Oracle Critical Patch Update Advisory - April 2017 - Oracle CVRF Oracle Critical Patch Update Advisory CPUApr2017 Final 1.0 1.0 2017-04-18T13:00:00-07:00 Initial Distribution 2017-04-18T13:00:00-07:00 2017-04-18T13:00:00-07:00 This document contains descriptions of Oracle product security vulnerabilities which have had fixes released for all supported versions and platforms for the associated product. Additional information regarding these vulnerabilities including fix distribution information can be found at the Oracle sites referenced in this document. This document is published at: http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3681811.xml http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html URL to html version of Advisory Abhishek Nandawat Abhishek Nandawat Adam Willard Blue Canopy Akshay Jain Akshay Jain Alexey Tyurin ERPScan Andrea Micalizzi aka rgod, working with Trend Micro's Zero Day Initiative Andrew Gill Pentest Limited Arun Babu ValueMentor Infosec Pvt. Ltd Binoy Koonammavu ValueMentor Infosec Pvt. Ltd Can Demirel and Faruk Unal of Biznet Bilisim A.S Thijs Alkemade of Computest Cédric Bühler Cédric Bühler Daniël van Eeden Daniël van Eeden David Litchfield formerly of Google Deniz Cevik Biznet Bilisim A.S. Devin Rosenbauer Identity Works LLC Dmitrii Iudin aka @ret5et Dmitry Chastuhin ERPScan Eric Gruber Netspi Florian Bogner Florian Bogner Gaston Traberg Onapsis Hamdi Charfeddine Tunisian WhiteHat Security Hanno Böck Hanno Böck Harsh Joshi of Infomenia Technologies Ivan Chalykin ERPScan Jacob Baines Tenable Network Security Jakub Palaczynski ING Services Polska James Forshaw James Forshaw Jann Horn Jann Horn Jasmin Landry Jasmin Landry Jason Bertman Jason Bertman Jeffrey Walton Jeffrey Walton Jhayz Rubio Jhayz Rubio John S Andersen Intel Jussi CERT-FI Khai Tran formerly of Netspi Khajornchol Puwarang Mindterra Red Team Li Qiang of the Qihoo 360 Gear Team Lionel Debroux Lionel Debroux MMakhil MMakhil Mala Mala Manich Koomsusi Mindterra Red Team Marcin Zięba Prevenity Mat Werber Amazon Web Services IT Security Mateusz Jurczyk of Google Project Zero Matias Mevied Onapsis Md. Nur A Alam Dipu Md. Nur A Alam Dipu Mehmet Nurcan Mehmet Nurcan Mickey Shkatov Intel Mohammed Almouty Mohammed Saty PricewaterhouseCoopers Moritz Bechler Moritz Bechler (eenterphace.org) Muhammad Uwais Muhammad Uwais Muhammad nurnobi of Serverghosts Nada Alnoaimi Saudi Aramco Nadezhda Krivdyuk ERPScan An Anonymous researcher via Beyond Security's SecuriTeam Secure Disclosure Program Or Hanuka Motorola Solutions Peter Kostiuk Salesforce.com Renjith TC ValueMentor Infosec Pvt. Ltd Rodrigo Marcos Secforce Roman Shalymov ERPScan Spyridon Chatzimichail of OTE Hellenic Telecommunications Organization S.A. Sreedeep.Ck Alavil of Kerala Police Cyber Dome Volunteers Commander Suleman Malik Suleman Malik Sumit Sahoo (54H00) Suraj Khetani Gulf Business Machines Suvadip Kar Suvadip Kar Tansel Çetin Tansel Çetin Tawatchai Pinsuwan Mindterra Red Team Teemu Kääriäinen (Nixu) Tzachy Horesh Motorola Solutions Ubais PK EY Global Delivery Services William Roberts Intel Xiejingwei Fei FINRA Zuozhi Fan formerly of Alibaba loopx9 loopx9 Oracle Berkeley DB Version Prior to 6.2.32 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.0 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.1 Commerce Guided Search / Oracle Commerce Experience Manager Version 11.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.1.4 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.2.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.3.0 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.4.1.2 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.5.0 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.5.1 Commerce Guided Search / Oracle Commerce Experience Manager Version 6.5.2 Communications ASAP Version 7.0 Communications ASAP Version 7.2 Communications ASAP Version 7.3 Communications Network Integrity Version 7.2.4 Communications Network Integrity Version 7.3.0 Communications Service Broker Engineered System Edition Version 6.0 Communications Service Broker Engineered System Edition Version 6.1 Communications Session Border Controller Version SCZ7.2.0 Communications Session Border Controller Version SCZ7.3.0 Communications Session Border Controller Version SCZ7.4.0 Communications Security Gateway Version 3.0.0 Communications Policy Management Version 12.2 Oracle Database Version 11.2.0.4 Oracle Database Version 12.1.0.2 SQL*Plus Version 11.2.0.4 SQL*Plus Version 12.1.0.2 Marketing Version 12.1.1 Marketing Version 12.1.2 Marketing Version 12.1.3 Marketing Version 12.2.3 Marketing Version 12.2.4 Marketing Version 12.2.5 Marketing Version 12.2.6 Scripting Version 12.1.1 Scripting Version 12.1.2 Scripting Version 12.1.3 Scripting Version 12.2.3 Scripting Version 12.2.4 Scripting Version 12.2.5 Scripting Version 12.2.6 Payroll Version 12.1.1 Payroll Version 12.1.2 Payroll Version 12.1.3 Payroll Version 12.2.3 Payroll Version 12.2.4 Payroll Version 12.2.5 Payroll Version 12.2.6 Application Object Library Version 12.1.3 Application Object Library Version 12.2.3 Application Object Library Version 12.2.4 Application Object Library Version 12.2.5 Application Object Library Version 12.2.6 Advanced Outbound Telephony Version 12.2.3 Advanced Outbound Telephony Version 12.2.4 Advanced Outbound Telephony Version 12.2.5 Advanced Outbound Telephony Version 12.2.6 iReceivables Version 12.1.1 iReceivables Version 12.1.2 iReceivables Version 12.1.3 iReceivables Version 12.2.3 iReceivables Version 12.2.4 iReceivables Version 12.2.5 iReceivables Version 12.2.6 Customer Interaction History Version 12.1.1 Customer Interaction History Version 12.1.2 Customer Interaction History Version 12.1.3 One-to-One Fulfillment Version 12.1.1 One-to-One Fulfillment Version 12.1.2 One-to-One Fulfillment Version 12.1.3 One-to-One Fulfillment Version 12.2.3 One-to-One Fulfillment Version 12.2.4 One-to-One Fulfillment Version 12.2.5 One-to-One Fulfillment Version 12.2.6 Applications Framework Version 12.1.3 Applications Framework Version 12.2.3 Applications Framework Version 12.2.4 Applications Framework Version 12.2.5 Applications Framework Version 12.2.6 User Management Version 12.1.3 User Management Version 12.2.3 User Management Version 12.2.4 User Management Version 12.2.5 User Management Version 12.2.6 Enterprise Manager Base Platform Version 12.1.0 Enterprise Manager Base Platform Version 13.1.0 Enterprise Manager Base Platform Version 13.2.0 Financial Services Enterprise Financial Performance Analytics Version 8.0.0 to 8.0.4 Financial Services Profitability Management Version 6.0.0 Financial Services Profitability Management Version 6.1.0 Financial Services Profitability Management Version 6.1.1 Financial Services Profitability Management Version 8.0.1 Financial Services Profitability Management Version 8.0.2 Financial Services Profitability Management Version 8.0.3 Financial Services Profitability Management Version 8.0.4 Financial Services Funds Transfer Pricing Version 6.0.0 Financial Services Funds Transfer Pricing Version 6.1.0 Financial Services Funds Transfer Pricing Version 6.1.1 Financial Services Funds Transfer Pricing Version 8.0.1 Financial Services Funds Transfer Pricing Version 8.0.2 Financial Services Funds Transfer Pricing Version 8.0.3 Financial Services Funds Transfer Pricing Version 8.0.4 Financial Services Asset Liability Management Version 6.0.0 Financial Services Asset Liability Management Version 6.1.0 Financial Services Asset Liability Management Version 6.1.1 Financial Services Asset Liability Management Version 8.0.1 Financial Services Asset Liability Management Version 8.0.2 Financial Services Asset Liability Management Version 8.0.3 Financial Services Asset Liability Management Version 8.0.4 Financial Services Analytical Applications Infrastructure Version 7.3.3 Financial Services Analytical Applications Infrastructure Version 7.3.4 Financial Services Analytical Applications Infrastructure Version 7.3.5 Financial Services Analytical Applications Reconciliation Framework Version 8.0.0 Financial Services Analytical