-856V-Java SE: 6u201 P-856V-7u191 P-856V-8u181; Java SE Embedded: 8u181; JRockit: R28.3.19 Vulnerability in the Oracle Endeca Information Discovery Integrator product of Oracle Fusion Middleware (component: Integrator ETL). Supported versions that are affected are 3.1.0 and 3.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Endeca Information Discovery Integrator. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Endeca Information Discovery Integrator accessible data as well as unauthorized read access to a subset of Oracle Endeca Information Discovery Integrator accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Security patch has been released CVE-2018-3215 P-10561V-3.1.0 P-10561V-3.2.0 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10561V-3.1.0 P-10561V-3.2.0 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). Security patch has been released CVE-2018-3217 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). Security patch has been released CVE-2018-3218 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L). Security patch has been released CVE-2018-3219 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L). Security patch has been released CVE-2018-3220 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3221 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3222 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3223 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3224 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3225 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3226 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3227 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3228 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3229 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3230 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3231 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3232 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3233 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3234 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: None). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Applications Manager accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3235 P-99V-12.1.3 P-99V-12.2.3 P-99V-12.2.4 P-99V-12.2.5 P-99V-12.2.6 P-99V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-99V-12.1.3 P-99V-12.2.3 P-99V-12.2.4 P-99V-12.2.5 P-99V-12.2.6 P-99V-12.2.7 Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Reports). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle User Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle User Management accessible data as well as unauthorized access to critical data or complete access to all Oracle User Management accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Security patch has been released CVE-2018-3236 P-1475V-12.1.3 P-1475V-12.2.3 P-1475V-12.2.4 P-1475V-12.2.5 P-1475V-12.2.6 P-1475V-12.2.7 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1475V-12.1.3 P-1475V-12.2.3 P-1475V-12.2.4 P-1475V-12.2.5 P-1475V-12.2.6 P-1475V-12.2.7 Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Support Cart). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3237 P-99V-12.1.3 P-99V-12.2.3 P-99V-12.2.4 P-99V-12.2.5 P-99V-12.2.6 P-99V-12.2.7 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-99V-12.1.3 P-99V-12.2.3 P-99V-12.2.4 P-99V-12.2.5 P-99V-12.2.6 P-99V-12.2.7 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3238 P-9617V-11.1.1.8.0 6.9 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-9617V-11.1.1.8.0 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3239 P-5085V-8.55 P-5085V-8.56 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3241 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 P-5579V-17.7 - 17.12 P-5579V-18.8 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 P-5579V-17.7 - 17.12 P-5579V-18.8 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3242 P-229V-12.1.1 P-229V-12.1.2 P-229V-12.1.3 P-229V-12.2.3 P-229V-12.2.4 P-229V-12.2.5 P-229V-12.2.6 P-229V-12.2.7 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-229V-12.1.1 P-229V-12.1.2 P-229V-12.1.3 P-229V-12.2.3 P-229V-12.2.4 P-229V-12.2.5 P-229V-12.2.6 P-229V-12.2.7 Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: None). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data as well as unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Security patch has been released CVE-2018-3243 P-1472V-12.1.3 P-1472V-12.2.3 P-1472V-12.2.4 P-1472V-12.2.5 P-1472V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1472V-12.1.3 P-1472V-12.2.3 P-1472V-12.2.4 P-1472V-12.2.5 P-1472V-12.2.6 Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Attachments / File Upload). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2018-3244 P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 P-510V-12.2.7 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 P-510V-12.2.7 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3245 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.3 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services). Supported versions that are affected are 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-3246 P-5242V-12.1.3.0 P-5242V-12.2.1.3 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-12.1.3.0 P-5242V-12.2.1.3 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Merge). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2018-3247 P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services). The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-3248 P-5242V-10.3.6.0 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-10.3.6.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services). The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2018-3249 P-5242V-10.3.6.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-10.3.6.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services). The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3250 P-5242V-10.3.6.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-10.3.6.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3251 P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3252 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.3 Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (component: Virtual Directory Manager). Supported versions that are affected are 11.1.1.7.0 and 11.1.1.9.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Virtual Directory. While the vulnerability is in Oracle Virtual Directory, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Virtual Directory. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3253 P-1978V-11.1.1.7.0 P-1978V-11.1.1.9.0 8.5 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1978V-11.1.1.7.0 P-1978V-11.1.1.9.0 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: WebCenter Spaces Application). Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3254 P-1696V-11.1.1.9.0 P-1696V-12.2.1.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1696V-11.1.1.9.0 P-1696V-12.2.1.3.0 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3255 P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Email Center accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). Security patch has been released CVE-2018-3256 P-950V-12.1.1 P-950V-12.1.2 P-950V-12.1.3 P-950V-12.2.3 P-950V-12.2.4 P-950V-12.2.5 P-950V-12.2.6 P-950V-12.2.7 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-950V-12.1.1 P-950V-12.1.2 P-950V-12.1.3 P-950V-12.2.3 P-950V-12.2.4 P-950V-12.2.5 P-950V-12.2.6 P-950V-12.2.7 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3257 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3258 P-8576V-8.0.12 and prior 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8576V-8.0.12 and prior Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-3259 P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 P-5V-18c 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5V-11.2.0.4 P-5V-12.1.0.2 P-5V-12.2.0.1 P-5V-18c Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3261 P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Stylesheet). