Oracle Critical Patch Update Advisory - January 2022 - Oracle CVRF Oracle Critical Patch Update Advisory CPUJan2022 Final 6 6 2022-03-14T13:00:00-07:00 WLS Log4j CVE version and additional CVE update 2022-01-18T13:00:00-07:00 2022-03-14T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had security patches released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including security patch distribution information can be found at the Oracle sites referenced in this document. This document is published at: https://www.oracle.com/a/tech/docs/cpujan2022cvrf.xml https://www.oracle.com/security-alerts/cpujan2022.html URL to html version of Advisory Abdelrhman Yousri Abdelrhman Yousri Abderrahmane Elghoul Abderrahmane Elghoul Abilash V L Abilash V L Abisheik M Adam Willard Aleena Avarachan Aleena Avarachan Alexander Kornbrust Red Database Security Ali Alzahrani Ali Alzahrani Andrej Simko Accenture Aniket Nimkar Aniket Nimkar Anonymous researcher working with Trend Micro's Zero Day Initiative Aobo Wang of Chaitin Security Research Lab Ashik Kunjumon Ashik Kunjumon Dan Rabe Dan Rabe Dhanesh Sivasamy Dhanesh Sivasamy Dinh Ho Anh Khoa Viettel Cyber Security Dor Tumarkin, Principal Application Security Researcher at Checkmarx Truffle Security Co Fabian Meumertzheim Code Intelligence Frederic Quenneville videotron.com Gaurang Maheta Gaurang Maheta B.Dhiyaneshwaran aka (Geek Freak) Hamed Ashraf Hamed Ashraf Hans Christian Woithe Hans Christian Woithe Harold Siyu Zang of Trustwave Huixin Ma of Tencent.com Jangggg of VNPT Jeremy Nunn Trustwave Jie Liang WingTecher Lab of Tsinghua University Jingzhou Fu WingTecher Lab of Tsinghua University Jonah T Jonah T Jonni Passki of Apple Information Security Kishore Hariram Kishore Hariram Kun Yang of Chaitin Security Research Lab Liboheng of Tophant Starlight laboratory thiscodecc of MoyunSec V-Lab Lidor Ben Shitrit from Orca Security Liying Wang Liying Wang Lokesh Rulz Lokesh Rulz Longofo Knownsec 404 Team Lucas Leong (wmliang) of Trend Micro Zero Day Initiative Malicious.Group Malicious.Group Markus Loewe Markus Loewe Matei "Mal" Badanoiu Matei "Mal" Badanoiu Mohit Ahir Mohit Ahir N3td1v3r N3td1v3r Patrick Star BMH Security Team Quan Doan of R&D Center - VinCSS LLC (a member of Vingroup) RE:HACK Rahul PS Reno Robert working with Trend Micro Zero Day Initiative Rob Evans Fortinet, Inc. Robin Textor Robin Textor Rounak Sharma Rounak Sharma Ryota Shiga (Ga_ryo_) of Flatt Security working with Trend Micro Zero Day Initiative Sakhare Vinayak Sakhare Vinayak Samprit Das (sampritdas8) Sander Meijering HackDefense Saptak Saha Saptak Saha Sergey Temnikov Amazon Web Services IT Security Shubham Choudhery Shubham Choudhery Shuvam Adhikari Shuvam Adhikari Srikar V - exp1o1t9r Thijmen Kooy HackDefense Victor Rodriguez Victor Rodriguez Yaoguang Chen Ant Security Light-Year Lab Yeswanth Reddy Yeswanth Reddy osword from SGLAB of Legendsec at Qi'anxin Group Zhiqiang Zang of University of Texas at Austin Zhiyong Wu WingTecher Lab of Tsinghua University peterjson - Security Engineering - VNG Corporation pinkflower pinkflower r00t4dm Nightwatch Cybersecurity Research Airlines Data Model Version 12.1.1.0.0 Airlines Data Model Version 12.2.0.1.0 Big Data Spatial and Graph Version Prior to 23.1 Commerce Platform Version 11.3.0 Commerce Platform Version 11.3.1 Commerce Platform Version 11.3.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.3.2 Communications Services Gatekeeper Version 7.0 Communications Service Broker Version 6.2 Communications Session Border Controller Version 8.2 Communications Session Border Controller Version 8.3 Communications Session Border Controller Version 8.4 Communications Session Border Controller Version 9.0 Enterprise Session Border Controller Version 8.4 Enterprise Session Border Controller Version 9.0 Enterprise Communications Broker Version 3.3 Communications Operations Monitor Version 3.4 Communications Operations Monitor Version 4.2 Communications Operations Monitor Version 4.3 Communications Operations Monitor Version 4.4 Communications Operations Monitor Version 5.0 Communications Interactive Session Recorder Version 6.3 Communications Interactive Session Recorder Version 6.4 Communications WebRTC Session Controller Version 7.2.0 Communications WebRTC Session Controller Version 7.2.1 Communications Diameter Signaling Router (DSR) Version 8.0.0.0-8.5.0.2 Communications Diameter Signaling Router (DSR) Version 8.3.0.0-8.5.1.0 Communications EAGLE Application Processor Version 16.1-16.4 SD-WAN Edge Version 9.0 SD-WAN Edge Version 9.1 SD-WAN Aware Version 8.2 Communications Cloud Native Core Service Communication Proxy Version 1.14.0 Communications Cloud Native Core Network Repository Function Version 1.14.0 Communications Cloud Native Core Network Repository Function Version All Supported Versions Communications Cloud Native Core Unified Data Repository Version 1.14.0 Communications Cloud Native Core Binding Support Function Version 1.10.0 Communications Cloud Native Core Binding Support Function Version 1.9.0 Communications Cloud Native Core Security Edge Protection Proxy Version 1.15.0 Communications Cloud Native Core Security Edge Protection Proxy Version 1.5.0 Communications Cloud Native Core Security Edge Protection Proxy Version 1.6.0 Communications Cloud Native Core Network Function Cloud Native Environment Version 1.9.0 Communications Cloud Native Core Console Version 1.7.0 Communications Cloud Native Core Policy Version 1.14.0 Communications Cloud Native Core Automated Test Suite Version 1.8.0 Communications Billing and Revenue Management Version 12.0.0.3 Communications Billing and Revenue Management Version 12.0.0.4 Communications Offline Mediation Controller Version 12.0.0.3 Communications Design Studio Version 7.3.4 Communications Design Studio Version 7.3.5 Communications Design Studio Version 7.4.0 Communications Design Studio Version 7.4.1 Communications Design Studio Version 7.4.2 Communications Network Integrity Version 7.3.5 Communications Network Integrity Version 7.3.6 Communications Unified Inventory Management Version 7.3.0 Communications Unified Inventory Management Version 7.3.4 Communications Unified Inventory Management Version 7.3.5 Communications Unified Inventory Management Version 7.4.0 Communications Unified Inventory Management Version 7.4.1 Communications Unified Inventory Management Version 7.4.2 Communications Unified Inventory Management Version 7.5.0 Communications Network Charging and Control Version 12.0.1.0.0-12.0.4.0.0 Communications Network Charging and Control Version 6.0.1.0.0 Communications Calendar Server Version 8.0.0.5.0 Communications Instant Messaging Server Version 10.0.1.5.0 Communications Messaging Server Version 8.1 Communications Convergence Version 3.0.2.2.0 Communications Pricing Design Center Version 12.0.0.3.0 Communications Pricing Design Center Version 12.0.0.4.0 Communications BRM - Elastic Charging Engine Version 11.3 Communications BRM - Elastic Charging Engine Version 12.0 Communications Contacts Server Version 8.0.0.3.0 Communications Convergent Charging Controller Version 12.0.1.0.0-12.0.4.0.0 Communications Convergent Charging Controller Version 6.0.1.0.0 Communications Data Model Version 11.3.2.1.0 Communications Data Model Version 11.3.2.2.0 Communications Data Model Version 11.3.2.3.0 Communications Data Model Version 12.1.0.1.0 Communications Data Model Version 12.1.2.0.0 Primavera P6 Enterprise Project Portfolio Management Version 17.12.0.0-17.12.20.0 Primavera P6 Enterprise Project Portfolio Management Version 18.8.0.0-18.8.24.0 Primavera P6 Enterprise Project Portfolio Management Version 19.12.0.0-19.12.17.0 Primavera P6 Enterprise Project Portfolio Management Version 19.12.0.0-19.12.18.0 Primavera P6 Enterprise Project Portfolio Management Version 20.12.0.0-20.12.12.0 Primavera P6 Enterprise Project Portfolio Management Version 20.12.0.0-20.12.9.0 Primavera P6 Enterprise Project Portfolio Management Version 21.12.0.0 Primavera P6 Professional Project Management Version 17.12.0.0-17.12.20.0 Primavera P6 Professional Project Management Version 18.8.0.0-18.8.24.0 Primavera P6 Professional Project Management Version 19.12.0.0-19.12.17.0 Primavera P6 Professional Project Management Version 20.12.0.0-20.12.9.0 Primavera Portfolio Management Version 18.0.0.0-18.0.3.0 Primavera Portfolio Management Version 19.0.0.0-19.0.1.2 Primavera Portfolio Management Version 20.0.0.0 Primavera Portfolio Management Version 20.0.0.1 Primavera Data Warehouse Version 18.8.3.3 Primavera Data Warehouse Version 19.12.11.1 Primavera Data Warehouse Version 20.12.12.0 Primavera Analytics Version 18.8.3.3 Primavera Analytics Version 19.12.11.1 Primavera Analytics Version 20.12.12.0 Primavera Unifier Version 17.7-17.12 Primavera Unifier Version 18.8 Primavera Unifier Version 19.12 Primavera Unifier Version 20.12 Primavera Unifier Version 21.12 Instantis EnterpriseTrack Version 17.1 Instantis EnterpriseTrack Version 17.2 Instantis EnterpriseTrack Version 17.3 Primavera Gateway Version 17.12.0-17.12.11 Primavera Gateway Version 18.8.0-18.8.13 Primavera Gateway Version 19.12.0-19.12.12 Primavera Gateway Version 20.12.0-20.12.7 Primavera Gateway Version 21.12.0 Database - Enterprise Edition Version 12.1.0.2 Database - Enterprise Edition Version 12.2.0.1 Database - Enterprise Edition Version 19c Database - Enterprise Edition Version 21c Database - Enterprise Edition Version All Supported Versions Database Configuration Assistant Version All Supported Versions Spatial and Graph Version All Supported Versions Application Express (APEX) Version Prior to 21.1.4 Engineered Systems Utilities Version All Supported Versions Configurator Version 12.2.3-12.2.11 Time and Labor Version 12.2.6-12.2.11 iStore Version 12.2.3-12.2.11 Trade Management Version 12.2.3-12.2.11 Partner Management Version 12.2.3-12.2.11 Installed Base Version 12.2.3-12.2.11 Sourcing Version 12.2.3-12.2.11 Project Costing Version 12.2.3-12.2.11 Enterprise Manager Base Platform Version 13.4.0.0 Enterprise Manager Base Platform Version 13.5.0.0 Application Testing Suite Version 13.3.0.1 APM - Application Performance Management Version 13.4.1.0 APM - Application Performance Management Version 13.5.1.0 Enterprise Manager Ops Center Version 12.4.0.0 Hyperion Essbase Version All Supported Versions Hyperion Essbase Version Prior to 11.1.2.4.047 Hyperion Essbase Version Prior to 21.3 Hyperion Essbase Administration Services Version Prior to 11.1.2.4.047 Financial Services Analytical Applications Infrastructure Version 8.0.7-8.1.1 Financial Services Analytical Applications Infrastructure Version 8.0.8-8.1.1 FLEXCUBE Investor Servicing Version 12.0.4 FLEXCUBE Investor Servicing Version 12.1.0 FLEXCUBE Investor Servicing Version 12.3.0 FLEXCUBE Investor Servicing Version 12.4.0 FLEXCUBE Investor Servicing Version 14.4.0 FLEXCUBE Investor Servicing Version 14.5.0 FLEXCUBE Private Banking Version 12.0.0 FLEXCUBE Private Banking Version 12.1.0 Banking Platform Version 2.3.0-2.4.1 Banking Platform Version 2.6.2 Banking Platform Version 2.7.0 Banking Platform Version 2.7.1 Financial Services Behavior Detection Platform Version 8.0.7 Financial Services Behavior Detection Platform Version 8.0.8 Financial Services Behavior Detection Platform Version 8.1.1 Financial Services Foreign Account Tax Compliance Act Management Version 8.0.7 Financial Services Foreign Account Tax Compliance Act Management Version 8.0.8 Financial Services Foreign Account Tax Compliance Act Management Version 8.1.1 Banking Digital Experience Version 17.2 Banking Digital Experience Version 18.1-18.3 Banking Digital Experience Version 18.3 Banking Digital Experience Version 19.1 Banking Digital Experience Version 19.2 Banking Digital Experience Version 20.1 Banking Digital Experience Version 21.1 Banking Enterprise Default Management Version 2.10.0 Banking Enterprise Default Management Version 2.12.0 Banking Enterprise Default Management Version 2.3.0-2.4.1 Banking Enterprise Default Management Version 2.6.2 Banking Enterprise Default Management Version 2.7.0 Banking Enterprise Default Management Version 2.7.1 Financial Services Enterprise Case Management Version 8.0.7 Financial Services Enterprise Case Management Version 8.0.8 Financial Services Enterprise Case Management Version 8.1.1 Banking APIs Version 18.1-18.3 Banking APIs Version 18.3 Banking APIs Version 19.1 Banking APIs Version 19.2 Banking APIs Version 20.1 Banking APIs Version 21.1 Financial Services Trade-Based Anti Money Laundering Enterprise Edition Version 8.0.7 Financial Services Trade-Based Anti Money Laundering Enterprise Edition Version 8.0.8 Banking Loans Servicing Version 2.12.0 Banking Deposits and Lines of Credit Servicing Version 2.12.0 Banking Party Management Version 2.7.0 Financial Services Model Management and Governance Version 8.0.8 Financial Services Model Management and Governance Version 8.0.8-8.1.1 Financial Services Model Management and Governance Version 8.1.0 Financial Services Model Management and Governance Version 8.1.1 Hospitality Reporting and Analytics Version 9.1.0 Fusion Middleware Version 12.2.1.3.0 Fusion Middleware Version 12.2.1.4.0 HTTP Server Version 12.2.1.3.0 HTTP Server Version 12.2.1.4.0 Fusion Middleware MapViewer Version 12.2.1.4.0 BI Publisher (formerly XML Publisher) Version 12.2.1.3.0 BI Publisher (formerly XML Publisher) Version 12.2.1.4.0 BI Publisher (formerly XML Publisher) Version 5.5.0.0.0 BAM (Business Activity Monitoring) Version 12.2.1.4.0 WebCenter Portal Version 12.2.1.3.0 WebCenter Portal Version 12.2.1.4.0 Business Intelligence Enterprise Edition Version 12.2.1.3.0 Business Intelligence Enterprise Edition Version 12.2.1.4.0 Business Intelligence Enterprise Edition Version 5.5.0.0.0 Business Intelligence Enterprise Edition Version 5.9.0.0.0 Data Integrator Version 12.2.1.3.0 Data Integrator Version 12.2.1.4.0 WebLogic Server Version 12.1.3.0.0 WebLogic Server Version 12.2.1.3.0 WebLogic Server Version 12.2.1.4.0 WebLogic Server Version 14.1.1.0.0 Business Process Management Suite Version 12.2.1.3.0 Business Process Management Suite Version 12.2.1.4.0 Access Manager Version 11.1.2.3.0 Access Manager Version 12.2.1.3.0 Access Manager Version 12.2.1.4.0 Enterprise Data Quality Version 12.2.1.3.0 Enterprise Data Quality Version 12.2.1.4.0 Managed File Transfer Version 12.2.1.3.0 Managed File Transfer Version 12.2.1.4.0 GoldenGate Version Prior to 12.3.0.1 GoldenGate Version Prior to 19.1.0.0.220118 GoldenGate Version Prior to 21.4.0.0.0 GoldenGate Version Prior to 21.5.0.0.220118 Graph Server and Client Version All Supported Versions Graph Server and Client Version Prior to 21.4 Thesaurus Management System Version 5.2.3 Thesaurus Management System Version 5.3.0 Thesaurus Management System Version 5.3.1 Clinical Version 5.2.1 Clinical Version 5.2.2 Health Sciences Clinical Development Analytics Version 4.0.1 Argus Safety Version 8.2.1 Argus Safety Version 8.2.2 Argus Safety Version 8.2.3 Argus Insight Version 8.2.1 Argus Insight Version 8.2.2 Argus Insight Version 8.2.3 Argus Analytics Version 8.2.1 Argus Analytics Version 8.2.2 Argus Analytics Version 8.2.3 Health Sciences InForm CRF Submit Version 6.2.1 Argus Mart Version 8.2.1 Argus Mart Version 8.2.2 Argus Mart Version 8.2.3 Healthcare Data Repository Version 7.0.2 Healthcare Data Repository Version 8.1.0 Healthcare Data Repository Version 8.1.1 Health Sciences Information Manager Version 3.0.2 Health Sciences Information Manager Version 3.0.3 Healthcare Translational Research Version 4.1.0 Healthcare Foundation Version 7.3.0.0-7.3.0.2 Healthcare Foundation Version 8.0.0-8.0.2 Healthcare Foundation Version 8.1.0-8.1.1 Hospitality OPERA 5 Property Services Version 5.6 Hospitality Cruise Shipboard Property Management System Version 20.1.0 Hospitality Suite8 Version 8.10.2 Hospitality Suite8 Version 8.11.0 Hospitality Suite8 Version 8.12.0 Hospitality Suite8 Version 8.13.0 Hospitality Suite8 Version 8.14.0 Hyperion Infrastructure Technology Version 11.2.7.0 Insurance Policy Administration J2EE Version 10.2.0 Insurance Policy Administration J2EE Version 10.2.4 Insurance Policy Administration J2EE Version 11.0.2 Insurance Policy Administration J2EE Version 11.1.0 Insurance Policy Administration J2EE Version 11.1.0-11.3.0 Insurance Policy Administration J2EE Version 11.2.7 Insurance Policy Administration J2EE Version 11.3.0 Insurance Policy Administration J2EE Version 11.3.1 Insurance Rules Palette Version 10.2.0 Insurance Rules Palette Version 10.2.4 Insurance Rules Palette Version 11.0.2 Insurance Rules Palette Version 11.1.0 Insurance Rules Palette Version 11.1.0-11.3.0 Insurance Rules Palette Version 11.2.7 Insurance Rules Palette Version 11.3.0 Insurance Rules Palette Version 11.3.1 Insurance Insbridge Rating and Underwriting Version 5.2.0 Insurance Insbridge Rating and Underwriting Version 5.4.0-5.6.0 Insurance Data Gateway Version 11.0.2 Insurance Data Gateway Version 11.1.0 Insurance Data Gateway Version 11.2.7 Insurance Data Gateway Version 11.3.0 Insurance Data Gateway Version 11.3.1 JD Edwards EnterpriseOne Tools Version Prior to 9.2.6.1 Java SE JDK and JRE Version Oracle GraalVM Enterprise Edition:20.3.4 Java SE JDK and JRE Version Oracle GraalVM Enterprise Edition:21.3.0 Java SE JDK and JRE Version Oracle Java SE:11.0.13 Java SE JDK and JRE Version Oracle Java SE:17.01 Java SE JDK and JRE Version Oracle Java SE:7u321 Java SE JDK and JRE Version Oracle Java SE:8u311 GraalVM Enterprise Edition Version Oracle GraalVM Enterprise Edition:20.3.4 GraalVM Enterprise Edition Version Oracle GraalVM Enterprise Edition:21.3.0 MySQL Workbench Version 8.0.27 and prior MySQL Server Version 5.7.36 and prior MySQL Server Version 8.0.26 and prior MySQL Server Version 8.0.27 and prior MySQL Cluster Version 7.4.34 and prior MySQL Cluster Version 7.5.24 and prior MySQL Cluster Version 7.6.20 and prior MySQL Cluster Version 8.0.27 and prior MySQL Connectors Version 8.0.27 and prior NoSQL Database Version Prior to 21.1.12 PeopleSoft Enterprise PT PeopleTools Version 8.57 PeopleSoft Enterprise PT PeopleTools Version 8.58 PeopleSoft Enterprise PT PeopleTools Version 8.59 PeopleSoft Enterprise CS SA Integration Pack Version 9.0 PeopleSoft Enterprise CS SA Integration Pack Version 9.2 Policy Automation Version 12.2.0-12.2.24 REST Data Services Version Prior to 21.2.0 REST Data Services Version Prior to 21.2.4 Retail Allocation Version 14.1.3.2 Retail Allocation Version 15.0.3.1 Retail Allocation Version 16.0.3 Retail Allocation Version 19.0.1 Retail Assortment Planning Version 16.0.3 Retail Extract Tranform and Load Version 13.2.8 Retail Integration Bus Version 14.1.3.0 Retail Integration Bus Version 14.1.3.2 Retail Integration Bus Version 15.0.3.1 Retail Integration Bus Version 16.0.1-16.0.3 Retail Integration Bus Version 16.0.3 Retail Integration Bus Version 19.0.0 Retail Integration Bus Version 19.0.1 Retail Invoice Matching Version 15.0.3 Retail Invoice Matching Version 16.0.3 Retail Merchandising System Version 19.0.1 Retail Predictive Application Server Version 14.1.3 Retail Predictive Application Server Version 14.1.3.46 Retail Predictive Application Server Version 15.0.3 Retail Predictive Application Server Version 15.0.3.115 Retail Predictive Application Server Version 16.0.3 Retail Predictive Application Server Version 16.0.3.240 Retail Price Management Version 13.2 Retail Price Management Version 14.0.4 Retail Price Management Version 14.1 Retail Price Management Version 14.1.3 Retail Price Management Version 15 Retail Price Management Version 15.0.3 Retail Price Management Version 16 Retail Price Management Version 16.0.3 Retail Back Office Version 14.1 Retail Central Office Version 14.1 Retail Point-of-Service Version 14.1 Retail Returns Management Version 14.1 Retail Size Profile Optimization Version 16.0.3 Retail Fiscal Management Version 14.2 Retail Analytics Version 16.0.0-16.0.2 Retail Customer Insights Version 16.0.0-16.0.2 Retail Financial Integration Version 14.1.3.2 Retail Financial Integration Version 15.0.3.1 Retail Financial Integration Version 16.0.3 Retail Financial Integration Version 19.0.1 Retail Service Backbone Version 14.1.3.0 Retail Service Backbone Version 14.1.3.2 Retail Service Backbone Version 15.0.3.1 Retail Service Backbone Version 16.0.1-16.0.3 Retail Service Backbone Version 16.0.3 Retail Service Backbone Version 19.0.0 Retail Service Backbone Version 19.0.1 Retail Xstore Point of Service Version 17.0.4 Retail Xstore Point of Service Version 18.0.3 Retail Xstore Point of Service Version 19.0.2 Retail Xstore Point of Service Version 20.0.1 Retail EFTLink Version 16.0.3 Retail EFTLink Version 17.0.2 Retail EFTLink Version 18.0.1 Retail EFTLink Version 19.0.1 Retail EFTLink Version 20.0.1 Retail Order Management System Cloud Service Version 19.5 Retail Order Broker Cloud Service Version 16.0 Retail Order Broker Cloud Service Version 18.0 Retail Order Broker Cloud Service Version 19.1 Retail Customer Management and Segmentation Foundation Version 16.0-19.0 Retail Customer Management and Segmentation Foundation Version 18.1 Retail Customer Management and Segmentation Foundation Version 19.0 Secure Backup Version Prior to 18.1.0.1.0 Siebel UI Framework Version 21.12 and prior Spatial Studio Version Prior to 21.2.1 Demantra Demand Management Version 12.2.6-12.2.11 Agile Engineering Data Management Version 6.2.1.0 Agile PLM MCAD Connector Version 3.4 Agile PLM MCAD Connector Version 3.6 Agile PLM Framework Version 9.3.3 Agile PLM Framework Version 9.3.6 Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite Version 3.6 Rapid Planning Version 12.2.6-12.2.11 Product Lifecycle Analytics Version 3.6.1 OSS Support Tools Version Prior to 2.12.42 Solaris Operating System Version 10 Solaris Operating System Version 11 Sun ZFS Storage Appliance Kit (AK) Software Version 8.8 Sun ZFS Storage Application Integration Engineering Software Version 1.3.3 Fujitsu SPARC Servers Firmware Version Prior to XCP2410 Fujitsu SPARC Servers Firmware Version prior to XCP3110 TimesTen In-Memory Database Version Prior to 11.2.2.8.27 TimesTen In-Memory Database Version Prior to 21.1.1.1.0 Utilities Framework Version 4.2.0.2.0 Utilities Framework Version 4.2.0.3.0 Utilities Framework Version 4.3.0.1.0-4.3.0.6.0 Utilities Framework Version 4.4.0.0.0 Utilities Framework Version 4.4.0.2.0 Utilities Framework Version 4.4.0.3.0 Utilities Testing Accelerator Version 6.0.0.1.1 Utilities Testing Accelerator Version 6.0.0.2.2 Utilities Testing Accelerator Version 6.0.0.3.1 VM VirtualBox Version Prior to 6.1.32 iLearning Version 6.2 iLearning Version 6.3 Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant (jQuery UI)). The supported version that is affected is Prior to 2.12.42. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in OSS Support Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of OSS Support Tools accessible data as well as unauthorized read access to a subset of OSS Support Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2016-7103 P-1330V-Prior to 2.12.42 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N OSS Support Tools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833277.1 P-1330V-Prior to 2.12.42 Vulnerability in Oracle GoldenGate (component: Build Request (Apache Xerces-C++)). The supported version that is affected is Prior to 21.4.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2018-1311 P-5757V-Prior to 21.4.0.0.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H GoldenGate Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5757V-Prior to 21.4.0.0.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLST (Apache Commons Compress)). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2018-1324 P-5242V-14.1.1.0.0 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Message Store (Apache Commons BeanUtils)). The supported version that is affected is 3.0.2.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Convergence accessible data as well as unauthorized read access to a subset of Oracle Communications Convergence accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Convergence. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2019-10086 P-8501V-3.0.2.2.0 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Communications Convergence Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-8501V-3.0.2.2.0 Vulnerability in the Oracle Communications Design Studio product of Oracle Communications Applications (component: Inventory (Apache Commons BeanUtils)). Supported versions that are affected are 7.3.4, 7.3.5 and 7.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Design Studio. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Design Studio accessible data as well as unauthorized read access to a subset of Oracle Communications Design Studio accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Design Studio. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2019-10086 P-2283V-7.3.4 P-2283V-7.3.5 P-2283V-7.4.0 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Communications Design Studio Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831888.1 P-2283V-7.3.4 P-2283V-7.3.5 P-2283V-7.4.0 Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting (Apache Commons BeanUtils)). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized read access to a subset of Oracle Hospitality Reporting and Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2019-10086 P-11599V-9.1.0 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Hospitality Reporting and Analytics Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825723.1 P-11599V-9.1.0 Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard (Apache Commons Beanutils)). Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Time and Labor accessible data as well as unauthorized read access to a subset of Oracle Time and Labor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Time and Labor. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2019-10086 P-311V-12.2.6-12.2.11 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Time and Labor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-311V-12.2.6-12.2.11 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services (JBoss Enterprise Application Platform)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2019-10219 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Communications Cloud Native Core Network Repository Function product of Oracle Communications (component: NRF (SQLite)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Network Repository Function. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Network Repository Function. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2019-13734 P-14118V-1.14.0 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Communications Cloud Native Core Network Repository Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833598.1 P-14118V-1.14.0 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (Swagger UI)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking APIs. Successful attacks of this vulnerability can result in takeover of Oracle Banking APIs. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2019-17495 P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Framework (Swagger UI)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Digital Experience. Successful attacks of this vulnerability can result in takeover of Oracle Banking Digital Experience. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2019-17495 P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Banking Digital Experience Oracle customers with valid support contracts https://support.oracle.com P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Answers (Apache Batik)). Supported versions that are affected are 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2019-17566 P-2025V-5.5.0.0.0 P-2025V-5.9.0.0.0 P-2025V-12.2.1.3.0 P-2025V-12.2.1.4.