Applications Reconciliation Framework Version 8.0.1 Financial Services Analytical Applications Reconciliation Framework Version 8.0.2 Financial Services Pricing Management, Transfer Pricing Component Version 8.0.0 to 8.0.4 FLEXCUBE Universal Banking Version 11.3.0 FLEXCUBE Universal Banking Version 11.4.0 FLEXCUBE Universal Banking Version 12.0.0 FLEXCUBE Universal Banking Version 12.0.1 FLEXCUBE Universal Banking Version 12.0.2 FLEXCUBE Universal Banking Version 12.0.3 FLEXCUBE Universal Banking Version 12.1.0 FLEXCUBE Universal Banking Version 12.2.0 FLEXCUBE Universal Banking Version 12.3.0 Financial Services Liquidity Risk Management Version 8.0.1 Financial Services Liquidity Risk Management Version 8.0.2 Financial Services Liquidity Risk Management Version 8.0.4 FLEXCUBE Investor Servicing Version 12.0.1 FLEXCUBE Investor Servicing Version 12.0.2 FLEXCUBE Investor Servicing Version 12.0.3 FLEXCUBE Investor Servicing Version 12.0.4 FLEXCUBE Investor Servicing Version 12.1.0 FLEXCUBE Investor Servicing Version 12.2.0 FLEXCUBE Investor Servicing Version 12.3.0 FLEXCUBE Enterprise Limits and Collateral Management Version 12.0.0 FLEXCUBE Enterprise Limits and Collateral Management Version 12.0.1 FLEXCUBE Enterprise Limits and Collateral Management Version 12.1.0 FLEXCUBE Private Banking Version 12.0.0 FLEXCUBE Private Banking Version 12.0.1 FLEXCUBE Private Banking Version 12.0.2 FLEXCUBE Private Banking Version 12.0.3 FLEXCUBE Private Banking Version 12.1.0 FLEXCUBE Private Banking Version 2.0.0 FLEXCUBE Private Banking Version 2.0.1 FLEXCUBE Private Banking Version 2.2.0.1 FLEXCUBE Direct Banking Version 12.0.2 FLEXCUBE Direct Banking Version 12.0.3 Financial Services Data Foundation Version 8.0.1 Financial Services Data Foundation Version 8.0.2 Financial Services Data Foundation Version 8.0.3 Financial Services Data Foundation Version 8.0.4 Financial Services Hedge Management and IFRS Valuations Version 6.1.1 Financial Services Hedge Management and IFRS Valuations Version 8.0.1 Financial Services Hedge Management and IFRS Valuations Version 8.0.2 Financial Services Hedge Management and IFRS Valuations Version 8.0.3 Financial Services Hedge Management and IFRS Valuations Version 8.0.4 Financial Services Basel Regulatory Capital Internal Ratings Based Approach Version 6.1.2 Financial Services Basel Regulatory Capital Internal Ratings Based Approach Version 6.1.3 Financial Services Basel Regulatory Capital Internal Ratings Based Approach Version 8.0.2 Financial Services Basel Regulatory Capital Internal Ratings Based Approach Version 8.0.3 Financial Services Loan Loss Forecasting and Provisioning Version 1.5.0 Financial Services Loan Loss Forecasting and Provisioning Version 1.5.1 Financial Services Loan Loss Forecasting and Provisioning Version 8.0.1 Financial Services Loan Loss Forecasting and Provisioning Version 8.0.2 Financial Services Loan Loss Forecasting and Provisioning Version 8.0.3 Financial Services Loan Loss Forecasting and Provisioning Version 8.0.4 Financial Services Basel Regulatory Capital Basic Version 6.1.2 Financial Services Basel Regulatory Capital Basic Version 6.1.3 Financial Services Basel Regulatory Capital Basic Version 8.0.2 Financial Services Basel Regulatory Capital Basic Version 8.0.3 Insurance Data Foundation Version 8.0.1 Insurance Data Foundation Version 8.0.2 Insurance Data Foundation Version 8.0.3 Insurance Data Foundation Version 8.0.4 Financial Services Retail Customer Analytics Version 8.0.0 to 8.0.3 Financial Services Institutional Performance Analytics Version 8.0.0 to 8.0.4 Financial Services Retail Performance Analytics Version 8.0.0 to 8.0.4 Financial Services Data Integration Hub Version 8.0.1 Financial Services Data Integration Hub Version 8.0.2 Financial Services Data Integration Hub Version 8.0.3 Financial Services Data Integration Hub Version 8.0.4 Fusion Middleware MapViewer Version 11.1.1.9 Fusion Middleware MapViewer Version 12.2.1.1 Fusion Middleware MapViewer Version 12.2.1.2 Identity Manager Version 11.1.2.3.0 WebCenter Content Version 11.1.1.7 WebCenter Content Version 11.1.1.9 WebCenter Content Version 12.2.1.0 WebCenter Content Version 12.2.1.1 WebCenter Content Version 12.2.1.2 WebLogic Server Version 10.3.6.0 WebLogic Server Version 12.1.3.0 WebLogic Server Version 12.2.1.0 WebLogic Server Version 12.2.1.1 WebLogic Server Version 12.2.1.2 Service Bus Version 12.1.3.0.0 Service Bus Version 12.2.1.0.0 Service Bus Version 12.2.1.1.0 Service Bus Version 12.2.1.2.0 GlassFish Server Version 3.1.2 API Gateway Version 11.1.2.4.0 Social Network Version prior to 11.1.12.0.0 (17019101) WebCenter Sites Version 11.1.1.8.0 WebCenter Sites Version 12.2.1.0.0 WebCenter Sites Version 12.2.1.1.0 WebCenter Sites Version 12.2.1.2.0 Healthcare Master Person Index Version 3.0.0.x and 4.0.1.x Healthcare Master Person Index Version Prior to and 2.0.1.x Hospitality OPERA 5 Property Services Version 5.4.0.x Hospitality OPERA 5 Property Services Version 5.4.1.x Hospitality OPERA 5 Property Services Version 5.4.2.x Hospitality OPERA 5 Property Services Version 5.4.3.x Hospitality OPERA 5 Property Services Version 5.5.0.x Hospitality OPERA 5 Property Services Version 5.5.1.x Hyperion Essbase Version 11.1.2.2 Insurance Istream Version 4.3.2 and prior JD Edwards EnterpriseOne Tools Version 9.2 Java Version 7u131 Java Version 8u121 Java Version 8u121; Java SE Embedded: 8u121 Java Version 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 Java Version Java SE: 6u141 Java Version Java SE: 7u131 MySQL Workbench Version 6.3.7 and earlier MySQL Workbench Version 6.3.8 and earlier MySQL Enterprise Backup Version 3.12.2 and earlier MySQL Enterprise Backup Version 3.12.3 and earlier MySQL Enterprise Backup Version 4.0.1 and earlier MySQL Enterprise Backup Version 4.0.3 and earlier MySQL Server Version 5.5.54 and earlier MySQL Server Version 5.5.55 and earlier MySQL Server Version 5.6.20 and earlier MySQL Server Version 5.6.35 and earlier MySQL Server Version 5.7.11 to 5.7.17 MySQL Server Version 5.7.17 and earlier MySQL Cluster Version 7.2.27 and earlier MySQL Cluster Version 7.3.16 and earlier MySQL Cluster Version 7.4.14 and earlier MySQL Cluster Version 7.5.5 and earlier MySQL Enterprise Monitor Version 3.1.6.8003 and earlier MySQL Enterprise Monitor Version 3.2.1182 and earlier MySQL Enterprise Monitor Version 3.3.2.1162 and earlier MySQL Connectors Version 2.1.5 and earlier MySQL Connectors Version 5.1.40 and eariler MySQL Connectors Version 5.1.41 and earlier PeopleSoft Enterprise FIN eSettlements Version 9.1 PeopleSoft Enterprise FIN Receivables Version 9.2 PeopleSoft Enterprise PT PeopleTools Version 8.54 PeopleSoft Enterprise PT PeopleTools Version 8.55 PeopleSoft Enterprise SCM eBill Payment Version 9.2 PeopleSoft Enterprise SCM eSupplier Connection Version 9.2 PeopleSoft Enterprise SCM Purchasing Version 9.2 PeopleSoft Enterprise SCM Services Procurement Version 9.2 PeopleSoft Enterprise SCM Strategic Sourcing Version 9.2 PeopleSoft Enterprise CS Campus Community Version 9.2 Primavera P6 Enterprise Project Portfolio Management Version 15.1 Primavera P6 Enterprise Project Portfolio Management Version 15.2 Primavera P6 Enterprise Project Portfolio Management Version 16.1 Primavera P6 Enterprise Project Portfolio Management Version 16.2 Primavera P6 Enterprise Project Portfolio Management Version 8.3 Primavera P6 Enterprise Project Portfolio Management Version 8.4 Primavera P6 Professional Project Management Version 15.1 Primavera P6 Professional Project Management Version 15.2 Primavera P6 Professional Project Management Version 16.1 Primavera P6 Professional Project Management Version 16.2 Primavera P6 Professional Project Management Version 8.3 Primavera P6 Professional Project Management Version 8.4 Primavera Unifier Version 10.0 Primavera Unifier Version 10.1 Primavera Unifier Version 15.1 Primavera Unifier Version 15.2 Primavera Unifier Version 9.13 Primavera Unifier Version 9.14 Primavera Gateway Version 1.0 Primavera Gateway Version 1.1 Primavera Gateway Version 14.2 Primavera Gateway Version 15.1 Primavera Gateway Version 15.2 