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). Security patch has been released CVE-2018-3262 P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 P-5085V-8.57 Vulnerability in the Solaris product of Oracle Systems (component: Sudo). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-3263 P-10006V-11.3 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 4.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). Security patch has been released CVE-2018-3264 P-10006V-11.3 4.4 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: Zones). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 4.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-3265 P-10006V-11.3 4.9 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: Verified Boot). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 3.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-3266 P-10006V-11.3 3.9 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: LFTP). The supported version that is affected is 11.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via FTP to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2018-3267 P-10006V-11.3 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: SMB Server). The supported version that is affected is 11.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMB to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2018-3268 P-10006V-11.3 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: SMB Server). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2018-3269 P-10006V-11.3 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 1.8 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L). Security patch has been released CVE-2018-3270 P-10006V-11.3 1.8 AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: Kernel Zones). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H). Security patch has been released CVE-2018-3271 P-10006V-11.3 5.3 AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: Kernel Zones Virtualized NIC Driver). The supported version that is affected is 11.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3272 P-10006V-11.3 6.2 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: Remote Administration Daemon (RAD)). The supported version that is affected is 11.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris accessible data as well as unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Security patch has been released CVE-2018-3273 P-10006V-11.3 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 5.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3274 P-10006V-11.3 5.7 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the Solaris product of Oracle Systems (component: LibKMIP). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris accessible data as well as unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Security patch has been released CVE-2018-3275 P-10006V-11.3 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10006V-11.3 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3276 P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3277 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RBR). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3278 P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3279 P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3280 P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3281 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 P-5579V-17.7 - 17.12 P-5579V-18.8 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 P-5579V-17.7 - 17.12 P-5579V-18.8 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Storage Engines). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3282 P-8478V-5.5.61 and prior P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.5.61 and prior P-8478V-5.6.41 and prior P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3283 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3284 P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-5.7.23 and prior P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Windows). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-3285 P-8478V-8.0.12 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2018-3286 P-8478V-8.0.12 and prior 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8478V-8.0.12 and prior Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3287 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3288 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3289 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3290 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3291 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3292 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3293 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows low privileged attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3294 P-8370V-Prior to 5.2.20 9.0 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3295 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3296 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3297 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2018-3298 P-8370V-Prior to 5.2.20 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8370V-Prior to 5.2.20 Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Text. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Text, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Text as well as unauthorized update, insert or delete access to some of Oracle Text accessible data. CVSS 3.0 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H). Security patch has been released CVE-2018-3299 P-211V-11.2.0.4 P-211V-12.1.0.2 P-211V-12.2.0.1 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-211V-11.2.0.4 P-211V-12.1.0.2 P-211V-12.2.0.1 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2018-3301 P-5085V-8.55 P-5085V-8.56 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5085V-8.55 P-5085V-8.56 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Security patch has been released CVE-2018-3302 P-2276V-8.5.3 P-2276V-8.5.4 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2276V-8.5.3 P-2276V-8.5.4 Vulnerability in the Rapid Home Provisioning component of Oracle Database Server. The supported version that is affected is 18c. Difficult to exploit vulnerability allows low privileged attacker having RHP User privilege with access to the physical communication segment attached to the hardware where the Rapid Home Provisioning executes to compromise Rapid Home Provisioning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Rapid Home Provisioning. CVSS 3.0 Base Score 2.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L). Security patch has been released CVE-2018-7489 P-5V-18c 2.3 AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5V-18c Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: IoT Orchestrator Security (jackson-databind)). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-7489 P-11681V-9.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11681V-9.2 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: EnterpriseOne Mobility (jackson-databind)). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-7489 P-4781V-9.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4781V-9.2 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime (jackson-databind)). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-7489 P-4781V-9.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-4781V-9.2 Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Web Access (jackson-databind)). Supported versions that are affected are 15.2, 16.2 and 17.