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Business Intelligence Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-2025V-5.5.0.0.0 P-2025V-5.9.0.0.0 P-2025V-12.2.1.3.0 P-2025V-12.2.1.4.0 Vulnerability in the Oracle Insurance Policy Administration J2EE product of Oracle Insurance Applications (component: Architecture (dom4j)). Supported versions that are affected are 10.2.0, 10.2.4, 11.0.2 and 11.1.0-11.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Policy Administration J2EE. Successful attacks of this vulnerability can result in takeover of Oracle Insurance Policy Administration J2EE. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-10683 P-5279V-10.2.0 P-5279V-10.2.4 P-5279V-11.0.2 P-5279V-11.1.0-11.3.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Insurance Policy Administration J2EE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832476.1 P-5279V-10.2.0 P-5279V-10.2.4 P-5279V-11.0.2 P-5279V-11.1.0-11.3.0 Vulnerability in the Oracle Insurance Rules Palette product of Oracle Insurance Applications (component: Architecture (dom4j)). Supported versions that are affected are 10.2.0, 10.2.4, 11.0.2 and 11.1.0-11.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Rules Palette. Successful attacks of this vulnerability can result in takeover of Oracle Insurance Rules Palette. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-10683 P-5288V-10.2.0 P-5288V-10.2.4 P-5288V-11.0.2 P-5288V-11.1.0-11.3.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Insurance Rules Palette Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832476.1 P-5288V-10.2.0 P-5288V-10.2.4 P-5288V-11.0.2 P-5288V-11.1.0-11.3.0 Vulnerability in the Oracle Communications EAGLE Application Processor product of Oracle Communications (component: Platform (Perl)). Supported versions that are affected are 16.1-16.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Application Processor. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications EAGLE Application Processor as well as unauthorized update, insert or delete access to some of Oracle Communications EAGLE Application Processor accessible data and unauthorized read access to a subset of Oracle Communications EAGLE Application Processor accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). Security patch has been released CVE-2020-10878 P-11122V-16.1-16.4 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Communications EAGLE Application Processor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833619.1 P-11122V-16.1-16.4 Vulnerability in the Oracle Communications EAGLE Application Processor product of Oracle Communications (component: Platform (jQuery)). Supported versions that are affected are 16.1-16.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Application Processor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications EAGLE Application Processor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications EAGLE Application Processor accessible data as well as unauthorized read access to a subset of Oracle Communications EAGLE Application Processor accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2020-11022 P-11122V-16.1-16.4 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Communications EAGLE Application Processor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833619.1 P-11122V-16.1-16.4 Vulnerability in the Oracle Communications Services Gatekeeper product of Oracle Communications (component: API Portal (jQuery)). The supported version that is affected is 7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Services Gatekeeper. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Services Gatekeeper, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Services Gatekeeper accessible data as well as unauthorized read access to a subset of Oracle Communications Services Gatekeeper accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2020-11022 P-5381V-7.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Communications Services Gatekeeper Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833211.1 P-5381V-7.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps (jQuery)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2020-11023 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in Oracle TimesTen In-Memory Database (component: Install (Apache Ant)). The supported version that is affected is Prior to 11.2.2.8.27. Easily exploitable vulnerability allows low privileged attacker with network access via Local Logon to compromise Oracle TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2020-11979 P-1870V-Prior to 11.2.2.8.27 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N TimesTen In-Memory Database Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1870V-Prior to 11.2.2.8.27 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (Apache Batik)). Supported versions that are affected are 18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking APIs. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking APIs accessible data as well as unauthorized update, insert or delete access to some of Oracle Banking APIs accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Security patch has been released CVE-2020-11987 P-13676V-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Framework (Apache Batik)). Supported versions that are affected are 18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Digital Experience. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Digital Experience accessible data as well as unauthorized update, insert or delete access to some of Oracle Banking Digital Experience accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Security patch has been released CVE-2020-11987 P-12605V-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Banking Digital Experience Oracle customers with valid support contracts https://support.oracle.com P-12605V-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 Vulnerability in the Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers product of Oracle Systems (component: XCP Firmware (NTP)). Supported versions that are affected are Prior to XCP2410 and prior to XCP3110. Difficult to exploit vulnerability allows unauthenticated attacker with network access via NTP to compromise Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H). Security patch has been released CVE-2020-13817 P-10656V-Prior to XCP2410 P-10656V-prior to XCP3110 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Fujitsu SPARC Servers Firmware Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10656V-Prior to XCP2410 P-10656V-prior to XCP3110 Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Endeca Application Controller (Apache Tomcat)). The supported version that is affected is 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-13935 P-9633V-11.3.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Commerce Guided Search / Oracle Commerce Experience Manager Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832419.1 P-9633V-11.3.2 Vulnerability in the Oracle Banking Deposits and Lines of Credit Servicing product of Oracle Financial Services Applications (component: Web UI (Apache Velocity Engine)). The supported version that is affected is 2.12.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Deposits and Lines of Credit Servicing. Successful attacks of this vulnerability can result in takeover of Oracle Banking Deposits and Lines of Credit Servicing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-13928V-2.12.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Banking Deposits and Lines of Credit Servicing Oracle customers with valid support contracts https://support.oracle.com P-13928V-2.12.0 Vulnerability in the Oracle Banking Enterprise Default Management product of Oracle Financial Services Applications (component: Collections (Apache Velocity Engine)). Supported versions that are affected are 2.3.0-2.4.1, 2.6.2, 2.7.1, 2.10.0 and 2.12.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Enterprise Default Management. Successful attacks of this vulnerability can result in takeover of Oracle Banking Enterprise Default Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-13390V-2.3.0-2.4.1 P-13390V-2.6.2 P-13390V-2.7.1 P-13390V-2.10.0 P-13390V-2.12.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Banking Enterprise Default Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13390V-2.3.0-2.4.1 P-13390V-2.6.2 P-13390V-2.7.1 P-13390V-2.10.0 P-13390V-2.12.0 Vulnerability in the Oracle Banking Loans Servicing product of Oracle Financial Services Applications (component: Web UI (Apache Velocity Engine)). The supported version that is affected is 2.12.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Loans Servicing. Successful attacks of this vulnerability can result in takeover of Oracle Banking Loans Servicing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-13927V-2.12.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Banking Loans Servicing Oracle customers with valid support contracts https://support.oracle.com P-13927V-2.12.0 Vulnerability in the Oracle Banking Party Management product of Oracle Financial Services Applications (component: Web UI (Apache Velocity Engine)). The supported version that is affected is 2.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Party Management. Successful attacks of this vulnerability can result in takeover of Oracle Banking Party Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-13929V-2.7.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Banking Party Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13929V-2.7.0 Vulnerability in the Oracle Banking Platform product of Oracle Financial Services Applications (component: Security (Apache Velocity Engine)). Supported versions that are affected are 2.3.0-2.4.1, 2.6.2 and 2.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Platform. Successful attacks of this vulnerability can result in takeover of Oracle Banking Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-9178V-2.3.0-2.4.1 P-9178V-2.6.2 P-9178V-2.7.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Banking Platform Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-9178V-2.3.0-2.4.1 P-9178V-2.6.2 P-9178V-2.7.1 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (Apache Velocity Engine)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-14277V-1.14.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal (Apache Velocity Engine)). The supported version that is affected is 19.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Integration Bus. Successful attacks of this vulnerability can result in takeover of Oracle Retail Integration Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-1807V-19.0.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Retail Integration Bus Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1807V-19.0.1 Vulnerability in the Oracle Retail Order Broker product of Oracle Retail Applications (component: Order Broker Foundation (Apache Velocity Engine)). The supported version that is affected is 16.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Order Broker. Successful attacks of this vulnerability can result in takeover of Oracle Retail Order Broker. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-11520V-16.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Retail Order Broker Cloud Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-11520V-16.0 Vulnerability in the Oracle Retail Service Backbone product of Oracle Retail Applications (component: RSB kernel (Apache Velocity Engine)). The supported version that is affected is 19.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Service Backbone. Successful attacks of this vulnerability can result in takeover of Oracle Retail Service Backbone. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-10867V-19.0.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Retail Service Backbone Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-10867V-19.0.1 Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (Apache Velocity Engine)). Supported versions that are affected are 6.0.0.1.1, 6.0.0.2.2 and 6.0.0.3.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Testing Accelerator. Successful attacks of this vulnerability can result in takeover of Oracle Utilities Testing Accelerator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-13936 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (Apache Thrift)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-13949 P-14277V-1.14.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (Apache HttpClient)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Service Communication Proxy accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2020-13956 P-14117V-1.14.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples (Apache HttpClient)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2020-13956 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Communications Cloud Native Core Network Repository Function product of Oracle Communications (component: Network Repository Function (XNIO)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Network Repository Function. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Network Repository Function. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-14340 P-14118V-1.14.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Network Repository Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833598.1 P-14118V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP (XNIO)). The supported version that is affected is 1.15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-14340 P-14123V-1.15.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Security Edge Protection Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833594.1 P-14123V-1.15.0 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (XNIO)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Service Communication Proxy. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-14340 P-14117V-1.14.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: UDR (XNIO)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Unified Data Repository. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-14340 P-14119V-1.14.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Unified Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833596.1 P-14119V-1.14.0 Vulnerability in the Oracle Utilities Framework product of Oracle Utilities Applications (component: General (Oracle Coherence)). Supported versions that are affected are 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 and 4.4.0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Framework. Successful attacks of this vulnerability can result in takeover of Oracle Utilities Framework. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-14756 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0-4.3.0.6.0 P-2245V-4.4.0.0.0 P-2245V-4.4.0.2.0 P-2245V-4.4.0.3.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Utilities Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0-4.3.0.6.0 P-2245V-4.4.0.0.0 P-2245V-4.4.0.2.0 P-2245V-4.4.0.3.0 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (Kotlin)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-15824 P-14277V-1.14.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client (Apache Groovy)). Supported versions that are affected are 3.6 and 3.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2020-17521 P-4440V-3.6 P-4440V-3.4 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Agile PLM MCAD Connector Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-4440V-3.6 P-4440V-3.4 Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Binding Support Function (Apache Tomcat)). The supported version that is affected is 1.10.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Binding Support Function. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Binding Support Function accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2020-17527 P-14121V-1.10.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Cloud Native Core Binding Support Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833618.1 P-14121V-1.10.0 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (Apache Tomcat)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Policy accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2020-17527 P-14277V-1.14.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation (Apache Struts2)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-17530 P-2025V-12.2.1.3.0 P-2025V-12.2.1.4.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Business Intelligence Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-2025V-12.2.1.3.0 P-2025V-12.2.1.4.0 Vulnerability in the Oracle Communications Instant Messaging Server product of Oracle Communications Applications (component: PresenceApi (jackson-databind)). The supported version that is affected is 10.0.1.5.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Instant Messaging Server. Successful attacks of this vulnerability can result in takeover of Oracle Communications Instant Messaging Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-24750 P-8495V-10.0.1.5.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Communications Instant Messaging Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-8495V-10.0.1.5.0 Vulnerability in the Oracle Communications Offline Mediation Controller product of Oracle Communications Applications (component: Installer (jackson-databind)). The supported version that is affected is 12.0.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Offline Mediation Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications Offline Mediation Controller. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-24750 P-2269V-12.0.0.3 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Communications Offline Mediation Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2269V-12.0.0.3 Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications Applications (component: Installation (jackson-databind)). The supported version that is affected is 12.0.0.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Pricing Design Center. Successful attacks of this vulnerability can result in takeover of Oracle Communications Pricing Design Center. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-24750 P-9437V-12.0.0.4.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Communications Pricing Design Center Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-9437V-12.0.0.4.0 Vulnerability in the Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite product of Oracle Supply Chain (component: Installation Issues (jackson-databind)). The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2020-25649 P-4589V-3.6 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-4589V-3.6 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (jackson-databind)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking APIs. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking APIs accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2020-25649 P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (glibc)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Service Communication Proxy executes to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Service Communication Proxy. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-27618 P-14117V-1.14.0 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Messaging (Bouncy Castle Java Library)). The supported version that is affected is 3.0.2.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via S/MIME to compromise Oracle Communications Convergence. Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergence. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-28052 P-8501V-3.0.2.2.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Communications Convergence Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-8501V-3.0.2.2.0 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (glob-parent)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-28469 P-14277V-1.14.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Datasource (MySQL Connector)). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SQL to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Security patch has been released CVE-2020-2934 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (Kotlin)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Cloud Native Core Service Communication Proxy accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2020-29582 P-14117V-1.14.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (jackson-databind)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-36189 P-14277V-1.14.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples (dojo)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2020-5258 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Communications Design Studio product of Oracle Communications Applications (component: Inventory (Spring Framework)). Supported versions that are affected are 7.3.4, 7.3.5 and 7.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Design Studio. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Design Studio, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications Design Studio accessible data as well as unauthorized read access to a subset of Oracle Communications Design Studio accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N). Security patch has been released CVE-2020-5421 P-2283V-7.3.4 P-2283V-7.3.5 P-2283V-7.4.0 6.5 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N Communications Design Studio Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831888.1 P-2283V-7.3.4 P-2283V-7.3.5 P-2283V-7.4.0 Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard (Eclipse Mojarra)). Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Security patch has been released CVE-2020-6950 P-311V-12.2.6-12.2.11 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Time and Labor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-311V-12.2.6-12.2.11 Vulnerability in Oracle TimesTen In-Memory Database (component: TimesTen Infrastructure (Apache ZooKeeper)). The supported version that is affected is Prior to 21.1.1.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle TimesTen In-Memory Database. Successful attacks of this vulnerability can result in takeover of Oracle TimesTen In-Memory Database. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2020-7712 P-1870V-Prior to 21.1.1.1.0 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H TimesTen In-Memory Database Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1870V-Prior to 21.1.1.1.0 Vulnerability in the Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers product of Oracle Systems (component: XCP Firmware (cURL)). Supported versions that are affected are Prior to XCP2410 and prior to XCP3110. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2020-8285 P-10656V-Prior to XCP2410 P-10656V-prior to XCP3110 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Fujitsu SPARC Servers Firmware Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10656V-Prior to XCP2410 P-10656V-prior to XCP3110 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (Kubernetes API)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Service Communication Proxy accessible data as well as unauthorized read access to a subset of Oracle Communications Cloud Native Core Service Communication Proxy accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Cloud Native Core Service Communication Proxy. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2020-8554 P-14117V-1.14.0 5.0 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: UDR (Kubernetes API)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Unified Data Repository accessible data as well as unauthorized read access to a subset of Oracle Communications Cloud Native Core Unified Data Repository accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Cloud Native Core Unified Data Repository. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2020-8554 P-14119V-1.14.0 5.0 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Communications Cloud Native Core Unified Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833596.1 P-14119V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: UDR (Guava)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Unified Data Repository executes to compromise Oracle Communications Cloud Native Core Unified Data Repository. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Cloud Native Core Unified Data Repository accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2020-8908 P-14119V-1.14.0 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Communications Cloud Native Core Unified Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833596.1 P-14119V-1.14.0 Security-in-Depth issue in the Workload Manager (Guava) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product. Security patch has been released CVE-2020-8908 P-5V-All Supported Versions 0.0 Database - Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5V-All Supported Versions Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Data Service (Guava)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Primavera Unifier executes to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2020-8908 P-10354V-17.7-17.12 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Primavera Unifier Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10354V-17.7-17.12 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 Vulnerability in the Oracle Banking Enterprise Default Management product of Oracle Financial Services Applications (component: Collections (CKEditor)). The supported version that is affected is 2.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Enterprise Default Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Enterprise Default Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Enterprise Default Management accessible data as well as unauthorized read access to a subset of Oracle Banking Enterprise Default Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2020-9281 P-13390V-2.7.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Banking Enterprise Default Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13390V-2.7.0 Vulnerability in Oracle Essbase (component: Infrastructure (mod_auth_openidc)). The supported version that is affected is Prior to 21.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-20718 P-4379V-Prior to 21.3 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Hyperion Essbase Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-4379V-Prior to 21.3 Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (Netty)). The supported version that is affected is 1.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Console. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2021-21409 P-14250V-1.7.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Communications Cloud Native Core Console Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833832.1 P-14250V-1.7.0 Vulnerability in Oracle NoSQL Database (component: Administration (Netty)). The supported version that is affected is Prior to 21.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle NoSQL Database executes to compromise Oracle NoSQL Database. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle NoSQL Database accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-21409 P-13373V-Prior to 21.1.12 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NoSQL Database Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-13373V-Prior to 21.1.12 Vulnerability in the Oracle Communications Diameter Signaling Router product of Oracle Communications (component: Platform (PHP)). Supported versions that are affected are 8.0.0.0-8.5.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Diameter Signaling Router executes to compromise Oracle Communications Diameter Signaling Router. Successful attacks of this vulnerability can result in takeover of Oracle Communications Diameter Signaling Router. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-21703 P-10899V-8.0.0.0-8.5.0.2 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Diameter Signaling Router (DSR) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833215.1 P-10899V-8.0.0.0-8.5.0.2 Vulnerability in the Oracle SD-WAN Aware product of Oracle Communications (component: Management (PHP)). The supported version that is affected is 8.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SD-WAN Aware. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle SD-WAN Aware accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2021-21705 P-13941V-8.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N SD-WAN Aware Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833597.1 P-13941V-8.2 Vulnerability in the Oracle Communications EAGLE Application Processor product of Oracle Communications (component: Platform (gSOAP)). Supported versions that are affected are 16.1-16.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Application Processor. Successful attacks of this vulnerability can result in takeover of Oracle Communications EAGLE Application Processor. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-21783 P-11122V-16.1-16.4 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Communications EAGLE Application Processor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833619.1 P-11122V-16.1-16.4 Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Binding Support Function (Spring Framework)). The supported version that is affected is 1.9.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Binding Support Function executes to compromise Oracle Communications Cloud Native Core Binding Support Function. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Binding Support Function. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-14121V-1.9.0 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Binding Support Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833618.1 P-14121V-1.9.0 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (Spring Framework)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Policy executes to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-14277V-1.14.0 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP (Spring Framework)). The supported version that is affected is 1.6.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Security Edge Protection Proxy executes to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-14123V-1.6.0 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Security Edge Protection Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833594.1 P-14123V-1.6.0 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (Spring Framework)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Service Communication Proxy executes to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Service Communication Proxy. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-14117V-1.14.0 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: UDR (Spring Framework)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Unified Data Repository executes to compromise Oracle Communications Cloud Native Core Unified Data Repository. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Unified Data Repository. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-14119V-1.14.0 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Unified Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833596.1 P-14119V-1.14.0 Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications Applications (component: TMF API (Spring Framework)). Supported versions that are affected are 7.4.1, 7.4.2 and 7.5.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-4516V-7.4.1 P-4516V-7.4.2 P-4516V-7.5.0 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Unified Inventory Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831889.1 P-4516V-7.4.1 P-4516V-7.4.2 P-4516V-7.5.0 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)). Supported versions that are affected are 8.0.8-8.1.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Financial Services Analytical Applications Infrastructure executes to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-5680V-8.0.8-8.1.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Financial Services Analytical Applications Infrastructure Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825591.1 P-5680V-8.0.8-8.1.1 Vulnerability in the Oracle Insurance Rules Palette product of Oracle Insurance Applications (component: Architecture (Spring Framework)). Supported versions that are affected are 11.0.2, 11.1.0, 11.2.7, 11.3.0 and 11.3.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Insurance Rules Palette executes to compromise Oracle Insurance Rules Palette. Successful attacks of this vulnerability can result in takeover of Oracle Insurance Rules Palette. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-5288V-11.0.2 P-5288V-11.1.0 P-5288V-11.2.7 P-5288V-11.3.0 P-5288V-11.3.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Insurance Rules Palette Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832476.1 P-5288V-11.0.2 P-5288V-11.1.0 P-5288V-11.2.7 P-5288V-11.3.0 P-5288V-11.3.1 Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Deal (Spring Framework)). Supported versions that are affected are 16.0-19.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Retail Customer Management and Segmentation Foundation executes to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Management and Segmentation Foundation. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-13388V-16.0-19.0 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Retail Customer Management and Segmentation Foundation Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-13388V-16.0-19.0 Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (Spring Framework)). Supported versions that are affected are 6.0.0.1.1, 6.0.0.2.2 and 6.0.0.3.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Utilities Testing Accelerator executes to compromise Oracle Utilities Testing Accelerator. Successful attacks of this vulnerability can result in takeover of Oracle Utilities Testing Accelerator. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22118 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (Spring Security)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-22119 P-14277V-1.14.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in Oracle Essbase (component: Build (cURL)). Supported versions that are affected are Prior to 11.1.2.4.047 and Prior to 21.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22901 P-4379V-Prior to 11.1.2.4.047 P-4379V-Prior to 21.3 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Hyperion Essbase Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-4379V-Prior to 11.1.2.4.047 P-4379V-Prior to 21.3 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search (Node.js)). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-22931 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling (cURL)). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-22946 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: File Processing (cURL)). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-22946 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Node (Node.js)). Supported versions that are affected are Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-22959 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N GraalVM Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing (nginx)). Supported versions that are affected are 8.4 and 9.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Session Border Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Session Border Controller accessible data as well as unauthorized read access to a subset of Oracle Communications Session Border Controller accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Session Border Controller. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2021-23017 P-10750V-8.4 P-10750V-9.0 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Communications Session Border Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833085.1 P-10750V-8.4 P-10750V-9.0 Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications (component: Routing (nginx)). The supported version that is affected is 3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Communications Broker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Communications Broker accessible data as well as unauthorized read access to a subset of Oracle Enterprise Communications Broker accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Communications Broker. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2021-23017 P-10758V-3.3 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Enterprise Communications Broker Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833087.1 P-10758V-3.3 Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Routing (nginx)). Supported versions that are affected are 8.4 and 9.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Session Border Controller accessible data as well as unauthorized read access to a subset of Oracle Enterprise Session Border Controller accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Session Border Controller. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2021-23017 P-10757V-8.4 P-10757V-9.0 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Enterprise Session Border Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833085.1 P-10757V-8.4 P-10757V-9.0 Vulnerability in Oracle GoldenGate (component: GG Market Place for Support (nginx)). The supported version that is affected is Prior to 21.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via UDP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle GoldenGate accessible data as well as unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Security patch has been released CVE-2021-23017 P-5757V-Prior to 21.4.0.0.0 9.4 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L GoldenGate Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5757V-Prior to 21.4.0.0.0 Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Binding Support Function (Lodash)). The supported version that is affected is 1.9.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Binding Support Function. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Binding Support Function. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-23337 P-14121V-1.9.0 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Binding Support Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833618.1 P-14121V-1.9.0 Vulnerability in the Oracle Communications Services Gatekeeper product of Oracle Communications (component: Policy service (Lodash)). The supported version that is affected is 7.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Services Gatekeeper. Successful attacks of this vulnerability can result in takeover of Oracle Communications Services Gatekeeper. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-23337 P-5381V-7.0 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Communications Services Gatekeeper Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833211.1 P-5381V-7.0 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - Cloud (Lodash)). The supported version that is affected is Prior to 9.2.6.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-23337 P-4781V-Prior to 9.2.6.1 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H JD Edwards EnterpriseOne Tools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832004.1 P-4781V-Prior to 9.2.6.1 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search (Lodash)). Supported versions that are affected are 8.58 and 8.59. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-23337 P-5085V-8.58 P-5085V-8.59 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.58 P-5085V-8.59 Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Security (Lodash)). The supported version that is affected is 19.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Management and Segmentation Foundation. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-23337 P-13388V-19.0 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Retail Customer Management and Segmentation Foundation Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-13388V-19.0 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (set-value)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-23440 P-14277V-1.14.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Application Performance Management product of Oracle Enterprise Manager (component: End User Experience Management (JDBC)). Supported versions that are affected are 13.4.1.0 and 13.5.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Application Performance Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Performance Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Performance Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9572V-13.4.1.0 P-9572V-13.5.1.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H APM - Application Performance Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-9572V-13.4.1.0 P-9572V-13.5.1.0 Vulnerability in the Oracle Real User Experience Insight product of Oracle Enterprise Manager (component: End User Experience Management (OCCI)). Supported versions that are affected are 13.4.1.0 and 13.5.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Real User Experience Insight. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Real User Experience Insight, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Real User Experience Insight. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9572V-13.4.1.0 P-9572V-13.5.1.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H APM - Application Performance Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-9572V-13.4.1.0 P-9572V-13.5.1.0 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Installation (JDBC)). The supported version that is affected is 6.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Agile Engineering Data Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-4436V-6.2.1.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Agile Engineering Data Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-4436V-6.2.1.0 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security (JDBC)). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-4461V-9.3.6 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Agile PLM Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-4461V-9.3.6 Vulnerability in Oracle Airlines Data Model (component: Installation (JDBC)). Supported versions that are affected are 12.2.0.1.0 and 12.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Airlines Data Model. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Airlines Data Model, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Airlines Data Model. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9587V-12.2.0.1.0 P-9587V-12.1.1.0.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Airlines Data Model Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833257.1 P-9587V-12.2.0.1.0 P-9587V-12.1.1.0.0 Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load Testing for Web Apps (JDBC, OCCI)). The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Application Testing Suite. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Testing Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-4622V-13.3.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Application Testing Suite Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-4622V-13.3.0.1 Vulnerability in the Oracle Argus Analytics product of Oracle Health Sciences Applications (component: Schema Creation (JDBC)). Supported versions that are affected are 8.2.1, 8.2.2 and 8.2.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Argus Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Argus Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Argus Analytics. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9171V-8.2.1 P-9171V-8.2.2 P-9171V-8.2.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Argus Analytics Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827314.1 P-9171V-8.2.1 P-9171V-8.2.2 P-9171V-8.2.3 Vulnerability in the Oracle Argus Insight product of Oracle Health Sciences Applications (component: Schema Creation (JDBC)). Supported versions that are affected are 8.2.1, 8.2.2 and 8.2.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Argus Insight. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Argus Insight, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Argus Insight. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5717V-8.2.1 P-5717V-8.2.2 P-5717V-8.2.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Argus Insight Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827314.1 P-5717V-8.2.1 P-5717V-8.2.2 P-5717V-8.2.3 Vulnerability in the Oracle Argus Mart product of Oracle Health Sciences Applications (component: Schema Creation (JDBC)). Supported versions that are affected are 8.2.1, 8.2.2 and 8.2.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Argus Mart. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Argus Mart, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Argus Mart. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-10383V-8.2.1 P-10383V-8.2.2 P-10383V-8.2.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Argus Mart Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827314.1 P-10383V-8.2.1 P-10383V-8.2.2 P-10383V-8.2.3 Vulnerability in the Oracle Argus Safety product of Oracle Health Sciences Applications (component: Schema Creation (JDBC)). Supported versions that are affected are 8.2.1, 8.2.2 and 8.2.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Argus Safety. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Argus Safety, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Argus Safety. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5710V-8.2.1 P-5710V-8.2.2 P-5710V-8.2.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Argus Safety Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827314.1 P-5710V-8.2.1 P-5710V-8.2.2 P-5710V-8.2.3 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (JDBC)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Banking APIs. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking APIs, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Banking APIs. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Framework (JDBC)). Supported versions that are affected are 17.2, 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Banking Digital Experience. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Digital Experience, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Banking Digital Experience. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-12605V-17.2 P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Banking Digital Experience Oracle customers with valid support contracts https://support.oracle.com P-12605V-17.2 P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 Vulnerability in the Big Data Spatial and Graph product of Oracle Big Data Graph (component: Big Data Graph (JDBC)). The supported version that is affected is Prior to 23.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Big Data Spatial and Graph. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Big Data Spatial and Graph, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Big Data Spatial and Graph. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-11528V-Prior to 23.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Big Data Spatial and Graph Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-11528V-Prior to 23.1 Vulnerability in the Oracle Clinical product of Oracle Health Sciences Applications (component: Schema Creation (JDBC)). Supported versions that are affected are 5.2.1 and 5.2.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Clinical. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Clinical, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Clinical. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-801V-5.2.1 P-801V-5.2.2 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Clinical Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827314.1 P-801V-5.2.1 P-801V-5.2.2 Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (JDBC)). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Commerce Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9348V-11.3.0 P-9348V-11.3.1 P-9348V-11.3.2 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Commerce Platform Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832419.1 P-9348V-11.3.0 P-9348V-11.3.1 P-9348V-11.3.2 Vulnerability in the Oracle Communications Calendar Server product of Oracle Communications Applications (component: Administration (JDBC)). The supported version that is affected is 8.0.0.5.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Communications Calendar Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Calendar Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Calendar Server. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-8494V-8.0.0.5.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Communications Calendar Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-8494V-8.0.0.5.0 Vulnerability in the Oracle Communications Contacts Server product of Oracle Communications Applications (component: Database (JDBC)). The supported version that is affected is 8.0.0.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Communications Contacts Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Contacts Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Contacts Server. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-10696V-8.0.0.3.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Communications Contacts Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-10696V-8.0.0.3.0 Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications Applications (component: ACS (JDBC)). Supported versions that are affected are 6.0.1.0.0 and 12.0.1.0.0-12.0.4.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Communications Convergent Charging Controller. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Convergent Charging Controller, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergent Charging Controller. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-12985V-6.0.1.0.0 P-12985V-12.0.1.0.0-12.0.4.0.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Communications Convergent Charging Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831885.1 P-12985V-6.0.1.0.0 P-12985V-12.0.1.0.0-12.0.4.0.0 Vulnerability in Oracle Communications Data Model (component: Utilities (JDBC)). Supported versions that are affected are 11.3.2.2.0, 12.1.2.0.0, 12.1.0.1.0, 11.3.2.3.0 and 11.3.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Communications Data Model. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Data Model, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Data Model. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-4671V-11.3.2.2.0 P-4671V-12.1.2.0.0 P-4671V-12.1.0.1.0 P-4671V-11.3.2.3.0 P-4671V-11.3.2.1.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Communications Data Model Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833265.1 P-4671V-11.3.2.2.0 P-4671V-12.1.2.0.0 P-4671V-12.1.0.1.0 P-4671V-11.3.2.3.0 P-4671V-11.3.2.1.0 Vulnerability in the Oracle Communications Design Studio product of Oracle Communications Applications (component: OSM, NI Plugins (JDBC)). Supported versions that are affected are 7.3.5, 7.4.0, 7.4.1 and 7.4.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Communications Design Studio. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Design Studio, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Design Studio. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-2283V-7.3.5 P-2283V-7.4.0 P-2283V-7.4.1 P-2283V-7.4.2 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Communications Design Studio Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831888.1 P-2283V-7.3.5 P-2283V-7.4.0 P-2283V-7.4.1 P-2283V-7.4.2 Vulnerability in the Oracle Communications Network Charging and Control product of Oracle Communications Applications (component: ACS (JDBC)). Supported versions that are affected are 6.0.1.0.0 and 12.0.1.0.0-12.0.4.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Communications Network Charging and Control. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Network Charging and Control, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Charging and Control. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-4623V-6.0.1.0.0 P-4623V-12.0.1.0.0-12.0.4.0.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Communications Network Charging and Control Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831885.1 P-4623V-6.0.1.0.0 P-4623V-12.0.1.0.0-12.0.4.0.0 Vulnerability in the Oracle Communications Network Integrity product of Oracle Communications Applications (component: Installer (JDBC)). Supported versions that are affected are 7.3.5 and 7.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Communications Network Integrity. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Network Integrity, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Integrity. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-4491V-7.3.5 P-4491V-7.3.6 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Communications Network Integrity Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831886.1 P-4491V-7.3.5 P-4491V-7.3.6 Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Runtime Java agent for ODI (JDBC)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Data Integrator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-2196V-12.2.1.3.0 P-2196V-12.2.1.4.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Data Integrator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-2196V-12.2.1.3.0 P-2196V-12.2.1.4.0 Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Security (JDBC, OCCI)). Supported versions that are affected are 12.2.6-12.2.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Demantra Demand Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demantra Demand Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Demantra Demand Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-2100V-12.2.6-12.2.11 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Demantra Demand Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-2100V-12.2.6-12.2.11 Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: General (JDBC)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Enterprise Data Quality. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Data Quality, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Data Quality. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9464V-12.2.1.3.0 P-9464V-12.2.1.4.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Enterprise Data Quality Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-9464V-12.2.1.3.0 P-9464V-12.2.1.4.0 Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install (JDBC)). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1370V-13.4.0.0 P-1370V-13.5.0.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Enterprise Manager Base Platform Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1370V-13.4.0.0 P-1370V-13.5.0.0 Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Networking (JDBC)). The supported version that is affected is 12.4.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Enterprise Manager Ops Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Enterprise Manager Ops Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops Center. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9835V-12.4.0.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Enterprise Manager Ops Center Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-9835V-12.4.0.0 Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications (component: Infrastructure Code (JDBC)). Supported versions that are affected are 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.4.0 and 14.5.