Primavera Gateway Version 16.1 Primavera Gateway Version 16.2 Retail Advanced Inventory Planning Version 14.1 Retail Advanced Inventory Planning Version 15.0 Retail Category Management Version 13.2 Retail Category Management Version 13.3 Retail Category Management Version 14.0 Retail Category Management Version 14.1 Retail Assortment Planning Version 14.1.3 Retail Assortment Planning Version 15.0.1 Retail Assortment Planning Version 16.0.0 Retail Demand Forecasting Version 14.1.3 Retail Demand Forecasting Version 15.0.2 Retail Invoice Matching Version 12.0 Retail Invoice Matching Version 13.0 Retail Invoice Matching Version 13.1 Retail Invoice Matching Version 13.2 Retail Invoice Matching Version 14.0 Retail Invoice Matching Version 14.1 Retail Item Planning Version 14.1.3 Retail Item Planning Version 15.0.2 Retail Merchandise Financial Planning Version 14.1.3 Retail Merchandise Financial Planning Version 15.0.2 Retail Predictive Application Server Version 13.1 Retail Predictive Application Server Version 13.2 Retail Predictive Application Server Version 13.3 Retail Predictive Application Server Version 13.3.3 Retail Predictive Application Server Version 13.4 Retail Predictive Application Server Version 13.4.3 Retail Predictive Application Server Version 14.0 Retail Predictive Application Server Version 14.0.3 Retail Predictive Application Server Version 14.1 Retail Predictive Application Server Version 14.1.3 Retail Predictive Application Server Version 15.0 Retail Predictive Application Server Version 15.0.2 Retail Predictive Application Server Version 16.0.0 Retail Replenishment Optimization Version 14.1.3 Retail Replenishment Optimization Version 15.0.2 Retail Store Inventory Management Version 14.1 Retail Store Inventory Management Version 15.0 Retail Store Inventory Management Version 16.0 Retail Warehouse Management System Version 13.2 Retail Warehouse Management System Version 14.0 Retail Warehouse Management System Version 15.0 Retail Back Office Version 14.1 Retail Point-of-Service Version 14.1.3 Retail Returns Management Version 14.1 Retail Regular Price Optimization Version 14.1.3 Retail Regular Price Optimization Version 15.0.2 Retail Size Profile Optimization Version 14.1.3 Retail Size Profile Optimization Version 15.0.2 Retail Analytic Parameter Calculator - RO Version 15.0 Retail Analytics Version 14.0 Retail Analytics Version 14.1 Retail Analytics Version 15.0 Retail Analytics Version 16.0 Retail Advanced Science Engine Version 14.1 XBRi Cloud Service Version 10.0.1 XBRi Cloud Service Version 10.5.0 XBRi Cloud Service Version 10.6.0 XBRi Cloud Service Version 10.7.0 XBRi Cloud Service Version 10.8.0 XBRi Cloud Service Version 10.8.1 Retail Xstore Point of Service Version 15.0 Retail Xstore Point of Service Version 16.0 Retail Xstore Point of Service Version 5.5 Retail Xstore Point of Service Version 6.0 Retail Xstore Point of Service Version 6.5 Retail Xstore Point of Service Version 7.0 Retail Xstore Point of Service Version 7.1 Retail Customer Management and Segmentation Foundation Cloud Service Version 15.0 Retail Order Broker Cloud Service Version 15.0 Retail Order Broker Cloud Service Version 16.0 Retail Order Broker Cloud Service Version 5.1 Retail Order Broker Cloud Service Version 5.2 Retail Open Commerce Platform Cloud Service Version 15.0 Retail Open Commerce Platform Cloud Service Version 16.0 Retail Open Commerce Platform Cloud Service Version 4.0 Retail Open Commerce Platform Cloud Service Version 5.0 Retail Open Commerce Platform Cloud Service Version 5.1 Retail Open Commerce Platform Cloud Service Version 5.3 Retail Open Commerce Platform Cloud Service Version 6.0 Retail Open Commerce Platform Cloud Service Version 6.1 MICROS Xstore Payment Version 15.0 MICROS Xstore Payment Version 16.0 MICROS Xstore Payment Version 5.5 MICROS Xstore Payment Version 6.0 MICROS Xstore Payment Version 6.5 MICROS Xstore Payment Version 7.0 MICROS Xstore Payment Version 7.1 MICROS XBR Version 10.0.1 MICROS XBR Version 10.5.0 MICROS XBR Version 10.6.0 MICROS XBR Version 10.7.7 MICROS XBR Version 10.8.0 MICROS XBR Version 10.8.1 MICROS Relate CRM Software Version 10.0 MICROS Relate CRM Software Version 10.5 MICROS Relate CRM Software Version 10.8 MICROS Relate CRM Software Version 11.0 MICROS Relate CRM Software Version 11.1 MICROS Relate CRM Software Version 11.4 MICROS Relate CRM Software Version 15.0 Retail Macro Space Optimization Version 15.0.2 Retail Category Management Planning and Optimization Version 15.0 Retail Merchandising Insights Cloud Service Version 15.0 Retail Customer Insights Cloud Service Version 15.0 MICROS Lucas Version 2.9.5.1 MICROS Lucas Version 2.9.5.2 MICROS Lucas Version 2.9.5.3 MICROS Lucas Version 2.9.5.4 MICROS Lucas Version 2.9.5.5 Oracle Secure Backup Version Prior to 12.1.0.3.0 Siebel Apps - E-Billing Version 6.1 Siebel Apps - E-Billing Version 6.2 Siebel Apps - E-Billing Version 7.0 Siebel Apps - E-Billing Version 7.1 Solaris Cluster Version 4.3 Solaris Operating System Version 10 Solaris Operating System Version 11.3 Solaris Operating System Version None SuperCluster Specific Software Version 2.3.13 SuperCluster Specific Software Version 2.3.8 Sun ZFS Storage Appliance Kit (AK) Software Version AK 2013 Tape General STA - StorageTek Tape Analytics SW Tool Version Prior to 2.2.1 Transportation Management Version 6.2 Transportation Management Version 6.3.0 Transportation Management Version 6.3.1 Transportation Management Version 6.3.2 Transportation Management Version 6.3.3 Transportation Management Version 6.3.4 Transportation Management Version 6.3.5 Transportation Management Version 6.3.6 Transportation Management Version 6.3.7 Transportation Management Version 6.4.0 Transportation Management Version 6.4.1 Transportation Management Version 6.4.2 OSS Support Tools Version Prior to RDA 8.15.17.3.14 Automatic Service Request (ASR) Version Prior to 5.7 Advanced Support Gateway Version Prior to 7.2 System Utilities Version Prior to 12.1.2.8.4 Real-Time Scheduler Version 2.2.0.3.13 Real-Time Scheduler Version 2.3.0.0 Real-Time Scheduler Version 2.3.0.1 Utilities Work and Asset Management Version 1.9.1.2.11 Utilities Framework Version 2.2.0.0.0 Utilities Framework Version 4.1.0.1.0 Utilities Framework Version 4.1.0.2.0 Utilities Framework Version 4.2.0.1.0 Utilities Framework Version 4.2.0.2.0 Utilities Framework Version 4.2.0.3.0 Utilities Framework Version 4.3.0.1.0 Utilities Framework Version 4.3.0.2.0 Utilities Framework Version 4.3.0.3.0 Utilities Customer Self Service Version 2.1.0.2.0 Oracle VM VirtualBox Version Prior to 5.0.34 Oracle VM VirtualBox Version Prior to 5.0.38 Oracle VM VirtualBox Version Prior to 5.1.16 Oracle VM VirtualBox Version Prior to 5.1.20 Secure Global Desktop Version 4.71 Secure Global Desktop Version 5.2 Secure Global Desktop Version 5.3 Vulnerability in the Oracle Trace File Analyzer (TFA) component of Oracle Support Tools (subcomponent: TFA Collector). The supported version that is affected is Prior to 12.1.2.8.4. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Trace File Analyzer (TFA). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Trace File Analyzer (TFA) accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2004-2761 P-10655V-Prior to 12.1.2.8.4 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10655V-Prior to 12.1.2.8.4 Vulnerability in the Oracle Communications Session Border Controller component of Oracle Communications Applications (subcomponent: Sysadmin (Dropbear)). Supported versions that are affected are SCZ7.2.0, SCZ7.3.0 and SCZ7.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via SSH to compromise Oracle Communications Session Border Controller. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Session Border Controller. CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2012-0920 P-10750V-SCZ7.2.0 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 7.