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-7489 P-10605V-15.2 P-10605V-16.2 P-10605V-17.12 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10605V-15.2 P-10605V-16.2 P-10605V-17.12 Vulnerability in the Oracle Retail Allocation product of Oracle Retail Applications (component: General (jackson-databind)). Supported versions that are affected are 15.0 and 16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Allocation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Allocation. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-7489 P-1786V-15.0 P-1786V-16.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1786V-15.0 P-1786V-16.0 Vulnerability in the Oracle Retail Assortment Planning product of Oracle Retail Applications (component: Application Core (jackson-databind)). The supported version that is affected is 15.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Assortment Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Assortment Planning. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-7489 P-1788V-15.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-1788V-15.0 Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (jackson-databind)). Supported versions that are affected are 6.5.12, 7.0.7, 7.1.7, 15.0.2, 16.0.4 and 17.0.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in takeover of Oracle Retail Xstore Point of Service. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-7489 P-11513V-6.5.12 P-11513V-7.0.7 P-11513V-7.1.7 P-11513V-15.0.2 P-11513V-16.0.4 P-11513V-17.0.2 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11513V-6.5.12 P-11513V-7.0.7 P-11513V-7.1.7 P-11513V-15.0.2 P-11513V-16.0.4 P-11513V-17.0.2 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Oracle Business Intelligence Enterprise Edition (Apache Batik)). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-2025V-11.1.1.7.0 P-2025V-11.1.1.9.0 P-2025V-12.2.1.3.0 P-2025V-12.2.1.4.0 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2025V-11.1.1.7.0 P-2025V-11.1.1.9.0 P-2025V-12.2.1.3.0 P-2025V-12.2.1.4.0 Vulnerability in the Oracle Enterprise Repository product of Oracle Fusion Middleware (component: Security Subsystem - 12c (Apache Batik)). Supported versions that are affected are 11.1.1.7.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Repository. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Repository accessible data as well as unauthorized read access to a subset of Oracle Enterprise Repository accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Repository. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-5326V-11.1.1.7.0 P-5326V-12.1.3.0.0 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-5326V-11.1.1.7.0 P-5326V-12.1.3.0.0 Vulnerability in the Instantis EnterpriseTrack product of Oracle Construction and Engineering (component: Generic (Apache Batik)). Supported versions that are affected are 17.1, 17.2 and 17.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Instantis EnterpriseTrack. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Instantis EnterpriseTrack accessible data as well as unauthorized read access to a subset of Instantis EnterpriseTrack accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Instantis EnterpriseTrack. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-10563V-17.1 P-10563V-17.2 P-10563V-17.3 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10563V-17.1 P-10563V-17.2 P-10563V-17.3 Vulnerability in the Oracle Insurance Calculation Engine product of Oracle Insurance Applications (component: Architecture (Apache Batik)). Supported versions that are affected are 10.1.1 and 10.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Calculation Engine. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Insurance Calculation Engine accessible data as well as unauthorized read access to a subset of Oracle Insurance Calculation Engine accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Insurance Calculation Engine. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-10837V-10.1.1 P-10837V-10.2.1 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-10837V-10.1.1 P-10837V-10.2.1 Vulnerability in the Oracle Retail Back Office product of Oracle Retail Applications (component: Security (Apache Batik)). Supported versions that are affected are 13.3, 13.4, 14 and 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Back Office. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Back Office accessible data as well as unauthorized read access to a subset of Oracle Retail Back Office accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Back Office. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-2013V-13.3 P-2013V-13.4 P-2013V-14 P-2013V-14.1 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2013V-13.3 P-2013V-13.4 P-2013V-14 P-2013V-14.1 Vulnerability in the Oracle Retail Central Office product of Oracle Retail Applications (component: Security (Apache Batik)). The supported version that is affected is 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Central Office. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Central Office accessible data as well as unauthorized read access to a subset of Oracle Retail Central Office accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Central Office. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-2016V-14.1 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2016V-14.1 Vulnerability in the Oracle Retail Order Broker product of Oracle Retail Applications (component: Upgrade Install (Apache Batik)). Supported versions that are affected are 5.1, 5.2, 15.0 and 16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Order Broker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Order Broker accessible data as well as unauthorized read access to a subset of Oracle Retail Order Broker accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Order Broker. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-11520V-5.1 P-11520V-5.2 P-11520V-15.0 P-11520V-16.0 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-11520V-5.1 P-11520V-5.2 P-11520V-15.0 P-11520V-16.0 Vulnerability in the Oracle Retail Point-of-Service product of Oracle Retail Applications (component: Security (Apache Batik)). Supported versions that are affected are 13.4, 14.0 and 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Point-of-Service. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Point-of-Service accessible data as well as unauthorized read access to a subset of Oracle Retail Point-of-Service accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Point-of-Service. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-2017V-13.4 P-2017V-14.0 P-2017V-14.1 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2017V-13.4 P-2017V-14.0 P-2017V-14.1 Vulnerability in the Oracle Retail Returns Management product of Oracle Retail Applications (component: Security (Apache Batik)). The supported version that is affected is 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Returns Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Returns Management accessible data as well as unauthorized read access to a subset of Oracle Retail Returns Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Returns Management. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2018-8013 P-2020V-14.1 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-2020V-14.1 Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General (Apache Tomcat)). Supported versions that are affected are 3.4.9.4237 and prior, 4.0.6.5281 and prior and 8.0.2.8191 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-8014 P-8480V-3.4.9.4237 and prior P-8480V-4.0.6.5281 and prior P-8480V-8.0.2.8191 and prior 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUOct2018 Oracle customers with valid support contracts https://www.oracle.com/security-alerts/cpuoct2018.html P-8480V-3.4.9.4237 and prior P-8480V-4.0.6.5281 and prior P-8480V-8.0.2.8191 and prior