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Investor Servicing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Investor Servicing. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.3.0 P-9099V-12.4.0 P-9099V-14.4.0 P-9099V-14.5.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H FLEXCUBE Investor Servicing Oracle customers with valid support contracts https://support.oracle.com P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.3.0 P-9099V-12.4.0 P-9099V-14.4.0 P-9099V-14.5.0 Vulnerability in the Oracle FLEXCUBE Private Banking product of Oracle Financial Services Applications (component: Miscellaneous (JDBC)). Supported versions that are affected are 12.0.0 and 12.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Private Banking. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9110V-12.0.0 P-9110V-12.1.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H FLEXCUBE Private Banking Oracle customers with valid support contracts https://support.oracle.com P-9110V-12.0.0 P-9110V-12.1.0 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Rate Management (JDBC)). Supported versions that are affected are 8.0.7-8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Analytical Applications Infrastructure, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5680V-8.0.7-8.1.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Financial Services Analytical Applications Infrastructure Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825591.1 P-5680V-8.0.7-8.1.1 Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (JDBC)). Supported versions that are affected are 8.0.7, 8.0.8 and 8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Financial Services Behavior Detection Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Behavior Detection Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9190V-8.0.7 P-9190V-8.0.8 P-9190V-8.1.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Financial Services Behavior Detection Platform Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832147.1 P-9190V-8.0.7 P-9190V-8.0.8 P-9190V-8.1.1 Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Financial Services Applications (component: Installers (JDBC)). Supported versions that are affected are 8.0.7, 8.0.8 and 8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Financial Services Enterprise Case Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Enterprise Case Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Enterprise Case Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-13545V-8.0.7 P-13545V-8.0.8 P-13545V-8.1.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Financial Services Enterprise Case Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832152.1 P-13545V-8.0.7 P-13545V-8.0.8 P-13545V-8.1.1 Vulnerability in the Oracle Financial Services Foreign Account Tax Compliance Act Management product of Oracle Financial Services Applications (component: Installation (JDBC)). Supported versions that are affected are 8.0.7, 8.0.8 and 8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Financial Services Foreign Account Tax Compliance Act Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Foreign Account Tax Compliance Act Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Foreign Account Tax Compliance Act Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-10308V-8.0.7 P-10308V-8.0.8 P-10308V-8.1.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Financial Services Foreign Account Tax Compliance Act Management Oracle customers with valid support contracts https://support.oracle.com P-10308V-8.0.7 P-10308V-8.0.8 P-10308V-8.1.1 Vulnerability in the Oracle Financial Services Model Management and Governance product of Oracle Financial Services Applications (component: Installer & Configuration (JDBC)). Supported versions that are affected are 8.0.8-8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Financial Services Model Management and Governance. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Model Management and Governance, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Model Management and Governance. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-14276V-8.0.8-8.1.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Financial Services Model Management and Governance Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825611.1 P-14276V-8.0.8-8.1.1 Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (JDBC)). Supported versions that are affected are 8.0.7 and 8.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-13789V-8.0.7 P-13789V-8.0.8 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Financial Services Trade-Based Anti Money Laundering Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833718.1 P-13789V-8.0.7 P-13789V-8.0.8 Vulnerability in Oracle Fusion Middleware (component: Centralized Third-party Jars (JDBC, OCCI, ODP for .NET)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Fusion Middleware. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Fusion Middleware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Fusion Middleware. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1032V-12.2.1.3.0 P-1032V-12.2.1.4.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Fusion Middleware Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1032V-12.2.1.3.0 P-1032V-12.2.1.4.0 Vulnerability in Oracle GoldenGate (component: Database (OCCI)). Supported versions that are affected are Prior to 21.5.0.0.220118, Prior to 19.1.0.0.220118 and Prior to 12.3.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle GoldenGate. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle GoldenGate, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5757V-Prior to 21.5.0.0.220118 P-5757V-Prior to 19.1.0.0.220118 P-5757V-Prior to 12.3.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H GoldenGate Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5757V-Prior to 21.5.0.0.220118 P-5757V-Prior to 19.1.0.0.220118 P-5757V-Prior to 12.3.0.1 Vulnerability in Oracle Graph Server and Client (component: Packaging/install issues (JDBC)). The supported version that is affected is Prior to 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Graph Server and Client. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Graph Server and Client, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Graph Server and Client. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-14069V-Prior to 21.4 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Graph Server and Client Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-14069V-Prior to 21.4 Vulnerability in the Oracle Health Sciences Clinical Development Analytics product of Oracle Health Sciences Applications (component: Installation (JDBC)). The supported version that is affected is 4.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Health Sciences Clinical Development Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Health Sciences Clinical Development Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Health Sciences Clinical Development Analytics. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5563V-4.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Health Sciences Clinical Development Analytics Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827314.1 P-5563V-4.0.1 Vulnerability in the Oracle Health Sciences InForm CRF Submit product of Oracle Health Sciences Applications (component: Installation and Configuration (JDBC, ODP for .NET)). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Health Sciences InForm CRF Submit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Health Sciences InForm CRF Submit, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Health Sciences InForm CRF Submit. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9641V-6.2.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Health Sciences InForm CRF Submit Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827314.1 P-9641V-6.2.1 Vulnerability in the Oracle Health Sciences Information Manager product of Oracle HealthCare Applications (component: Health Policy Engine (JDBC)). Supported versions that are affected are 3.0.2 and 3.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Health Sciences Information Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Health Sciences Information Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Health Sciences Information Manager. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9177V-3.0.2 P-9177V-3.0.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Health Sciences Information Manager Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827318.1 P-9177V-3.0.2 P-9177V-3.0.3 Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: Installation (JDBC)). Supported versions that are affected are 7.0.2, 8.1.0 and 8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Healthcare Data Repository. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Healthcare Data Repository, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9161V-7.0.2 P-9161V-8.1.0 P-9161V-8.1.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Healthcare Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827318.1 P-9161V-7.0.2 P-9161V-8.1.0 P-9161V-8.1.1 Vulnerability in the Oracle Healthcare Foundation product of Oracle HealthCare Applications (component: Installation (JDBC)). Supported versions that are affected are 7.3.0.0-7.3.0.2, 8.0.0-8.0.2 and 8.1.0-8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Healthcare Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Healthcare Foundation, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Foundation. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-12950V-7.3.0.0-7.3.0.2 P-12950V-8.0.0-8.0.2 P-12950V-8.1.0-8.1.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Healthcare Foundation Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827318.1 P-12950V-7.3.0.0-7.3.0.2 P-12950V-8.0.0-8.0.2 P-12950V-8.1.0-8.1.1 Vulnerability in the Oracle Healthcare Translational Research product of Oracle HealthCare Applications (component: Installation (JDBC)). The supported version that is affected is 4.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Healthcare Translational Research. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Healthcare Translational Research, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Translational Research. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9427V-4.1.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Healthcare Translational Research Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827318.1 P-9427V-4.1.0 Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Integrations (JDBC, ODP for .NET)). The supported version that is affected is 5.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Hospitality OPERA 5. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality OPERA 5, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-11580V-5.6 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Hospitality OPERA 5 Property Services Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2824790.1 P-11580V-5.6 Vulnerability in the Oracle Hospitality Suite8 product of Oracle Hospitality Applications (component: Rest API (ODP for .NET)). Supported versions that are affected are 8.10.2, 8.11.0, 8.12.0, 8.13.0 and 8.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Hospitality Suite8. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Suite8, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Suite8. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-12619V-8.10.2 P-12619V-8.11.0 P-12619V-8.12.0 P-12619V-8.13.0 P-12619V-8.14.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Hospitality Suite8 Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2824342.1 P-12619V-8.10.2 P-12619V-8.11.0 P-12619V-8.12.0 P-12619V-8.13.0 P-12619V-8.14.0 Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration (JDBC, OCCI, ODP for .NET)). The supported version that is affected is 11.2.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Infrastructure Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-4392V-11.2.7.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Hyperion Infrastructure Technology Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-4392V-11.2.7.0 Vulnerability in the Oracle Insurance Data Gateway product of Oracle Insurance Applications (component: Security (JDBC)). Supported versions that are affected are 11.0.2, 11.1.0, 11.2.7, 11.3.0 and 11.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Data Gateway. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Insurance Data Gateway, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Insurance Data Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-13628V-11.0.2 P-13628V-11.1.0 P-13628V-11.2.7 P-13628V-11.3.0 P-13628V-11.3.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Insurance Data Gateway Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832476.1 P-13628V-11.0.2 P-13628V-11.1.0 P-13628V-11.2.7 P-13628V-11.3.0 P-13628V-11.3.1 Vulnerability in the Oracle Insurance Insbridge Rating and Underwriting product of Oracle Insurance Applications (component: Framework Administrator IBFA (JDBC, ODP for .NET)). Supported versions that are affected are 5.2.0 and 5.4.0-5.6.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Insurance Insbridge Rating and Underwriting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Insurance Insbridge Rating and Underwriting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Insurance Insbridge Rating and Underwriting. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5484V-5.2.0 P-5484V-5.4.0-5.6.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Insurance Insbridge Rating and Underwriting Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832476.1 P-5484V-5.2.0 P-5484V-5.4.0-5.6.0 Vulnerability in the Oracle Insurance Policy Administration product of Oracle Insurance Applications (component: Architecture (JDBC)). Supported versions that are affected are 11.0.2, 11.1.0, 11.2.7, 11.3.0 and 11.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Insurance Policy Administration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Insurance Policy Administration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Insurance Policy Administration. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5279V-11.0.2 P-5279V-11.1.0 P-5279V-11.2.7 P-5279V-11.3.0 P-5279V-11.3.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Insurance Policy Administration J2EE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832476.1 P-5279V-11.0.2 P-5279V-11.1.0 P-5279V-11.2.7 P-5279V-11.3.0 P-5279V-11.3.1 Vulnerability in the Oracle Insurance Rules Palette product of Oracle Insurance Applications (component: Architecture (JDBC)). Supported versions that are affected are 11.0.2, 11.1.0, 11.2.7, 11.3.0 and 11.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Insurance Rules Palette. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Insurance Rules Palette, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Insurance Rules Palette. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5288V-11.0.2 P-5288V-11.1.0 P-5288V-11.2.7 P-5288V-11.3.0 P-5288V-11.3.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Insurance Rules Palette Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832476.1 P-5288V-11.0.2 P-5288V-11.1.0 P-5288V-11.2.7 P-5288V-11.3.0 P-5288V-11.3.1 Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant (JDBC)). The supported version that is affected is Prior to 2.12.42. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise OSS Support Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in OSS Support Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of OSS Support Tools. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1330V-Prior to 2.12.42 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H OSS Support Tools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833277.1 P-1330V-Prior to 2.12.42 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Change Impact Analyzer (JDBC)). Supported versions that are affected are 8.57, 8.58 and 8.59. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in Oracle Policy Automation (component: Determinations Engine (JDBC)). Supported versions that are affected are 12.2.0-12.2.24. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Policy Automation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Policy Automation, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Policy Automation. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5624V-12.2.0-12.2.24 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Policy Automation Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832841.1 P-5624V-12.2.0-12.2.24 Vulnerability in the Primavera Analytics product of Oracle Construction and Engineering (component: ETL (JDBC)). Supported versions that are affected are 18.8.3.3, 19.12.11.1 and 20.12.12.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Primavera Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Primavera Analytics. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-8577V-18.8.3.3 P-8577V-19.12.11.1 P-8577V-20.12.12.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Primavera Analytics Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-8577V-18.8.3.3 P-8577V-19.12.11.1 P-8577V-20.12.12.0 Vulnerability in the Primavera Data Warehouse product of Oracle Construction and Engineering (component: ETL (JDBC)). Supported versions that are affected are 18.8.3.3, 19.12.11.1 and 20.12.12.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Primavera Data Warehouse. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Data Warehouse, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Primavera Data Warehouse. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5585V-18.8.3.3 P-5585V-19.12.11.1 P-5585V-20.12.12.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Primavera Data Warehouse Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5585V-18.8.3.3 P-5585V-19.12.11.1 P-5585V-20.12.12.0 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access (JDBC)). Supported versions that are affected are 17.12.0.0-17.12.20.0, 18.8.0.0-18.8.24.0, 19.12.0.0-19.12.17.0 and 20.12.0.0-20.12.9.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Primavera P6 Enterprise Project Portfolio Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5579V-17.12.0.0-17.12.20.0 P-5579V-18.8.0.0-18.8.24.0 P-5579V-19.12.0.0-19.12.17.0 P-5579V-20.12.0.0-20.12.9.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Primavera P6 Enterprise Project Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5579V-17.12.0.0-17.12.20.0 P-5579V-18.8.0.0-18.8.24.0 P-5579V-19.12.0.0-19.12.17.0 P-5579V-20.12.0.0-20.12.9.0 Vulnerability in the Primavera P6 Professional Project Management product of Oracle Construction and Engineering (component: API component of P6 Pro (JDBC)). Supported versions that are affected are 17.12.0.0-17.12.20.0, 18.8.0.0-18.8.24.0, 19.12.0.0-19.12.17.0 and 20.12.0.0-20.12.9.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Primavera P6 Professional Project Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Professional Project Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Primavera P6 Professional Project Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5580V-17.12.0.0-17.12.20.0 P-5580V-18.8.0.0-18.8.24.0 P-5580V-19.12.0.0-19.12.17.0 P-5580V-20.12.0.0-20.12.9.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Primavera P6 Professional Project Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5580V-17.12.0.0-17.12.20.0 P-5580V-18.8.0.0-18.8.24.0 P-5580V-19.12.0.0-19.12.17.0 P-5580V-20.12.0.0-20.12.9.0 Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform,Data Access,Data Persistence (JDBC)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Primavera Unifier. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-10354V-17.7-17.12 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Primavera Unifier Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10354V-17.7-17.12 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation (JDBC)). The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Product Lifecycle Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9387V-3.6.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Product Lifecycle Analytics Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-9387V-3.6.1 Vulnerability in the Oracle Rapid Planning product of Oracle Supply Chain (component: Middle Tier (JDBC, OCCI)). Supported versions that are affected are 12.2.6-12.2.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Rapid Planning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Rapid Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Rapid Planning. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-5235V-12.2.6-12.2.11 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Rapid Planning Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-5235V-12.2.6-12.2.11 Vulnerability in the Oracle Retail Analytics product of Oracle Retail Applications (component: Other (JDBC)). Supported versions that are affected are 16.0.0-16.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Analytics. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9346V-16.0.0-16.0.2 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Analytics Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-9346V-16.0.0-16.0.2 Vulnerability in the Oracle Retail Assortment Planning product of Oracle Retail Applications (component: Application Core (JDBC)). The supported version that is affected is 16.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Assortment Planning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Assortment Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Assortment Planning. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1788V-16.0.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Assortment Planning Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1788V-16.0.3 Vulnerability in the Oracle Retail Back Office product of Oracle Retail Applications (component: Security (JDBC)). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Back Office. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Back Office, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Back Office. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-2013V-14.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Back Office Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-2013V-14.1 Vulnerability in the Oracle Retail Central Office product of Oracle Retail Applications (component: Security (JDBC)). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Central Office. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Central Office, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Central Office. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-2016V-14.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Central Office Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-2016V-14.1 Vulnerability in the Oracle Retail Customer Insights product of Oracle Retail Applications (component: Other (JDBC)). Supported versions that are affected are 16.0.0-16.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Customer Insights. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Customer Insights, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Insights. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-10263V-16.0.0-16.0.2 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Customer Insights Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-10263V-16.0.0-16.0.2 Vulnerability in the Oracle Retail Extract Transform and Load product of Oracle Retail Applications (component: Mathematical Operators (JDBC)). The supported version that is affected is 13.2.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Extract Transform and Load. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Extract Transform and Load, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Extract Transform and Load. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1803V-13.2.8 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Extract Tranform and Load Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1803V-13.2.8 Vulnerability in the Oracle Retail Financial Integration product of Oracle Retail Applications (component: PeopleSoft Integration Bugs (JDBC)). Supported versions that are affected are 14.1.3.2, 15.0.3.1, 16.0.3 and 19.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Financial Integration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Financial Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Financial Integration. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-10722V-14.1.3.2 P-10722V-15.0.3.1 P-10722V-16.0.3 P-10722V-19.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Financial Integration Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-10722V-14.1.3.2 P-10722V-15.0.3.1 P-10722V-16.0.3 P-10722V-19.0.1 Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal (JDBC)). Supported versions that are affected are 14.1.3.2, 15.0.3.1, 16.0.3 and 19.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Integration Bus. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Integration Bus, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Integration Bus. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1807V-14.1.3.2 P-1807V-15.0.3.1 P-1807V-16.0.3 P-1807V-19.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Integration Bus Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1807V-14.1.3.2 P-1807V-15.0.3.1 P-1807V-16.0.3 P-1807V-19.0.1 Vulnerability in the Oracle Retail Merchandising System product of Oracle Retail Applications (component: Foundation (JDBC)). The supported version that is affected is 19.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Merchandising System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Merchandising System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Merchandising System. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1816V-19.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Merchandising System Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1816V-19.0.1 Vulnerability in the Oracle Retail Order Broker product of Oracle Retail Applications (component: System Administration (JDBC)). Supported versions that are affected are 16.0, 18.0 and 19.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Order Broker. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Order Broker, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Order Broker. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-11520V-16.0 P-11520V-18.0 P-11520V-19.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Order Broker Cloud Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-11520V-16.0 P-11520V-18.0 P-11520V-19.1 Vulnerability in the Oracle Retail Order Management System product of Oracle Retail Applications (component: Upgrade Install (JDBC)). The supported version that is affected is 19.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Order Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Order Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Order Management System. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-11519V-19.5 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Order Management System Cloud Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-11519V-19.5 Vulnerability in the Oracle Retail Point-of-Service product of Oracle Retail Applications (component: Security (JDBC)). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Point-of-Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Point-of-Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Point-of-Service. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-2017V-14.