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10750V-SCZ7.2.0 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 Vulnerability in the Oracle Utilities Framework component of Oracle Utilities Applications (subcomponent: UI (YUI JavaScript framework)). Supported versions that are affected are 2.2.0.0.0, 4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0 and 4.3.0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Utilities Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Framework accessible data as well as unauthorized read access to a subset of Oracle Utilities Framework accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2012-5881 P-2245V-2.2.0.0.0 P-2245V-4.1.0.1.0 P-2245V-4.1.0.2.0 P-2245V-4.2.0.1.0 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0 P-2245V-4.3.0.2.0 P-2245V-4.3.0.3.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2245V-2.2.0.0.0 P-2245V-4.1.0.1.0 P-2245V-4.1.0.2.0 P-2245V-4.2.0.1.0 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0 P-2245V-4.3.0.2.0 P-2245V-4.3.0.3.0 Vulnerability in the Secure Global Desktop component of Oracle Virtualization (subcomponent: Window System (X11)). The supported version that is affected is 4.71. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Secure Global Desktop. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Secure Global Desktop accessible data as well as unauthorized read access to a subset of Secure Global Desktop accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Secure Global Desktop. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2013-1982 P-8539V-4.71 5.6 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8539V-4.71 Vulnerability in the Oracle Communications Session Border Controller component of Oracle Communications Applications (subcomponent: Sysadmin). Supported versions that are affected are SCZ7.3.0 and SCZ7.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSH to compromise Oracle Communications Session Border Controller. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Session Border Controller accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2013-2566 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 Vulnerability in the Oracle Communications Session Border Controller component of Oracle Communications Applications (subcomponent: Sysadmin (SCTP)). Supported versions that are affected are SCZ7.2.0, SCZ7.3.0 and SCZ7.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SCTP to compromise Oracle Communications Session Border Controller. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Session Border Controller accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2013-5209 P-10750V-SCZ7.2.0 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10750V-SCZ7.2.0 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 Vulnerability in the Oracle Utilities Framework component of Oracle Utilities Applications (subcomponent: System Wide). Supported versions that are affected are 4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0 and 4.3.0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Framework. While the vulnerability is in Oracle Utilities Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Framework accessible data as well as unauthorized read access to a subset of Oracle Utilities Framework accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Utilities Framework. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L). Fix has been released CVE-2014-0114 P-2245V-4.1.0.1.0 P-2245V-4.1.0.2.0 P-2245V-4.2.0.1.0 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0 P-2245V-4.3.0.2.0 P-2245V-4.3.0.3.0 8.3 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2245V-4.1.0.1.0 P-2245V-4.1.0.2.0 P-2245V-4.2.0.1.0 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0 P-2245V-4.3.0.2.0 P-2245V-4.3.0.3.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2014-3596 P-5085V-8.54 P-5085V-8.55 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Oracle Communications Session Border Controller component of Oracle Communications Applications (subcomponent: Routing). Supported versions that are affected are SCZ7.2.0, SCZ7.3.0 and SCZ7.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Session Border Controller. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Session Border Controller accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2015-0204 P-10750V-SCZ7.2.0 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10750V-SCZ7.2.0 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 Vulnerability in the Oracle Retail Predictive Application Server component of Oracle Retail Applications (subcomponent: RPAS Server). Supported versions that are affected are 13.3.3, 13.4.3, 14.0.3, 14.1.3, 15.0.2 and 16.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Oracle Retail Predictive Application Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Predictive Application Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2015-0204 P-1823V-13.3.3 P-1823V-13.4.3 P-1823V-14.0.3 P-1823V-14.1.3 P-1823V-15.0.2 P-1823V-16.0.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1823V-13.3.3 P-1823V-13.4.3 P-1823V-14.0.3 P-1823V-14.1.3 P-1823V-15.0.2 P-1823V-16.0.0 Vulnerability in the Oracle Hyperion Essbase component of Oracle Hyperion (subcomponent: Security (libcurl)). The supported version that is affected is 11.1.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Essbase. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Fix has been released CVE-2015-3237 P-4379V-11.1.2.2 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4379V-11.1.2.2 Vulnerability in the StorageTek Tape Analytics SW Tool component of Oracle Sun Systems Products Suite (subcomponent: WebLogic Server). The supported version that is affected is Prior to 2.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise StorageTek Tape Analytics SW Tool. Successful attacks of this vulnerability can result in takeover of StorageTek Tape Analytics SW Tool. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-4852 P-10085V-Prior to 2.2.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10085V-Prior to 2.2.1 Vulnerability in the Oracle Advanced Support Gateway component of Oracle Support Tools (subcomponent: Samba Service). The supported version that is affected is Prior to 7.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMB to compromise Oracle Advanced Support Gateway. While the vulnerability is in Oracle Advanced Support Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Support Gateway accessible data as well as unauthorized read access to a subset of Oracle Advanced Support Gateway accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2015-5252 P-9296V-Prior to 7.2 7.2 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9296V-Prior to 7.2 Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Install (Apache Commons Collections)). Supported versions that are affected are 11.1.1.9, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks of this vulnerability can result in takeover of Oracle Fusion Middleware MapViewer. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-1215V-11.1.1.9 P-1215V-12.2.1.1 P-1215V-12.2.1.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1215V-11.1.1.9 P-1215V-12.2.1.1 P-1215V-12.2.1.2 Vulnerability in the StorageTek Tape Analytics SW Tool component of Oracle Sun Systems Products Suite (subcomponent: Core (Apache Commons Collections)). The supported version that is affected is Prior to 2.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise StorageTek Tape Analytics SW Tool. Successful attacks of this vulnerability can result in takeover of StorageTek Tape Analytics SW Tool. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-10085V-Prior to 2.2.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10085V-Prior to 2.2.1 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Sites (Apache Commons Collections)). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2015-7501 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle Insurance Istream component of Oracle Insurance Applications (subcomponent: IStream Publisher (Bouncy Castle)). Supported versions that are affected are 4.3.2 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Insurance Istream. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Insurance Istream accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-5486V-4.3.2 and prior 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5486V-4.3.2 and prior Vulnerability in the Oracle Retail Open Commerce Platform component of Oracle Retail Applications (subcomponent: Framework). Supported versions that are affected are 4.0, 5.0, 5.1, 5.3 and 6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Open Commerce Platform accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2015-7940 P-11521V-4.0 P-11521V-5.0 P-11521V-5.1 P-11521V-5.3 P-11521V-6.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11521V-4.0 P-11521V-5.0 P-11521V-5.1 P-11521V-5.3 P-11521V-6.0 Vulnerability in the Oracle Communications Network Integrity component of Oracle Communications Applications (subcomponent: Security (Spring)). Supported versions that are affected are 7.3.0 and 7.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Network Integrity. Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Integrity. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-4491V-7.3.0 P-4491V-7.2.4 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4491V-7.3.0 P-4491V-7.2.4 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Core (Spring Framework)). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Private Banking. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-9110V-12.0.1 P-9110V-12.0.2 P-9110V-12.0.3 P-9110V-12.1.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-12.0.1 P-9110V-12.0.2 P-9110V-12.0.3 P-9110V-12.1.0 Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications (subcomponent: Security). The supported version that is affected is 14.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Back Office. Successful attacks of this vulnerability can result in takeover of Oracle Retail Back Office. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-2013V-14.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2013V-14.1 Vulnerability in the Oracle Retail Invoice Matching component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.2, 14.0 and 14.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Invoice Matching. Successful attacks of this vulnerability can result in takeover of Oracle Retail Invoice Matching. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-1810V-13.2 P-1810V-14.0 P-1810V-14.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1810V-13.2 P-1810V-14.0 P-1810V-14.1 Vulnerability in the Oracle Retail Point-of-Service component of Oracle Retail Applications (subcomponent: Mobile POS). The supported version that is affected is 14.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Point-of-Service. Successful attacks of this vulnerability can result in takeover of Oracle Retail Point-of-Service. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-2017V-14.1.3 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2017V-14.1.3 Vulnerability in the Oracle Retail Returns Management component of Oracle Retail Applications (subcomponent: Security). The supported version that is affected is 14.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Returns Management. Successful attacks of this vulnerability can result in takeover of Oracle Retail Returns Management. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0635 P-2020V-14.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2020V-14.1 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Apache Tomcat). The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0714 P-9617V-11.1.1.8.0 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 Vulnerability in the Oracle Communications ASAP component of Oracle Communications Applications (subcomponent: Security (Xerces)). Supported versions that are affected are 7.0, 7.2 and 7.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications ASAP. Successful attacks of this vulnerability can result in takeover of Oracle Communications ASAP. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-0729 P-2260V-7.0 P-2260V-7.2 P-2260V-7.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2260V-7.0 P-2260V-7.2 P-2260V-7.3 Vulnerability in the Secure Global Desktop component of Oracle Virtualization (subcomponent: Application Server (Apache Tomcat)). Supported versions that are affected are 4.71, 5.2 and 5.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Secure Global Desktop. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Secure Global Desktop accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-0762 P-8539V-4.71 P-8539V-5.2 P-8539V-5.3 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8539V-4.71 P-8539V-5.2 P-8539V-5.3 Vulnerability in the Oracle Retail Invoice Matching component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 12.0, 13.0, 13.1, 13.2, 14.0 and 14.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Retail Invoice Matching executes to compromise Oracle Retail Invoice Matching. Successful attacks of this vulnerability can result in takeover of Oracle Retail Invoice Matching. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-1181 P-1810V-12.0 P-1810V-13.0 P-1810V-13.1 P-1810V-13.2 P-1810V-14.0 P-1810V-14.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1810V-12.0 P-1810V-13.0 P-1810V-13.1 P-1810V-13.2 P-1810V-14.0 P-1810V-14.1 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Samples (Struts 1)). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-1181 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: Platform Services). Supported versions that are affected are 6.1.4, 11.0, 11.1 and 11.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-2107 P-9633V-6.1.4 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9633V-6.1.4 P-9633V-11.0 P-9633V-11.1 P-9633V-11.2 Vulnerability in the MySQL Enterprise Backup component of Oracle MySQL (subcomponent: Backup: ENTRBACK (OpenSSL)). Supported versions that are affected are 3.12.2 and earlier and 4.0.1 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise Backup. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Backup and unauthorized read access to a subset of MySQL Enterprise Backup accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2176 P-4629V-3.12.2 and earlier P-4629V-4.0.1 and earlier 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4629V-3.12.2 and earlier P-4629V-4.0.1 and earlier Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security: Encryption (OpenSSL)). Supported versions that are affected are 6.3.7 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Workbench. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Workbench and unauthorized read access to a subset of MySQL Workbench accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Fix has been released CVE-2016-2176 P-4627V-6.3.7 and earlier 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4627V-6.3.7 and earlier Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation component of Oracle Retail Applications (subcomponent: Web Services). The supported version that is affected is 15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Management and Segmentation Foundation. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-2510 P-11518V-15.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11518V-15.0 Vulnerability in the Oracle Communications Service Broker Engineered System Edition component of Oracle Communications Applications (subcomponent: Install (Apache Commons FileUpload)). Supported versions that are affected are 6.0 and 6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Service Broker Engineered System Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Service Broker Engineered System Edition. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-9056V-6.0 P-9056V-6.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9056V-6.0 P-9056V-6.1 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Security Framework). Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-1370V-12.1.0 P-1370V-13.1.0 P-1370V-13.2.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1370V-12.1.0 P-1370V-13.1.0 P-1370V-13.2.0 Vulnerability in the Oracle Healthcare Master Person Index component of Oracle Health Sciences Applications (subcomponent: Cleanser, Profiler (Apache Commons FileUpload)). Supported versions that are affected are Prior to and 2.0.1.x and 3.0.0.x and 4.0.1.