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Point-of-Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-2017V-14.1 Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (OCCI)). Supported versions that are affected are 14.1.3, 15.0.3 and 16.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Predictive Application Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Predictive Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1823V-14.1.3 P-1823V-15.0.3 P-1823V-16.0.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Predictive Application Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1823V-14.1.3 P-1823V-15.0.3 P-1823V-16.0.3 Vulnerability in the Oracle Retail Price Management product of Oracle Retail Applications (component: Security (JDBC)). Supported versions that are affected are 14.1, 15 and 16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Price Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Price Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Price Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1824V-14.1 P-1824V-15 P-1824V-16 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Price Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1824V-14.1 P-1824V-15 P-1824V-16 Vulnerability in the Oracle Retail Returns Management product of Oracle Retail Applications (component: Security (JDBC)). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Returns Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Returns Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Returns Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-2020V-14.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Returns Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-2020V-14.1 Vulnerability in the Oracle Retail Service Backbone product of Oracle Retail Applications (component: RSB Installation (JDBC)). Supported versions that are affected are 14.1.3.2, 15.0.3.1, 16.0.3 and 19.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Service Backbone. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Service Backbone, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Service Backbone. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-10867V-14.1.3.2 P-10867V-15.0.3.1 P-10867V-16.0.3 P-10867V-19.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Service Backbone Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-10867V-14.1.3.2 P-10867V-15.0.3.1 P-10867V-16.0.3 P-10867V-19.0.1 Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (JDBC)). Supported versions that are affected are 17.0.4, 18.0.3, 19.0.2 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Xstore Point of Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Xstore Point of Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Retail Xstore Point of Service. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-11513V-17.0.4 P-11513V-18.0.3 P-11513V-19.0.2 P-11513V-20.0.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Retail Xstore Point of Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-11513V-17.0.4 P-11513V-18.0.3 P-11513V-19.0.2 P-11513V-20.0.1 Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI (JDBC)). Supported versions that are affected are 21.12 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel UI Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel UI Framework. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-9011V-21.12 and prior 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Siebel UI Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832003.1 P-9011V-21.12 and prior Vulnerability in Oracle Spatial Studio (component: Install (JDBC)). The supported version that is affected is Prior to 21.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Spatial Studio. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Spatial Studio, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Spatial Studio. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-13600V-Prior to 21.2.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Spatial Studio Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-13600V-Prior to 21.2.1 Vulnerability in the Oracle ZFS Storage Application Integration Engineering Software product of Oracle Systems (component: Snap Management Utility (JDBC)). The supported version that is affected is 1.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle ZFS Storage Application Integration Engineering Software. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle ZFS Storage Application Integration Engineering Software, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Application Integration Engineering Software. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-10027V-1.3.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Sun ZFS Storage Application Integration Engineering Software Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10027V-1.3.3 Vulnerability in the Oracle Thesaurus Management System product of Oracle Health Sciences Applications (component: Report Generation (JDBC)). Supported versions that are affected are 5.2.3, 5.3.0 and 5.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Thesaurus Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Thesaurus Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Thesaurus Management System. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-192V-5.2.3 P-192V-5.3.0 P-192V-5.3.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Thesaurus Management System Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827314.1 P-192V-5.2.3 P-192V-5.3.0 P-192V-5.3.1 Vulnerability in Oracle TimesTen In-Memory Database (component: EM TimesTen plug-in (JDBC,OCCI)). The supported version that is affected is Prior to 21.1.1.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via OracleNet to compromise Oracle TimesTen In-Memory Database. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle TimesTen In-Memory Database. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-1870V-Prior to 21.1.1.1.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H TimesTen In-Memory Database Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1870V-Prior to 21.1.1.1.0 Vulnerability in the Oracle Utilities Framework product of Oracle Utilities Applications (component: General (JDBC)). Supported versions that are affected are 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 and 4.4.0.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Utilities Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Utilities Framework. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0-4.3.0.6.0 P-2245V-4.4.0.0.0 P-2245V-4.4.0.2.0 P-2245V-4.4.0.3.0 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Utilities Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0-4.3.0.6.0 P-2245V-4.4.0.0.0 P-2245V-4.4.0.2.0 P-2245V-4.4.0.3.0 Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (JDBC)). Supported versions that are affected are 6.0.0.1.1, 6.0.0.2.2 and 6.0.0.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Utilities Testing Accelerator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Utilities Testing Accelerator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Utilities Testing Accelerator. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 Vulnerability in Oracle iLearning (component: Installation (JDBC)). Supported versions that are affected are 6.2 and 6.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle iLearning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iLearning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle iLearning. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-2351 P-902V-6.2 P-902V-6.3 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H iLearning Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2732007.1 P-902V-6.2 P-902V-6.3 Vulnerability in the Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers product of Oracle Systems (component: XCP Firmware (OpenSSL)). Supported versions that are affected are Prior to XCP2410 and prior to XCP3110. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-23840 P-10656V-Prior to XCP2410 P-10656V-prior to XCP3110 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Fujitsu SPARC Servers Firmware Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10656V-Prior to XCP2410 P-10656V-prior to XCP3110 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP (Apache Tomcat)). The supported version that is affected is 1.6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-25122 P-14123V-1.6.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Cloud Native Core Security Edge Protection Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833594.1 P-14123V-1.6.0 Vulnerability in the Oracle Communications Instant Messaging Server product of Oracle Communications Applications (component: DBPlugin (Apache Tomcat)). The supported version that is affected is 10.0.1.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via XMPP to compromise Oracle Communications Instant Messaging Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Instant Messaging Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-25122 P-8495V-10.0.1.5.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Instant Messaging Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-8495V-10.0.1.5.0 Vulnerability in Oracle Secure Backup (component: Oracle Secure Backup (Apache HTTP Server)). The supported version that is affected is Prior to 18.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-26691 P-1522V-Prior to 18.1.0.1.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Secure Backup Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1522V-Prior to 18.1.0.1.0 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (netplex json-smart)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Policy accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H). Security patch has been released CVE-2021-27568 P-14277V-1.14.0 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant (json-smart)). The supported version that is affected is Prior to 2.12.42. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all OSS Support Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of OSS Support Tools. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H). Security patch has been released CVE-2021-27568 P-1330V-Prior to 2.12.42 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H OSS Support Tools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833277.1 P-1330V-Prior to 2.12.42 Vulnerability in the Oracle Utilities Framework product of Oracle Utilities Applications (component: Common (json-smart)). Supported versions that are affected are 4.4.0.0.0, 4.4.0.2.0 and 4.4.0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Utilities Framework accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Framework. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H). Security patch has been released CVE-2021-27568 P-2245V-4.4.0.0.0 P-2245V-4.4.0.2.0 P-2245V-4.4.0.3.0 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Utilities Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-2245V-4.4.0.0.0 P-2245V-4.4.0.2.0 P-2245V-4.4.0.3.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services (json-smart)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-27568 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (Apache Ignite)). Supported versions that are affected are 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking APIs. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Banking APIs accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-28164 P-13676V-20.1 P-13676V-21.1 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Framework (Apache Ignite)). Supported versions that are affected are 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Digital Experience. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Banking Digital Experience accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-28164 P-12605V-20.1 P-12605V-21.1 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Banking Digital Experience Oracle customers with valid support contracts https://support.oracle.com P-12605V-20.1 P-12605V-21.1 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (Eclipse Jetty)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-28165 P-14277V-1.14.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Security-in-Depth issue in the Workload Manager (Jetty) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product. Security patch has been released CVE-2021-28165 P-5V-All Supported Versions 0.0 Database - Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5V-All Supported Versions Vulnerability in Oracle REST Data Services (component: General (Eclipse Jetty)). The supported version that is affected is Prior to 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-28165 P-9456V-Prior to 21.2.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H REST Data Services Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-9456V-Prior to 21.2.0 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (Apache Commons IO)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking APIs. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking APIs accessible data as well as unauthorized read access to a subset of Oracle Banking APIs accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Framework (Apache Commons IO)). Supported versions that are affected are 17.2, 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Digital Experience. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Digital Experience accessible data as well as unauthorized read access to a subset of Oracle Banking Digital Experience accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-12605V-17.2 P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Banking Digital Experience Oracle customers with valid support contracts https://support.oracle.com P-12605V-17.2 P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 Vulnerability in the Oracle Banking Enterprise Default Management product of Oracle Financial Services Applications (component: Collections (Apache Commons IO)). Supported versions that are affected are 2.3.0-2.4.1, 2.6.2, 2.7.1, 2.10.0 and 2.12.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Enterprise Default Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Enterprise Default Management accessible data as well as unauthorized read access to a subset of Oracle Banking Enterprise Default Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-13390V-2.3.0-2.4.1 P-13390V-2.6.2 P-13390V-2.7.1 P-13390V-2.10.0 P-13390V-2.12.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Banking Enterprise Default Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13390V-2.3.0-2.4.1 P-13390V-2.6.2 P-13390V-2.7.1 P-13390V-2.10.0 P-13390V-2.12.0 Vulnerability in the Oracle Banking Party Management product of Oracle Financial Services Applications (component: Web UI (Apache Commons IO)). The supported version that is affected is 2.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Party Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Party Management accessible data as well as unauthorized read access to a subset of Oracle Banking Party Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-13929V-2.7.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Banking Party Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13929V-2.7.0 Vulnerability in the Oracle Banking Platform product of Oracle Financial Services Applications (component: Security (Apache Commons IO)). Supported versions that are affected are 2.3.0-2.4.1, 2.6.2 and 2.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Platform accessible data as well as unauthorized read access to a subset of Oracle Banking Platform accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-9178V-2.3.0-2.4.1 P-9178V-2.6.2 P-9178V-2.7.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Banking Platform Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-9178V-2.3.0-2.4.1 P-9178V-2.6.2 P-9178V-2.7.1 Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Content Acquisition System (Apache Commons IO)). The supported version that is affected is 11.3.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-9633V-11.3.2 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Commerce Guided Search / Oracle Commerce Experience Manager Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832419.1 P-9633V-11.3.2 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Charging Controller (Apache Commons IO)). The supported version that is affected is 12.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications BRM - Elastic Charging Engine accessible data as well as unauthorized read access to a subset of Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-9742V-12.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Communications BRM - Elastic Charging Engine Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-9742V-12.0 Vulnerability in the Oracle Communications Cloud Native Core Network Repository Function product of Oracle Communications (component: NRF (Apache Commons IO)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Network Repository Function. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Network Repository Function accessible data as well as unauthorized read access to a subset of Oracle Communications Cloud Native Core Network Repository Function accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-14118V-1.14.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Communications Cloud Native Core Network Repository Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833598.1 P-14118V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: UDR (Apache Commons IO)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Unified Data Repository accessible data as well as unauthorized read access to a subset of Oracle Communications Cloud Native Core Unified Data Repository accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-14119V-1.14.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Communications Cloud Native Core Unified Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833596.1 P-14119V-1.14.0 Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Convergence Server (Apache Commons IO)). The supported version that is affected is 3.0.2.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Convergence accessible data as well as unauthorized read access to a subset of Oracle Communications Convergence accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-8501V-3.0.2.2.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Communications Convergence Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-8501V-3.0.2.2.0 Vulnerability in the Oracle Communications Offline Mediation Controller product of Oracle Communications Applications (component: Installation (Apache Commons IO)). The supported version that is affected is 12.0.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Offline Mediation Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Offline Mediation Controller accessible data as well as unauthorized read access to a subset of Oracle Communications Offline Mediation Controller accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-2269V-12.0.0.3 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Communications Offline Mediation Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2269V-12.0.0.3 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Apache Commons IO)). Supported versions that are affected are 8.0.7-8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Analytical Applications Infrastructure accessible data as well as unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-5680V-8.0.7-8.1.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Financial Services Analytical Applications Infrastructure Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825591.1 P-5680V-8.0.7-8.1.1 Vulnerability in the Oracle Financial Services Model Management and Governance product of Oracle Financial Services Applications (component: Installer & Configuration (Apache Commons IO)). Supported versions that are affected are 8.0.8, 8.1.0 and 8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Model Management and Governance. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Model Management and Governance accessible data as well as unauthorized read access to a subset of Oracle Financial Services Model Management and Governance accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-14276V-8.0.8 P-14276V-8.1.0 P-14276V-8.1.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Financial Services Model Management and Governance Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825611.1 P-14276V-8.0.8 P-14276V-8.1.0 P-14276V-8.1.1 Vulnerability in the Oracle Fusion Middleware MapViewer product of Oracle Fusion Middleware (component: Install (Apache Commons IO)). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Fusion Middleware MapViewer accessible data as well as unauthorized read access to a subset of Oracle Fusion Middleware MapViewer accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-1215V-12.2.1.4.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Fusion Middleware MapViewer Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1215V-12.2.1.4.0 Security-in-Depth issue in Oracle Graph Server and Client (component: Packaging/Install (Apache Commons IO)). This vulnerability cannot be exploited in the context of this product. Security patch has been released CVE-2021-29425 P-14069V-All Supported Versions 0.0 Graph Server and Client Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-14069V-All Supported Versions Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant (Apache Commons IO)). The supported version that is affected is Prior to 2.12.42. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of OSS Support Tools accessible data as well as unauthorized read access to a subset of OSS Support Tools accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-1330V-Prior to 2.12.42 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N OSS Support Tools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833277.1 P-1330V-Prior to 2.12.42 Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache Commons IO)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-10354V-17.7-17.12 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Primavera Unifier Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10354V-17.7-17.12 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 Vulnerability in the Oracle Retail Assortment Planning product of Oracle Retail Applications (component: Application Core (Apache Commons IO)). The supported version that is affected is 16.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Assortment Planning. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Assortment Planning accessible data as well as unauthorized read access to a subset of Oracle Retail Assortment Planning accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-1788V-16.0.3 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Retail Assortment Planning Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1788V-16.0.3 Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal (Apache Commons IO)). Supported versions that are affected are 14.1.3.2, 15.0.3.1, 16.0.3 and 19.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Integration Bus. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Integration Bus accessible data as well as unauthorized read access to a subset of Oracle Retail Integration Bus accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-1807V-14.1.3.2 P-1807V-15.0.3.1 P-1807V-16.0.3 P-1807V-19.0.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Retail Integration Bus Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1807V-14.1.3.2 P-1807V-15.0.3.1 P-1807V-16.0.3 P-1807V-19.0.1 Vulnerability in the Oracle Retail Order Broker product of Oracle Retail Applications (component: System Administration (Apache Commons IO)). Supported versions that are affected are 16.0, 18.0 and 19.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Order Broker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Order Broker accessible data as well as unauthorized read access to a subset of Oracle Retail Order Broker accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-11520V-16.0 P-11520V-18.0 P-11520V-19.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Retail Order Broker Cloud Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-11520V-16.0 P-11520V-18.0 P-11520V-19.1 Vulnerability in the Oracle Retail Service Backbone product of Oracle Retail Applications (component: RSB Installation (Apache Commons IO)). Supported versions that are affected are 15.0.3.1, 16.0.3 and 19.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Service Backbone. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Service Backbone accessible data as well as unauthorized read access to a subset of Oracle Retail Service Backbone accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-10867V-15.0.3.1 P-10867V-16.0.3 P-10867V-19.0.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Retail Service Backbone Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-10867V-15.0.3.1 P-10867V-16.0.3 P-10867V-19.0.1 Vulnerability in the Oracle Retail Size Profile Optimization product of Oracle Retail Applications (component: Application Core (Apache Commons IO)). The supported version that is affected is 16.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Size Profile Optimization. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Size Profile Optimization accessible data as well as unauthorized read access to a subset of Oracle Retail Size Profile Optimization accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-4670V-16.0.3 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Retail Size Profile Optimization Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-4670V-16.0.3 Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (Apache Commons IO)). The supported version that is affected is 6.0.0.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Testing Accelerator. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Testing Accelerator accessible data as well as unauthorized read access to a subset of Oracle Utilities Testing Accelerator accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-13784V-6.0.0.1.1 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Third Party Tools (Apache Commons IO)). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2021-29425 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications Applications (component: Rulesets (XStream)). Supported versions that are affected are 7.3.4, 7.3.5, 7.4.0, 7.4.1 and 7.4.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-29505 P-4516V-7.3.4 P-4516V-7.3.5 P-4516V-7.4.0 P-4516V-7.4.1 P-4516V-7.4.2 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Unified Inventory Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831889.1 P-4516V-7.3.4 P-4516V-7.3.5 P-4516V-7.4.0 P-4516V-7.4.1 P-4516V-7.4.2 Vulnerability in the Oracle Communications Cloud Native Core Automated Test Suite product of Oracle Communications (component: ATS Framework (Python)). The supported version that is affected is 1.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Automated Test Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Automated Test Suite accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2021-29921 P-14488V-1.8.0 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N Communications Cloud Native Core Automated Test Suite Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833620.1 P-14488V-1.8.0 Vulnerability in Oracle TimesTen In-Memory Database (component: EM TimesTen plug-in (Go)). The supported version that is affected is Prior to 21.1.1.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2021-29923 P-1870V-Prior to 21.1.1.1.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N TimesTen In-Memory Database Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1870V-Prior to 21.1.1.1.0 Vulnerability in Oracle TimesTen In-Memory Database (component: Install (Go)). The supported version that is affected is Prior to 21.1.1.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Security patch has been released CVE-2021-29923 P-1870V-Prior to 21.1.1.1.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N TimesTen In-Memory Database Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1870V-Prior to 21.1.1.1.0 Vulnerability in the Big Data Spatial and Graph product of Oracle Big Data Graph (component: Big Data Graph (Apache Tomcat)). The supported version that is affected is Prior to 23.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Big Data Spatial and Graph. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Big Data Spatial and Graph accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-30639 P-11528V-Prior to 23.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Big Data Spatial and Graph Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-11528V-Prior to 23.1 Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Networking (Python)). The supported version that is affected is 12.4.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops Center. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-3177 P-9835V-12.4.0.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Enterprise Manager Ops Center Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-9835V-12.4.0.0 Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Security (Apache PDFbox)). The supported version that is affected is 18.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Retail Customer Management and Segmentation Foundation executes to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Customer Management and Segmentation Foundation. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-31812 P-13388V-18.1 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Retail Customer Management and Segmentation Foundation Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-13388V-18.1 Vulnerability in Oracle REST Data Services (component: General (SheetJS)). The supported version that is affected is Prior to 21.2.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle REST Data Services executes to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Security patch has been released CVE-2021-32014 P-9456V-Prior to 21.2.4 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L REST Data Services Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-9456V-Prior to 21.2.4 Vulnerability in the Oracle Application Express (Prism) component of Oracle Database Server. The supported version that is affected is Prior to 21.1.4. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express (Prism). Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Express (Prism). CVSS 3.1 Base Score 3.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L). Security patch has been released CVE-2021-32723 P-1348V-Prior to 21.1.4 3.5 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L Application Express (APEX) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1348V-Prior to 21.1.4 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Policy (MockServer)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Cloud Native Core Policy, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-32827 P-14277V-1.14.0 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security (Apache Tomcat)). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2021-33037 P-4461V-9.3.6 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Agile PLM Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-4461V-9.3.6 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (Apache Tomcat)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Service Communication Proxy accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2021-33037 P-14117V-1.14.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in Oracle Graph Server and Client (component: Packaging/Install (Apache Tomcat)). The supported version that is affected is Prior to 21.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Graph Server and Client. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Graph Server and Client accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2021-33037 P-14069V-Prior to 21.4 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Graph Server and Client Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-14069V-Prior to 21.4 Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (Apache Tomcat)). Supported versions that are affected are 6.0.0.1.1, 6.0.0.2.2 and 6.0.0.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Testing Accelerator. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Testing Accelerator accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2021-33037 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP (glibc)). The supported version that is affected is 1.5.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-3326 P-14123V-1.5.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Security Edge Protection Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833594.1 P-14123V-1.5.0 Vulnerability in the Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers product of Oracle Systems (component: XCP Firmware (glibc)). Supported versions that are affected are Prior to XCP2410 and prior to XCP3110. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-3326 P-10656V-Prior to XCP2410 P-10656V-prior to XCP3110 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Fujitsu SPARC Servers Firmware Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10656V-Prior to XCP2410 P-10656V-prior to XCP3110 Vulnerability in the Oracle Communications Cloud Native Core Network Function Cloud Native Environment product of Oracle Communications (component: Configuration (libgcrypt)). The supported version that is affected is 1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications Cloud Native Core Network Function Cloud Native Environment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Network Function Cloud Native Environment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-33560 P-14125V-1.9.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Cloud Native Core Network Function Cloud Native Environment Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833600.1 P-14125V-1.9.0 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP (aaugustin websockets)). The supported version that is affected is 1.5.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-33880 P-14123V-1.5.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Cloud Native Core Security Edge Protection Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833594.1 P-14123V-1.5.0 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (aaugustin websockets)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Service Communication Proxy accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-33880 P-14117V-1.14.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: UDR (aaugustin websockets)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Unified Data Repository accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-33880 P-14119V-1.14.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Cloud Native Core Unified Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833596.1 P-14119V-1.14.0 Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Core (Kernel)). Supported versions that are affected are 8.2, 8.3, 8.4 and 9.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Session Border Controller executes to compromise Oracle Communications Session Border Controller. Successful attacks of this vulnerability can result in takeover of Oracle Communications Session Border Controller. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-33909 P-10750V-8.2 P-10750V-8.3 P-10750V-8.4 P-10750V-9.0 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Session Border Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833085.1 P-10750V-8.2 P-10750V-8.3 P-10750V-8.4 P-10750V-9.0 Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Binding Support Function (Python)). The supported version that is affected is 1.10.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Communications Cloud Native Core Binding Support Function executes to compromise Oracle Communications Cloud Native Core Binding Support Function. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Binding Support Function accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-3426 P-14121V-1.10.0 5.7 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Communications Cloud Native Core Binding Support Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833618.1 P-14121V-1.10.0 Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Binding Support Function (Eclipse Jetty)). The supported version that is affected is 1.10.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications Cloud Native Core Binding Support Function. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Cloud Native Core Binding Support Function accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-34429 P-14121V-1.10.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Communications Cloud Native Core Binding Support Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833618.1 P-14121V-1.10.0 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP (Eclipse Jetty)). The supported version that is affected is 1.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-34429 P-14123V-1.5.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Communications Cloud Native Core Security Edge Protection Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833594.1 P-14123V-1.5.0 Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (Eclipse Jetty)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Cloud Native Core Service Communication Proxy accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-34429 P-14117V-1.14.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: UDR (Eclipse Jetty)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Cloud Native Core Unified Data Repository accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-34429 P-14119V-1.14.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Communications Cloud Native Core Unified Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833596.1 P-14119V-1.14.0 Vulnerability in the Oracle Communications Diameter Signaling Router product of Oracle Communications (component: API Gateway (Eclipse Jetty)). Supported versions that are affected are 8.0.0.0-8.5.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Diameter Signaling Router. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Diameter Signaling Router accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-34429 P-10899V-8.0.0.0-8.5.0.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Communications Diameter Signaling Router (DSR) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833215.1 P-10899V-8.0.0.0-8.5.0.2 Vulnerability in the Oracle Communications Cloud Native Core Network Function Cloud Native Environment product of Oracle Communications (component: Configuration (dnsmasq)). The supported version that is affected is 1.9.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications Cloud Native Core Network Function Cloud Native Environment. While the vulnerability is in Oracle Communications Cloud Native Core Network Function Cloud Native Environment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Network Function Cloud Native Environment accessible data. CVSS 3.1 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N). Security patch has been released CVE-2021-3448 P-14125V-1.9.0 4.0 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N Communications Cloud Native Core Network Function Cloud Native Environment Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833600.1 P-14125V-1.9.0 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security (AntiSamy)). The supported version that is affected is 9.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-35043 P-4461V-9.3.3 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Agile PLM Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-4461V-9.3.3 Vulnerability in the Oracle Banking Enterprise Default Management product of Oracle Financial Services Applications (component: Collections (AntiSamy)). The supported version that is affected is 2.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Enterprise Default Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Enterprise Default Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Enterprise Default Management accessible data as well as unauthorized read access to a subset of Oracle Banking Enterprise Default Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-35043 P-13390V-2.7.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Banking Enterprise Default Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13390V-2.7.0 Vulnerability in the Oracle Banking Party Management product of Oracle Financial Services Applications (component: Web UI (AntiSamy)). The supported version that is affected is 2.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Party Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Party Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Party Management accessible data as well as unauthorized read access to a subset of Oracle Banking Party Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-35043 P-13929V-2.7.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Banking Party Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13929V-2.7.0 Vulnerability in the Oracle Banking Platform product of Oracle Financial Services Applications (component: SECURITY (AntiSamy)). The supported version that is affected is 2.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Platform accessible data as well as unauthorized read access to a subset of Oracle Banking Platform accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-35043 P-9178V-2.7.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Banking Platform Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-9178V-2.7.0 Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Operating System Image). The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit as well as unauthorized update, insert or delete access to some of Oracle ZFS Storage Appliance Kit accessible data and unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). Security patch has been released CVE-2021-3517 P-10026V-8.8 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Sun ZFS Storage Appliance Kit (AK) Software Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10026V-8.8 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-35587 P-5565V-11.1.2.3.0 P-5565V-12.2.1.3.0 P-5565V-12.2.1.4.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Access Manager Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5565V-11.1.2.3.0 P-5565V-12.2.1.3.0 P-5565V-12.2.1.4.0 Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported version that is affected is Prior to 11.1.2.4.047. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase Administration Services. While the vulnerability is in Oracle Essbase Administration Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase Administration Services. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-35683 P-4380V-Prior to 11.1.2.4.047 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Hyperion Essbase Administration Services Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-4380V-Prior to 11.1.2.4.047 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Unified Metadata Manager). Supported versions that are affected are 8.0.7-8.1.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-35686 P-5680V-8.0.7-8.1.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Financial Services Analytical Applications Infrastructure Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825591.1 P-5680V-8.0.7-8.1.1 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Unified Metadata Manager). Supported versions that are affected are 8.0.7-8.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2021-35687 P-5680V-8.0.7-8.1.1 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Financial Services Analytical Applications Infrastructure Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825591.1 P-5680V-8.0.7-8.1.1 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (Apache Commons Compress)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking APIs. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking APIs. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Framework (Apache Commons Compress)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Digital Experience. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking Digital Experience. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Banking Digital Experience Oracle customers with valid support contracts https://support.oracle.com P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 Vulnerability in the Oracle Banking Enterprise Default Management product of Oracle Financial Services Applications (component: Collections (Apache Commons Compress)). The supported version that is affected is 2.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Enterprise Default Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking Enterprise Default Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-13390V-2.7.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Banking Enterprise Default Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13390V-2.7.0 Vulnerability in the Oracle Banking Party Management product of Oracle Financial Services Applications (component: Web UI (Apache Commons Compress)). The supported version that is affected is 2.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Party Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking Party Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-13929V-2.7.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Banking Party Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13929V-2.7.0 Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Installer (Apache Commons Compress)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Process Management Suite. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-5325V-12.2.1.3.0 P-5325V-12.2.1.4.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Business Process Management Suite Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5325V-12.2.1.3.0 P-5325V-12.2.1.4.0 Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Content Acquisition System (Apache Commons Compress)). The supported version that is affected is 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-9633V-11.3.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Commerce Guided Search / Oracle Commerce Experience Manager Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832419.1 P-9633V-11.3.2 Security-in-Depth issue in the Oracle Communications Cloud Native Core Network Repository Function product of Oracle Communications (component: NRF (Apache Commons Compress)). This vulnerability cannot be exploited in the context of this product. Security patch has been released CVE-2021-36090 P-14118V-All Supported Versions 0.0 Communications Cloud Native Core Network Repository Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833598.1 P-14118V-All Supported Versions Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: SCP (Apache Commons Compress)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Service Communication Proxy. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-14117V-1.14.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Service Communication Proxy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833601.1 P-14117V-1.14.0 Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: UDR (Apache Commons Compress)). The supported version that is affected is 1.14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Unified Data Repository. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-14119V-1.14.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Unified Data Repository Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833596.1 P-14119V-1.14.0 Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications Applications (component: Inventory Organizer (Apache Commons Compress)). Supported versions that are affected are 7.4.0, 7.4.1, 7.4.2 and 7.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-4516V-7.4.0 P-4516V-7.4.1 P-4516V-7.4.2 P-4516V-7.5.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Unified Inventory Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831889.1 P-4516V-7.4.0 P-4516V-7.4.1 P-4516V-7.4.2 P-4516V-7.5.0 Security-in-Depth issue in the Oracle Database Configuration Assistant (Apache Commons Compress) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product. Security patch has been released CVE-2021-36090 P-383V-All Supported Versions 0.0 Database Configuration Assistant Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-383V-All Supported Versions Security-in-Depth issue in Oracle Essbase (component: Infrastructure (Apache Commons Compress)). This vulnerability cannot be exploited in the context of this product. Security patch has been released CVE-2021-36090 P-4379V-All Supported Versions 0.0 Hyperion Essbase Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-4379V-All Supported Versions Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (Apache Commons Compress)). Supported versions that are affected are 6.0.0.1.1, 6.0.0.2.2 and 6.0.0.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Testing Accelerator. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Testing Accelerator. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36090 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 Vulnerability in the MySQL Workbench product of Oracle MySQL (component: Workbench: libssh). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via MySQL Workbench to compromise MySQL Workbench. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Workbench. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-3634 P-4627V-8.0.27 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H MySQL Workbench Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-4627V-8.0.27 and prior Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security (Apache Ant)). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile PLM. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36374 P-4461V-9.3.6 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Agile PLM Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832006.1 P-4461V-9.3.6 Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications Applications (component: Build Tool (Apache Ant)). Supported versions that are affected are 7.3.0, 7.4.0, 7.4.1, 7.4.2 and 7.5.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36374 P-4516V-7.3.0 P-4516V-7.4.0 P-4516V-7.4.1 P-4516V-7.4.2 P-4516V-7.5.0 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Communications Unified Inventory Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831889.1 P-4516V-7.3.0 P-4516V-7.4.0 P-4516V-7.4.1 P-4516V-7.4.2 P-4516V-7.5.0 Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (Apache Ant)). The supported version that is affected is 6.0.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Utilities Testing Accelerator executes to compromise Oracle Utilities Testing Accelerator. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Testing Accelerator. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-36374 P-13784V-6.0.0.1.1 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 Vulnerability in Oracle Essbase (component: Infrastructure (OpenSSL)). Supported versions that are affected are Prior to 11.1.2.4.047 and Prior to 21.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-3711 P-4379V-Prior to 11.1.2.4.047 P-4379V-Prior to 21.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Hyperion Essbase Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-4379V-Prior to 11.1.2.4.047 P-4379V-Prior to 21.3 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++ (OpenSSL)). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H). Security patch has been released CVE-2021-3712 P-8576V-8.0.27 and prior 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H MySQL Connectors Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8576V-8.0.27 and prior Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC (OpenSSL)). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H). Security patch has been released CVE-2021-3712 P-8576V-8.0.27 and prior 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H MySQL Connectors Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8576V-8.0.27 and prior Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)). Supported versions that are affected are 8.57, 8.58 and 8.59. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H). Security patch has been released CVE-2021-3712 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in Oracle Secure Backup (component: Oracle Secure Backup (OpenSSL)). The supported version that is affected is Prior to 18.1.0.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Secure Backup accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 7.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H). Security patch has been released CVE-2021-3712 P-1522V-Prior to 18.1.0.1.0 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Secure Backup Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1522V-Prior to 18.1.0.1.0 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (Netty)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Banking APIs. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking APIs. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-37137 P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Framework (Netty)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Banking Digital Experience. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Banking Digital Experience. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-37137 P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Banking Digital Experience Oracle customers with valid support contracts https://support.oracle.com P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Content Acquisition System (Netty)). The supported version that is affected is 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-37137 P-9633V-11.3.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Commerce Guided Search / Oracle Commerce Experience Manager Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832419.1 P-9633V-11.3.2 Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Binding Support Function (Netty)). The supported version that is affected is 1.10.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications Cloud Native Core Binding Support Function. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Binding Support Function. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-37137 P-14121V-1.10.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Cloud Native Core Binding Support Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833618.1 P-14121V-1.10.0 Vulnerability in the Oracle Communications Diameter Signaling Router product of Oracle Communications (component: API Gateway (Netty)). Supported versions that are affected are 8.0.0.0-8.5.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Diameter Signaling Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Diameter Signaling Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-37137 P-10899V-8.0.0.0-8.5.0.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Diameter Signaling Router (DSR) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833215.1 P-10899V-8.0.0.0-8.5.0.2 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search (Netty)). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-37137 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in the Oracle Application Express (CKEditor) component of Oracle Database Server. The supported version that is affected is Prior to 21.1.4. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express (CKEditor). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express (CKEditor), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express (CKEditor) accessible data as well as unauthorized read access to a subset of Oracle Application Express (CKEditor) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-37695 P-1348V-Prior to 21.1.4 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Application Express (APEX) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1348V-Prior to 21.1.4 Vulnerability in the Oracle Banking Party Management product of Oracle Financial Services Applications (component: Web UI (CKEditor)). The supported version that is affected is 2.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Party Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Party Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Party Management accessible data as well as unauthorized read access to a subset of Oracle Banking Party Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-37695 P-13929V-2.7.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Banking Party Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2827842.1 P-13929V-2.7.0 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (CKEditor)). Supported versions that are affected are 8.0.7-8.1.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Analytical Applications Infrastructure, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Analytical Applications Infrastructure accessible data as well as unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-37695 P-5680V-8.0.7-8.1.1 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Financial Services Analytical Applications Infrastructure Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825591.1 P-5680V-8.0.7-8.1.1 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor (CKEditor)). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-37695 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in the Oracle Communications Messaging Server product of Oracle Communications Applications (component: ISC (jsoup)). The supported version that is affected is 8.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Messaging Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Messaging Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-37714 P-8496V-8.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Messaging Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-8496V-8.1 Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform,Data Parsing (jsoup)). Supported versions that are affected are 20.12 and 21.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-37714 P-10354V-20.12 P-10354V-21.12 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Primavera Unifier Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10354V-20.12 P-10354V-21.12 Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Event Streams and Communications (Apache Kafka)). Supported versions that are affected are 18.8, 19.12, 20.12 and 21.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2021-38153 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Primavera Unifier Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Updater (XStream)). Supported versions that are affected are 11.3 and 12.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-39139 P-9742V-11.3 P-9742V-12.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications BRM - Elastic Charging Engine Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-9742V-11.3 P-9742V-12.0 Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Binding Support Function (XStream)). The supported version that is affected is 1.10.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Binding Support Function. Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Binding Support Function. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-39139 P-14121V-1.10.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Communications Cloud Native Core Binding Support Function Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833618.1 P-14121V-1.10.0 Vulnerability in the Oracle Utilities Framework product of Oracle Utilities Applications (component: General (XStream)). Supported versions that are affected are 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 and 4.4.0.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Framework. Successful attacks of this vulnerability can result in takeover of Oracle Utilities Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-39139 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0-4.3.0.6.0 P-2245V-4.4.0.0.0 P-2245V-4.4.0.2.0 P-2245V-4.4.0.3.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Utilities Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0-4.3.0.6.0 P-2245V-4.4.0.0.0 P-2245V-4.4.0.2.0 P-2245V-4.4.0.3.0 Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (XStream)). The supported version that is affected is 6.0.0.1.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Testing Accelerator. Successful attacks of this vulnerability can result in takeover of Oracle Utilities Testing Accelerator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-39139 P-13784V-6.0.0.1.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Signaling (XStream)). The supported version that is affected is 1.14.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy. While the vulnerability is in Oracle Communications Cloud Native Core Policy, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Policy. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-39153 P-14277V-1.14.0 8.5 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Communications Cloud Native Core Policy Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833602.1 P-14277V-1.14.0 Vulnerability in the Oracle Business Activity Monitoring product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (XStream)). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Activity Monitoring. While the vulnerability is in Oracle Business Activity Monitoring, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Activity Monitoring. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-39154 P-1675V-12.2.1.4.0 8.5 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H BAM (Business Activity Monitoring) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1675V-12.2.1.4.0 Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module (Apache HTTP Server)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2021-40438 P-1042V-12.2.1.3.0 P-1042V-12.2.1.4.0 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H HTTP Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1042V-12.2.1.3.0 P-1042V-12.2.1.4.0 Vulnerability in the Oracle Retail Allocation product of Oracle Retail Applications (component: General (Apache Log4j)). Supported versions that are affected are 14.1.3.2, 15.0.3.1, 16.0.3 and 19.0.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Allocation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Allocation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-4104 P-1786V-14.1.3.2 P-1786V-15.0.3.1 P-1786V-16.0.3 P-1786V-19.0.1 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Retail Allocation Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1786V-14.1.3.2 P-1786V-15.0.3.1 P-1786V-16.0.3 P-1786V-19.0.1 Vulnerability in the Oracle Utilities Testing Accelerator product of Oracle Utilities Applications (component: Tools (Apache Log4j)). Supported versions that are affected are 6.0.0.1.1, 6.0.0.2.2 and 6.0.0.3.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Testing Accelerator. Successful attacks of this vulnerability can result in takeover of Oracle Utilities Testing Accelerator. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-4104 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Utilities Testing Accelerator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832617.1 P-13784V-6.0.0.1.1 P-13784V-6.0.0.2.2 P-13784V-6.0.0.3.1 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Apache Log4j)). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-4104 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Banking APIs product of Oracle Financial Services Applications (component: Framework (CKEditor)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking APIs. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking APIs, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking APIs accessible data as well as unauthorized read access to a subset of Oracle Banking APIs accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-41165 P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Banking APIs Oracle customers with valid support contracts https://support.oracle.com P-13676V-18.1-18.3 P-13676V-19.1 P-13676V-19.2 P-13676V-20.1 P-13676V-21.1 Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Framework (CKEditor)). Supported versions that are affected are 18.1-18.3, 19.1, 19.2, 20.1 and 21.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Digital Experience. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Digital Experience, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Digital Experience accessible data as well as unauthorized read access to a subset of Oracle Banking Digital Experience accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2021-41165 P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Banking Digital Experience Oracle customers with valid support contracts https://support.oracle.com P-12605V-18.1-18.3 P-12605V-19.1 P-12605V-19.2 P-12605V-20.1 P-12605V-21.1 Vulnerability in the Oracle Communications Diameter Signaling Router product of Oracle Communications (component: Platform (Apache Tomcat)). Supported versions that are affected are 8.0.0.0-8.5.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Diameter Signaling Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Diameter Signaling Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-42340 P-10899V-8.0.0.0-8.5.0.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Diameter Signaling Router (DSR) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833215.1 P-10899V-8.0.0.0-8.5.0.2 Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System product of Oracle Hospitality Applications (component: Next-Gen SPMS (Apache Tomcat)). The supported version that is affected is 20.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Cruise Shipboard Property Management System. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-42340 P-11607V-20.1.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Hospitality Cruise Shipboard Property Management System Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2824526.1 P-11607V-20.1.0 Vulnerability in the Oracle SD-WAN Edge product of Oracle Communications (component: Management (Apache Tomcat)). Supported versions that are affected are 9.0 and 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SD-WAN Edge. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SD-WAN Edge. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-42340 P-13940V-9.0 P-13940V-9.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H SD-WAN Edge Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833604.1 P-13940V-9.0 P-13940V-9.1 Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform, Data Persistence (OWASP Java HTML Sanitizer)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera Unifier. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-42575 P-10354V-17.7-17.12 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Primavera Unifier Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10354V-17.7-17.12 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). Supported versions that are affected are 11 and 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Security patch has been released CVE-2021-43395 P-10006V-11 P-10006V-10 6.5 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Solaris Operating System Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10006V-11 P-10006V-10 Vulnerability in the Instantis EnterpriseTrack product of Oracle Construction and Engineering (component: Core (Apache HTTP Server)). Supported versions that are affected are 17.1, 17.2 and 17.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Instantis EnterpriseTrack. Successful attacks of this vulnerability can result in takeover of Instantis EnterpriseTrack. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44790 P-10563V-17.1 P-10563V-17.2 P-10563V-17.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Instantis EnterpriseTrack Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10563V-17.1 P-10563V-17.2 P-10563V-17.3 Vulnerability in the Oracle Communications Diameter Signaling Router product of Oracle Communications (component: Virtual Network Function Manager, API Gateway (Apache Log4j)). Supported versions that are affected are 8.3.0.0-8.5.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Diameter Signaling Router. Successful attacks of this vulnerability can result in takeover of Oracle Communications Diameter Signaling Router. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-10899V-8.3.0.0-8.5.1.0 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Communications Diameter Signaling Router (DSR) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833215.1 P-10899V-8.3.0.0-8.5.1.0 Vulnerability in the Oracle Communications Interactive Session Recorder product of Oracle Communications (component: RSS (Apache Log4j)). Supported versions that are affected are 6.3 and 6.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Interactive Session Recorder. Successful attacks of this vulnerability can result in takeover of Oracle Communications Interactive Session Recorder. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-10765V-6.3 P-10765V-6.4 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Communications Interactive Session Recorder Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833605.1 P-10765V-6.3 P-10765V-6.4 Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Apache Log4j)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.13, 19.12.0-19.12.12, 20.12.0-20.12.7 and 21.12.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-10605V-17.12.0-17.12.11 P-10605V-18.8.0-18.8.13 P-10605V-19.12.0-19.12.12 P-10605V-20.12.0-20.12.7 P-10605V-21.12.0 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Primavera Gateway Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10605V-17.12.0-17.12.11 P-10605V-18.8.0-18.8.13 P-10605V-19.12.0-19.12.12 P-10605V-20.12.0-20.12.7 P-10605V-21.12.0 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access (Apache Log4j)). Supported versions that are affected are 19.12.0.0-19.12.18.0, 20.12.0.0-20.12.12.0 and 21.12.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in takeover of Primavera P6 Enterprise Project Portfolio Management. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-5579V-19.12.0.0-19.12.18.0 P-5579V-20.12.0.0-20.12.12.0 P-5579V-21.12.0.0 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Primavera P6 Enterprise Project Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5579V-19.12.0.0-19.12.18.0 P-5579V-20.12.0.0-20.12.12.0 P-5579V-21.12.0.0 Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging (Apache Log4j)). Supported versions that are affected are 18.8, 19.12, 20.12 and 21.12. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera Unifier. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Primavera Unifier Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10354V-18.8 P-10354V-19.12 P-10354V-20.12 P-10354V-21.12 Vulnerability in the Oracle Retail Assortment Planning product of Oracle Retail Applications (component: Application Core (Apache Log4j)). The supported version that is affected is 16.0.3. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Retail Assortment Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Assortment Planning. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-1788V-16.0.3 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Retail Assortment Planning Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1788V-16.0.3 Vulnerability in the Oracle Retail Fiscal Management product of Oracle Retail Applications (component: NF Issuing (Apache Log4j)). The supported version that is affected is 14.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Retail Fiscal Management. Successful attacks of this vulnerability can result in takeover of Oracle Retail Fiscal Management. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-9038V-14.2 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Retail Fiscal Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-9038V-14.2 Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: Enterprise Cache (Apache Log4j)). Supported versions that are affected are 21.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in takeover of Siebel UI Framework. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-9011V-21.12 and prior 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Siebel UI Framework Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832003.1 P-9011V-21.12 and prior Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2021-44832 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server (Apache Log4j)). The supported version that is affected is 5.5.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-2025V-5.5.0.0.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Business Intelligence Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-2025V-5.5.0.0.0 Vulnerability in the Oracle Communications Service Broker product of Oracle Communications (component: Integration (Apache Log4j)). The supported version that is affected is 6.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Service Broker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Service Broker. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-8565V-6.2 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Service Broker Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833617.1 P-8565V-6.2 Vulnerability in the Oracle Communications Services Gatekeeper product of Oracle Communications (component: API Portal (Apache Log4j)). The supported version that is affected is 7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Services Gatekeeper. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Services Gatekeeper. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-5381V-7.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Communications Services Gatekeeper Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833211.1 P-5381V-7.0 Vulnerability in the Oracle Communications WebRTC Session Controller product of Oracle Communications (component: Signaling Engine, Media Engine (Apache Log4j)). Supported versions that are affected are 7.2.0 and 7.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications WebRTC Session Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications WebRTC Session Controller. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-10811V-7.2.0 P-10811V-7.2.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Communications WebRTC Session Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833614.1 P-10811V-7.2.0 P-10811V-7.2.1 Security-in-Depth issue in the Trace file analyzer (Apache Log4j) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product. Security patch has been released CVE-2021-45105 P-10655V-All Supported Versions 0.0 Engineered Systems Utilities Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-10655V-All Supported Versions Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Apache Log4j)). Supported versions that are affected are 8.0.7-8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Financial Services Analytical Applications Infrastructure. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-5680V-8.0.7-8.1.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Financial Services Analytical Applications Infrastructure Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825591.1 P-5680V-8.0.7-8.1.1 Vulnerability in the Oracle Financial Services Model Management and Governance product of Oracle Financial Services Applications (component: Installer & Configuration (Apache Log4j)). Supported versions that are affected are 8.0.8, 8.1.0 and 8.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Model Management and Governance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Financial Services Model Management and Governance. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-14276V-8.0.8 P-14276V-8.1.0 P-14276V-8.1.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Financial Services Model Management and Governance Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2825611.1 P-14276V-8.0.8 P-14276V-8.1.0 P-14276V-8.1.1 Vulnerability in the Instantis EnterpriseTrack product of Oracle Construction and Engineering (component: Logging (Apache Log4j)). Supported versions that are affected are 17.1, 17.2 and 17.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Instantis EnterpriseTrack. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Instantis EnterpriseTrack. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-10563V-17.1 P-10563V-17.2 P-10563V-17.3 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Instantis EnterpriseTrack Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-10563V-17.1 P-10563V-17.2 P-10563V-17.3 Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Managed File Transfer. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Managed File Transfer. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-10198V-12.2.1.3.0 P-10198V-12.2.1.4.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Managed File Transfer Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-10198V-12.2.1.3.0 P-10198V-12.2.1.4.0 Vulnerability in the Oracle Retail Back Office product of Oracle Retail Applications (component: Security (Apache Log4j)). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Back Office. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Back Office. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-2013V-14.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Back Office Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-2013V-14.1 Vulnerability in the Oracle Retail Central Office product of Oracle Retail Applications (component: Security (Apache Log4j)). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Central Office. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Central Office. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-2016V-14.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Central Office Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-2016V-14.1 Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Installation (Apache Log4j)). Supported versions that are affected are 16.0.3, 17.0.2, 18.0.1, 19.0.1 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail EFTLink. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail EFTLink. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-11516V-16.0.3 P-11516V-17.0.2 P-11516V-18.0.1 P-11516V-19.0.1 P-11516V-20.0.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail EFTLink Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-11516V-16.0.3 P-11516V-17.0.2 P-11516V-18.0.1 P-11516V-19.0.1 P-11516V-20.0.1 Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal (Apache Log4j)). Supported versions that are affected are 14.1.3.0, 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0 and 19.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Integration Bus. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Integration Bus. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-1807V-14.1.3.0 P-1807V-14.1.3.2 P-1807V-15.0.3.1 P-1807V-16.0.1-16.0.3 P-1807V-19.0.0 P-1807V-19.0.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Integration Bus Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1807V-14.1.3.0 P-1807V-14.1.3.2 P-1807V-15.0.3.1 P-1807V-16.0.1-16.0.3 P-1807V-19.0.0 P-1807V-19.0.1 Vulnerability in the Oracle Retail Invoice Matching product of Oracle Retail Applications (component: Security (Apache Log4j)). Supported versions that are affected are 15.0.3 and 16.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Invoice Matching. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Invoice Matching. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-1810V-15.0.3 P-1810V-16.0.3 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Invoice Matching Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1810V-15.0.3 P-1810V-16.0.3 Vulnerability in the Oracle Retail Order Broker product of Oracle Retail Applications (component: System Administration (Apache Log4j)). Supported versions that are affected are 16.0, 18.0 and 19.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Order Broker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Order Broker. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-11520V-16.0 P-11520V-18.0 P-11520V-19.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Order Broker Cloud Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-11520V-16.0 P-11520V-18.0 P-11520V-19.1 Vulnerability in the Oracle Retail Order Management System product of Oracle Retail Applications (component: Upgrade Install (Apache Log4j)). The supported version that is affected is 19.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Order Management System. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Order Management System. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-11519V-19.5 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Order Management System Cloud Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-11519V-19.5 Vulnerability in the Oracle Retail Point-of-Service product of Oracle Retail Applications (component: Administration (Apache Log4j)). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Point-of-Service. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Point-of-Service. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-2017V-14.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Point-of-Service Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-2017V-14.1 Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Apache Log4j)). Supported versions that are affected are 14.1.3.46, 15.0.3.115 and 16.0.3.240. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Predictive Application Server. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-1823V-14.1.3.46 P-1823V-15.0.3.115 P-1823V-16.0.3.240 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Predictive Application Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1823V-14.1.3.46 P-1823V-15.0.3.115 P-1823V-16.0.3.240 Vulnerability in the Oracle Retail Price Management product of Oracle Retail Applications (component: Security (Apache Log4j)). Supported versions that are affected are 13.2, 14.0.4, 14.1.3, 15.0.3 and 16.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Price Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Price Management. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-1824V-13.2 P-1824V-14.0.4 P-1824V-14.1.3 P-1824V-15.0.3 P-1824V-16.0.3 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Price Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-1824V-13.2 P-1824V-14.0.4 P-1824V-14.1.3 P-1824V-15.0.3 P-1824V-16.0.3 Vulnerability in the Oracle Retail Returns Management product of Oracle Retail Applications (component: Security (Apache Log4j)). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Returns Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Returns Management. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-2020V-14.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Returns Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-2020V-14.1 Vulnerability in the Oracle Retail Service Backbone product of Oracle Retail Applications (component: RSB Installation (Apache Log4j)). Supported versions that are affected are 14.1.3.0, 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0 and 19.