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Healthcare Master Person Index. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-8575V-Prior to and 2.0.1.x P-8575V-3.0.0.x and 4.0.1.x 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8575V-Prior to and 2.0.1.x P-8575V-3.0.0.x and 4.0.1.x Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: General (Apache Commons FileUpload)). Supported versions that are affected are 3.1.6.8003 and earlier, 3.2.1182 and earlier and 3.3.2.1162 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier Vulnerability in the Oracle Utilities Framework component of Oracle Utilities Applications (subcomponent: File Uploads and Attachments (Apache Commons FileUpload)). Supported versions that are affected are 2.2.0.0.0, 4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0 and 4.3.0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Framework. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Framework. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-2245V-2.2.0.0.0 P-2245V-4.1.0.1.0 P-2245V-4.1.0.2.0 P-2245V-4.2.0.1.0 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0 P-2245V-4.3.0.2.0 P-2245V-4.3.0.3.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2245V-2.2.0.0.0 P-2245V-4.1.0.1.0 P-2245V-4.1.0.2.0 P-2245V-4.2.0.1.0 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0 P-2245V-4.3.0.2.0 P-2245V-4.3.0.3.0 Vulnerability in the Oracle Utilities Work and Asset Management component of Oracle Utilities Applications (subcomponent: Integrations (Apache Commons FileUpload)). The supported version that is affected is 1.9.1.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Work and Asset Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Work and Asset Management. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-3092 P-2244V-1.9.1.2.11 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2244V-1.9.1.2.11 Vulnerability in the MICROS Lucas component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 2.9.5.1, 2.9.5.2, 2.9.5.3,2.9.5.4 and 2.9.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise MICROS Lucas. Successful attacks of this vulnerability can result in takeover of MICROS Lucas. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-12633V-2.9.5.1 P-12633V-2.9.5.2 P-12633V-2.9.5.3 P-12633V-2.9.5.4 P-12633V-2.9.5.5 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-12633V-2.9.5.1 P-12633V-2.9.5.2 P-12633V-2.9.5.3 P-12633V-2.9.5.4 P-12633V-2.9.5.5 Vulnerability in the MICROS Relate CRM Software component of Oracle Retail Applications (subcomponent: Web Services). Supported versions that are affected are 10.0, 10.5, 10.8, 11.0, 11.1, 11.4 and 15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise MICROS Relate CRM Software. Successful attacks of this vulnerability can result in takeover of MICROS Relate CRM Software. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-11566V-10.0 P-11566V-10.5 P-11566V-10.8 P-11566V-11.0 P-11566V-11.1 P-11566V-11.4 P-11566V-15.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11566V-10.0 P-11566V-10.5 P-11566V-10.8 P-11566V-11.0 P-11566V-11.1 P-11566V-11.4 P-11566V-15.0 Vulnerability in the MICROS XBR component of Oracle Retail Applications (subcomponent: Database). Supported versions that are affected are 10.0.1, 10.5.0, 10.6.0, 10.7.7, 10.8.0 and 10.8.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise MICROS XBR. Successful attacks of this vulnerability can result in takeover of MICROS XBR. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-11564V-10.0.1 P-11564V-10.5.0 P-11564V-10.6.0 P-11564V-10.7.7 P-11564V-10.8.0 P-11564V-10.8.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11564V-10.0.1 P-11564V-10.5.0 P-11564V-10.6.0 P-11564V-10.7.7 P-11564V-10.8.0 P-11564V-10.8.1 Vulnerability in the MICROS Xstore Payment component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 5.5, 6.0, 6.5, 7.0, 7.1, 15.0 and 16.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise MICROS Xstore Payment. Successful attacks of this vulnerability can result in takeover of MICROS Xstore Payment. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-11562V-5.5 P-11562V-6.0 P-11562V-6.5 P-11562V-7.0 P-11562V-7.1 P-11562V-15.0 P-11562V-16.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11562V-5.5 P-11562V-6.0 P-11562V-6.5 P-11562V-7.0 P-11562V-7.1 P-11562V-15.0 P-11562V-16.0 Vulnerability in the Oracle Retail Advanced Inventory Planning component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1 and 15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Advanced Inventory Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Advanced Inventory Planning. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1785V-14.1 P-1785V-15.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1785V-14.1 P-1785V-15.0 Vulnerability in the Oracle Retail Advanced Science Engine component of Oracle Retail Applications (subcomponent: General). The supported version that is affected is 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Advanced Science Engine. Successful attacks of this vulnerability can result in takeover of Oracle Retail Advanced Science Engine. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-10872V-14.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10872V-14.1 Vulnerability in the Oracle Retail Analytic Parameter Calculator - RO component of Oracle Retail Applications (subcomponent: Installation/Configuration). The supported version that is affected is 15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Analytic Parameter Calculator - RO. Successful attacks of this vulnerability can result in takeover of Oracle Retail Analytic Parameter Calculator - RO. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-5598V-15.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5598V-15.0 Vulnerability in the Oracle Retail Analytics component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.0, 14.1, 15.0 and 16.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Analytics. Successful attacks of this vulnerability can result in takeover of Oracle Retail Analytics. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-9346V-14.0 P-9346V-14.1 P-9346V-15.0 P-9346V-16.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9346V-14.0 P-9346V-14.1 P-9346V-15.0 P-9346V-16.0 Vulnerability in the Oracle Retail Assortment Planning component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1.3, 15.0.1 and 16.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Assortment Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Assortment Planning. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1788V-14.1.3 P-1788V-15.0.1 P-1788V-16.0.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1788V-14.1.3 P-1788V-15.0.1 P-1788V-16.0.0 Vulnerability in the Oracle Retail Category Management component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 13.2, 13.3, 14.0 and 14.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Category Management. Successful attacks of this vulnerability can result in takeover of Oracle Retail Category Management. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1787V-13.2 P-1787V-13.3 P-1787V-14.0 P-1787V-14.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1787V-13.2 P-1787V-13.3 P-1787V-14.0 P-1787V-14.1 Vulnerability in the Oracle Retail Category Management Planning and Optimization component of Oracle Retail Applications (subcomponent: Installation). The supported version that is affected is 15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Category Management Planning and Optimization. Successful attacks of this vulnerability can result in takeover of Oracle Retail Category Management Planning and Optimization. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-12549V-15.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-12549V-15.0 Vulnerability in the Oracle Retail Customer Insights component of Oracle Retail Applications (subcomponent: Installer). The supported version that is affected is 15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Customer Insights. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Insights. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-12562V-15.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-12562V-15.0 Vulnerability in the Oracle Retail Demand Forecasting component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1.3 and 15.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Demand Forecasting. Successful attacks of this vulnerability can result in takeover of Oracle Retail Demand Forecasting. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1800V-14.1.3 P-1800V-15.0.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1800V-14.1.3 P-1800V-15.0.2 Vulnerability in the Oracle Retail Item Planning component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1.3 and 15.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Item Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Item Planning. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1811V-14.1.3 P-1811V-15.0.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1811V-14.1.3 P-1811V-15.0.2 Vulnerability in the Oracle Retail Macro Space Optimization component of Oracle Retail Applications (subcomponent: Installation). The supported version that is affected is 15.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Macro Space Optimization. Successful attacks of this vulnerability can result in takeover of Oracle Retail Macro Space Optimization. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-12548V-15.0.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-12548V-15.0.2 Vulnerability in the Oracle Retail Merchandise Financial Planning component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1.3 and 15.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Merchandise Financial Planning. Successful attacks of this vulnerability can result in takeover of Oracle Retail Merchandise Financial Planning. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1814V-14.1.3 P-1814V-15.0.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1814V-14.1.3 P-1814V-15.0.2 Vulnerability in the Oracle Retail Merchandising Insights component of Oracle Retail Applications (subcomponent: Installer). The supported version that is affected is 15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Merchandising Insights. Successful attacks of this vulnerability can result in takeover of Oracle Retail Merchandising Insights. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-12561V-15.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-12561V-15.0 Vulnerability in the Oracle Retail Order Broker component of Oracle Retail Applications (subcomponent: Order Broker Foundation). Supported versions that are affected are 5.1, 5.2, 15.0 and 16.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Order Broker. Successful attacks of this vulnerability can result in takeover of Oracle Retail Order Broker. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-11520V-5.1 P-11520V-5.2 P-11520V-15.0 P-11520V-16.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11520V-5.1 P-11520V-5.2 P-11520V-15.0 P-11520V-16.0 Vulnerability in the Oracle Retail Predictive Application Server component of Oracle Retail Applications (subcomponent: Installer - Server). Supported versions that are affected are 13.1, 13.2, 13.3, 13.4, 14.0, 14.1 and 15.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Predictive Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1823V-13.1 P-1823V-13.2 P-1823V-13.3 P-1823V-13.4 P-1823V-14.0 P-1823V-14.1 P-1823V-15.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1823V-13.1 P-1823V-13.2 P-1823V-13.3 P-1823V-13.4 P-1823V-14.0 P-1823V-14.1 P-1823V-15.0 Vulnerability in the Oracle Retail Regular Price Optimization component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1.3 and 15.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Regular Price Optimization. Successful attacks of this vulnerability can result in takeover of Oracle Retail Regular Price Optimization. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-4658V-14.1.3 P-4658V-15.0.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4658V-14.1.3 P-4658V-15.0.2 Vulnerability in the Oracle Retail Replenishment Optimization component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1.3 and 15.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Replenishment Optimization. Successful attacks of this vulnerability can result in takeover of Oracle Retail Replenishment Optimization. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1829V-14.1.3 P-1829V-15.0.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1829V-14.1.3 P-1829V-15.0.2 Vulnerability in the Oracle Retail Size Profile Optimization component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1.3 and 15.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Size Profile Optimization. Successful attacks of this vulnerability can result in takeover of Oracle Retail Size Profile Optimization. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-4670V-14.1.3 P-4670V-15.0.2 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4670V-14.1.3 P-4670V-15.0.2 Vulnerability in the Oracle Retail Store Inventory component of Oracle Retail Applications (subcomponent: Installation). Supported versions that are affected are 14.1, 15.0 and 16.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Store Inventory. Successful attacks of this vulnerability can result in takeover of Oracle Retail Store Inventory. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-1838V-14.1 P-1838V-15.0 P-1838V-16.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1838V-14.1 P-1838V-15.0 P-1838V-16.0 Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Point of Sale). Supported versions that are affected are 5.5, 6.0, 6.5, 7.0, 7.1, 15.0 and 16.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in takeover of Oracle Retail Xstore Point of Service. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3506 P-11513V-5.5 P-11513V-6.0 P-11513V-6.5 P-11513V-7.0 P-11513V-7.1 P-11513V-15.0 P-11513V-16.0 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11513V-5.5 P-11513V-6.0 P-11513V-6.5 P-11513V-7.0 P-11513V-7.1 P-11513V-15.0 P-11513V-16.0 Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: GlassFish Server). The supported version that is affected is 4.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris Cluster. Successful attacks of this vulnerability can result in takeover of Solaris Cluster. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-3607 P-10005V-4.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10005V-4.3 Vulnerability in the Oracle Utilities Framework component of Oracle Utilities Applications (subcomponent: UI, Batch and XAI (Xstream)). Supported versions that are affected are 2.2.0.0.0, 4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0 and 4.3.0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Utilities Framework accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2016-3674 P-2245V-2.2.0.0.0 P-2245V-4.1.0.1.0 P-2245V-4.1.0.2.0 P-2245V-4.2.0.1.0 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0 P-2245V-4.3.0.2.0 P-2245V-4.3.0.3.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2245V-2.2.0.0.0 P-2245V-4.1.0.1.0 P-2245V-4.1.0.2.0 P-2245V-4.2.0.1.0 P-2245V-4.2.0.2.0 P-2245V-4.2.0.3.0 P-2245V-4.3.0.1.0 P-2245V-4.3.0.2.0 P-2245V-4.3.0.3.0 Vulnerability in the Secure Global Desktop component of Oracle Virtualization (subcomponent: Core (LibcURL)). Supported versions that are affected are 5.2 and 5.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Secure Global Desktop. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Secure Global Desktop accessible data as well as unauthorized read access to a subset of Secure Global Desktop accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2016-3739 P-8539V-5.2 P-8539V-5.3 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8539V-5.2 P-8539V-5.3 Vulnerability in the StorageTek Tape Analytics SW Tool component of Oracle Sun Systems Products Suite (subcomponent: Core (Apache Trinidad)). The supported version that is affected is Prior to 2.