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Service Backbone. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Service Backbone. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-10867V-14.1.3.0 P-10867V-14.1.3.2 P-10867V-15.0.3.1 P-10867V-16.0.1-16.0.3 P-10867V-19.0.0 P-10867V-19.0.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Retail Service Backbone Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2826068.1 P-10867V-14.1.3.0 P-10867V-14.1.3.2 P-10867V-15.0.3.1 P-10867V-16.0.1-16.0.3 P-10867V-19.0.0 P-10867V-19.0.1 Security-in-Depth issue in the Oracle Spatial and Graph (Apache Log4j) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product. Security patch has been released CVE-2021-45105 P-619V-All Supported Versions 0.0 Spatial and Graph Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-619V-All Supported Versions Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Portal. Note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2021-45105 P-1696V-12.2.1.3.0 P-1696V-12.2.1.4.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H WebCenter Portal Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1696V-12.2.1.3.0 P-1696V-12.2.1.4.0 Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0 and 20.0.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21242 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Primavera Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0 and 20.0.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Portfolio Management. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21243 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Primavera Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0 and 20.0.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Security patch has been released CVE-2022-21244 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Primavera Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2022-21245 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21246 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2022-21247 P-5V-12.2.0.1 P-5V-19c 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Database - Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5V-12.2.0.1 P-5V-19c Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2022-21248 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21249 P-8478V-8.0.27 and prior 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: GL Accounts). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Trade Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Security patch has been released CVE-2022-21250 P-765V-12.2.3-12.2.11 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Trade Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-765V-12.2.3-12.2.11 Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Instance Main). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Installed Base. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21251 P-1118V-12.2.3-12.2.11 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Installed Base Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-1118V-12.2.3-12.2.11 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Security patch has been released CVE-2022-21252 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21253 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21254 P-8478V-8.0.27 and prior 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: UI Servlet). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Configurator accessible data as well as unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Security patch has been released CVE-2022-21255 P-31V-12.2.3-12.2.11 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Configurator Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-31V-12.2.3-12.2.11 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21256 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21257 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21258 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-14.1.1.0.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21259 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21260 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21261 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21262 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Fault Management Architecture). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data as well as unauthorized read access to a subset of Oracle Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.1 Base Score 4.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L). Security patch has been released CVE-2022-21263 P-10006V-11 4.8 AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Solaris Operating System Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10006V-11 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21264 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L). Security patch has been released CVE-2022-21265 P-8478V-8.0.27 and prior 3.8 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Pipeline Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2022-21266 P-2136V-12.0.0.3 P-2136V-12.0.0.4 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Communications Billing and Revenue Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2136V-12.0.0.3 P-2136V-12.0.0.4 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Pipeline Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2022-21267 P-2136V-12.0.0.3 P-2136V-12.0.0.4 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Communications Billing and Revenue Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2136V-12.0.0.3 P-2136V-12.0.0.4 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Pipeline Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2022-21268 P-2136V-12.0.0.3 P-2136V-12.0.0.4 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Communications Billing and Revenue Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2136V-12.0.0.3 P-2136V-12.0.0.4 Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0 and 20.0.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21269 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Primavera Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21270 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21271 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21271 P-10006V-11 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Solaris Operating System Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10006V-11 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21272 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite (component: Expenses, Currency Override). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Costing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Costing accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Costing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Security patch has been released CVE-2022-21273 P-1287V-12.2.3-12.2.11 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Project Costing Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-1287V-12.2.3-12.2.11 Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Intelligence, RFx Creation). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sourcing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sourcing accessible data as well as unauthorized access to critical data or complete access to all Oracle Sourcing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Security patch has been released CVE-2022-21274 P-1273V-12.2.3-12.2.11 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Sourcing Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-1273V-12.2.3-12.2.11 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. While the vulnerability is in Oracle Communications Billing and Revenue Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2022-21275 P-2136V-12.0.0.3 P-2136V-12.0.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Communications Billing and Revenue Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2136V-12.0.0.3 P-2136V-12.0.0.4 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. While the vulnerability is in Oracle Communications Billing and Revenue Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2022-21276 P-2136V-12.0.0.3 P-2136V-12.0.0.4 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Communications Billing and Revenue Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2136V-12.0.0.3 P-2136V-12.0.0.4 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21277 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2022-21278 P-8478V-8.0.26 and prior 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.26 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21279 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21280 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0 and 20.0.0.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21281 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 4.8 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Primavera Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 P-5584V-20.0.0.1 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2022-21282 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21283 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21284 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21285 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21286 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21287 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21288 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21289 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21290 P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-8.0.27 and prior Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2022-21291 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2022-21292 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21293 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21294 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). Security patch has been released CVE-2022-21295 P-8370V-Prior to 6.1.32 3.8 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N VM VirtualBox Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833279.1 P-8370V-Prior to 6.1.32 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2022-21296 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21297 P-8478V-8.0.26 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.26 and prior Vulnerability in the Oracle Solaris product of Oracle Systems (component: Install). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.1 Base Score 3.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L). Security patch has been released CVE-2022-21298 P-10006V-11 3.9 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L Solaris Operating System Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10006V-11 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21299 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the PeopleSoft Enterprise CS SA Integration Pack product of Oracle PeopleSoft (component: Snapshot Integration). Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS SA Integration Pack. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS SA Integration Pack accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2022-21300 P-5107V-9.0 P-5107V-9.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N PeopleSoft Enterprise CS SA Integration Pack Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5107V-9.0 P-5107V-9.2 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2022-21301 P-8478V-8.0.27 and prior 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21302 P-8478V-8.0.27 and prior 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21303 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21304 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Security patch has been released CVE-2022-21305 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21306 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21307 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21308 P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21309 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21310 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21311 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21312 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21313 P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21314 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21315 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21316 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21317 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21318 P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21319 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21320 P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21321 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21322 P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21323 P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21324 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21325 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21326 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21327 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21328 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21329 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21330 P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21331 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21332 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21333 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21334 P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21335 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21336 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21337 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: General Framework). The supported version that is affected is 3.0.2.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Convergence accessible data as well as unauthorized read access to a subset of Oracle Communications Convergence accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N). Security patch has been released CVE-2022-21338 P-8501V-3.0.2.2.0 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Communications Convergence Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831902.1 P-8501V-3.0.2.2.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21339 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21340 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21341 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21342 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21344 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.58 and 8.59. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2022-21345 P-5085V-8.58 P-5085V-8.59 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.58 P-5085V-8.59 Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2022-21346 P-1479V-5.5.0.0.0 P-1479V-12.2.1.3.0 P-1479V-12.2.1.4.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N BI Publisher (formerly XML Publisher) Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1479V-5.5.0.0.0 P-1479V-12.2.1.3.0 P-1479V-12.2.1.4.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Security patch has been released CVE-2022-21347 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21348 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21349 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Security patch has been released CVE-2022-21350 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2022-21351 P-8478V-8.0.27 and prior 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H). Security patch has been released CVE-2022-21352 P-8478V-8.0.26 and prior 5.9 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.26 and prior Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Security patch has been released CVE-2022-21353 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iStore accessible data as well as unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21354 P-384V-12.2.3-12.2.11 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N iStore Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-384V-12.2.3-12.2.11 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21355 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21356 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L). Security patch has been released CVE-2022-21357 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 2.9 AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21358 P-8478V-8.0.27 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Optimization Framework). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21359 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21360 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21361 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21362 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21363 P-8576V-8.0.27 and prior 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H MySQL Connectors Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8576V-8.0.27 and prior Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Weblogic). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2022-21364 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21365 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:7u321 P-856V-Oracle Java SE:8u311 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21366 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Java SE JDK and JRE Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2828114.1 P-856V-Oracle Java SE:11.0.13 P-856V-Oracle Java SE:17.01 P-14564V-Oracle GraalVM Enterprise Edition:20.3.4 P-14564V-Oracle GraalVM Enterprise Edition:21.3.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2022-21367 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-5.7.36 and prior P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Security patch has been released CVE-2022-21368 P-8478V-8.0.27 and prior 4.7 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21369 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N PeopleSoft Enterprise PT PeopleTools Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831970.1 P-5085V-8.57 P-5085V-8.58 P-5085V-8.59 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21370 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Security patch has been released CVE-2022-21371 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21372 P-8478V-8.0.27 and prior 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Reseller Locator). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Partner Management accessible data as well as unauthorized read access to a subset of Oracle Partner Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21373 P-1065V-12.2.3-12.2.11 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Partner Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2484000.1 P-1065V-12.2.3-12.2.11 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21374 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21375 P-10006V-11 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Solaris Operating System Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832878.1 P-10006V-11 Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2 and 20.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Security patch has been released CVE-2022-21376 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Primavera Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web API). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2 and 20.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Security patch has been released CVE-2022-21377 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Primavera Portfolio Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2829871.1 P-5584V-18.0.0.0-18.0.3.0 P-5584V-19.0.0.0-19.0.1.2 P-5584V-20.0.0.0 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Security patch has been released CVE-2022-21378 P-8478V-8.0.27 and prior 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Security patch has been released CVE-2022-21379 P-8478V-8.0.27 and prior 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H MySQL Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8478V-8.0.27 and prior Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21380 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior 6.3 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H MySQL Cluster Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832117.1 P-8479V-7.4.34 and prior P-8479V-7.5.24 and prior P-8479V-7.6.20 and prior P-8479V-8.0.27 and prior Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI). Supported versions that are affected are 8.4 and 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Session Border Controller. While the vulnerability is in Oracle Enterprise Session Border Controller, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Session Border Controller accessible data as well as unauthorized read access to a subset of Oracle Enterprise Session Border Controller accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21381 P-10757V-8.4 P-10757V-9.0 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Enterprise Session Border Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833085.1 P-10757V-8.4 P-10757V-9.0 Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI). Supported versions that are affected are 8.4 and 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Session Border Controller. While the vulnerability is in Oracle Enterprise Session Border Controller, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Session Border Controller accessible data. CVSS 3.1 Base Score 7.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N). Security patch has been released CVE-2022-21382 P-10757V-8.4 P-10757V-9.0 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N Enterprise Session Border Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833085.1 P-10757V-8.4 P-10757V-9.0 Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Log). Supported versions that are affected are 8.4 and 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Session Border Controller. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21383 P-10757V-8.4 P-10757V-9.0 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Enterprise Session Border Controller Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833085.1 P-10757V-8.4 P-10757V-9.0 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21386 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N WebLogic Server Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5242V-12.1.3.0.0 P-5242V-12.2.1.3.0 P-5242V-12.2.1.4.0 P-5242V-14.1.1.0.0 Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2022-21387 P-9348V-11.3.0 P-9348V-11.3.1 P-9348V-11.3.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Commerce Platform Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2832419.1 P-9348V-11.3.0 P-9348V-11.3.1 P-9348V-11.3.2 Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications Applications (component: On Premise Install). Supported versions that are affected are 12.0.0.3.0 and 12.0.0.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Pricing Design Center executes to compromise Oracle Communications Pricing Design Center. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Pricing Design Center accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Security patch has been released CVE-2022-21388 P-9437V-12.0.0.3.0 P-9437V-12.0.0.4.0 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Communications Pricing Design Center Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-9437V-12.0.0.3.0 P-9437V-12.0.0.4.0 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. While the vulnerability is in Oracle Communications Billing and Revenue Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2022-21389 P-2136V-12.0.0.3 P-2136V-12.0.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Communications Billing and Revenue Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2136V-12.0.0.3 P-2136V-12.0.0.4 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Webservices Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. While the vulnerability is in Oracle Communications Billing and Revenue Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2022-21390 P-2136V-12.0.0.3 P-2136V-12.0.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Communications Billing and Revenue Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2136V-12.0.0.3 P-2136V-12.0.0.4 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. While the vulnerability is in Oracle Communications Billing and Revenue Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2022-21391 P-2136V-12.0.0.3 P-2136V-12.0.0.4 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Communications Billing and Revenue Management Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2831903.1 P-2136V-12.0.0.3 P-2136V-12.0.0.4 Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Enterprise Manager Base Platform executes to compromise Enterprise Manager Base Platform. While the vulnerability is in Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Security patch has been released CVE-2022-21392 P-1370V-13.4.0.0 P-1370V-13.5.0.0 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Enterprise Manager Base Platform Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-1370V-13.4.0.0 P-1370V-13.5.0.0 Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java VM. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Security patch has been released CVE-2022-21393 P-5V-12.1.0.2 P-5V-12.2.0.1 P-5V-19c P-5V-21c 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Database - Enterprise Edition Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2817011.1 P-5V-12.1.0.2 P-5V-12.2.0.1 P-5V-19c P-5V-21c Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Security patch has been released CVE-2022-21394 P-8370V-Prior to 6.1.32 6.5 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N VM VirtualBox Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833279.1 P-8370V-Prior to 6.1.32 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks of this vulnerability can result in takeover of Oracle Communications Operations Monitor. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Security patch has been released CVE-2022-21395 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21396 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21397 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21398 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. While the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Operations Monitor. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L). Security patch has been released CVE-2022-21399 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 6.6 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21400 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. While the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Operations Monitor. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L). Security patch has been released CVE-2022-21401 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 6.6 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N). Security patch has been released CVE-2022-21402 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 4.8 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. While the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Operations Monitor. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L). Security patch has been released CVE-2022-21403 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0 6.6 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L Communications Operations Monitor Oracle customers with valid support contracts https://support.oracle.com/rs?type=doc&id=2833603.1 P-10761V-3.4 P-10761V-4.2 P-10761V-4.3 P-10761V-4.4 P-10761V-5.0