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise StorageTek Tape Analytics SW Tool. Successful attacks of this vulnerability can result in takeover of StorageTek Tape Analytics SW Tool. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5019 P-10085V-Prior to 2.2.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10085V-Prior to 2.2.1 Vulnerability in the Oracle Utilities Customer Self Service component of Oracle Utilities Applications (subcomponent: Packaging (Apache Trinidad)). The supported version that is affected is 2.1.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Customer Self Service. Successful attacks of this vulnerability can result in takeover of Oracle Utilities Customer Self Service. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5019 P-9426V-2.1.0.2.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9426V-2.1.0.2.0 Vulnerability in the Secure Global Desktop component of Oracle Virtualization (subcomponent: Window System (X11)). Supported versions that are affected are 4.71, 5.2 and 5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Secure Global Desktop. Successful attacks of this vulnerability can result in takeover of Secure Global Desktop. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-5407 P-8539V-4.71 P-8539V-5.2 P-8539V-5.3 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8539V-4.71 P-8539V-5.2 P-8539V-5.3 Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: NAS device addition). The supported version that is affected is 4.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris Cluster executes to compromise Solaris Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris Cluster accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Fix has been released CVE-2016-5551 P-10005V-4.3 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10005V-4.3 Vulnerability in the PHP component of Oracle Secure Backup. The supported version that is affected is Prior to 12.1.0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise PHP. Successful attacks of this vulnerability can result in takeover of PHP. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-6290 P-1522V-Prior to 12.1.0.3.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1522V-Prior to 12.1.0.3.0 Vulnerability in the Oracle API Gateway component of Oracle Fusion Middleware (subcomponent: Oracle API Gateway (OpenSSL)). The supported version that is affected is 11.1.2.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle API Gateway. Successful attacks of this vulnerability can result in takeover of Oracle API Gateway. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-6303 P-9195V-11.1.2.4.0 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9195V-11.1.2.4.0 Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security: Encryption (OpenSSL)). Supported versions that are affected are 6.3.8 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Workbench. Successful attacks of this vulnerability can result in takeover of MySQL Workbench. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2016-6303 P-4627V-6.3.8 and earlier 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4627V-6.3.8 and earlier Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: MDEX). Supported versions that are affected are 6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1 and 6.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-9633V-6.2.2 P-9633V-6.3.0 P-9633V-6.4.1.2 P-9633V-6.5.0 P-9633V-6.5.1 P-9633V-6.5.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9633V-6.2.2 P-9633V-6.3.0 P-9633V-6.4.1.2 P-9633V-6.5.0 P-9633V-6.5.1 P-9633V-6.5.2 Vulnerability in the Oracle Communications Session Border Controller component of Oracle Communications Applications (subcomponent: Routing (OpenSSL)). Supported versions that are affected are SCZ7.2.0, SCZ7.3.0 and SCZ7.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Session Border Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Session Border Controller. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-10750V-SCZ7.2.0 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10750V-SCZ7.2.0 P-10750V-SCZ7.3.0 P-10750V-SCZ7.4.0 Vulnerability in the OSS Support Tools component of Oracle Support Tools (subcomponent: Oracle Explorer (OpenSSL)). The supported version that is affected is Prior to RDA 8.15.17.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise OSS Support Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of OSS Support Tools. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2016-6304 P-1330V-Prior to RDA 8.15.17.3.14 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1330V-Prior to RDA 8.15.17.3.14 Vulnerability in the Secure Global Desktop component of Oracle Virtualization (subcomponent: Web Server (Apache HTTP Server)). Supported versions that are affected are 4.71, 5.2 and 5.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Secure Global Desktop. While the vulnerability is in Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Secure Global Desktop accessible data. CVSS 3.0 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N). Fix has been released CVE-2016-8743 P-8539V-4.71 P-8539V-5.2 P-8539V-5.3 4.0 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8539V-4.71 P-8539V-5.2 P-8539V-5.3 Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported versions that are affected are 11.1.1.9, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Fusion Middleware MapViewer accessible data as well as unauthorized read access to a subset of Oracle Fusion Middleware MapViewer accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Fusion Middleware MapViewer. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L). Fix has been released CVE-2017-3230 P-1215V-11.1.1.9 P-1215V-12.2.1.1 P-1215V-12.2.1.2 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1215V-11.1.1.9 P-1215V-12.2.1.1 P-1215V-12.2.1.2 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3232 P-9042V-Prior to 5.7 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-3233 P-9042V-Prior to 5.7 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFT to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in takeover of Automatic Service Request (ASR). CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3234 P-9042V-Prior to 5.7 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in takeover of Automatic Service Request (ASR). CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3237 P-9042V-Prior to 5.7 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Oracle Retail Invoice Matching component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 12.0 and 13.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Invoice Matching. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Invoice Matching accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Invoice Matching accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Invoice Matching. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L). Fix has been released CVE-2017-3254 P-1810V-12.0 P-1810V-13.0 7.6 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1810V-12.0 P-1810V-13.0 Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Unit Trust). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3288 P-9099V-12.0.1 P-9099V-12.0.2 P-9099V-12.0.3 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.2.0 P-9099V-12.3.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9099V-12.0.1 P-9099V-12.0.2 P-9099V-12.0.3 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.2.0 P-9099V-12.3.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.54 and earlier and 5.6.20 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3302 P-8478V-5.5.54 and earlier P-8478V-5.6.20 and earlier 5.1 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.20 and earlier Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: DD). Supported versions that are affected are 7.2.27 and earlier, 7.3.16 and earlier, 7.4.14 and earlier and 7.5.5 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2017-3304 P-8479V-7.2.27 and earlier P-8479V-7.3.16 and earlier P-8479V-7.4.14 and earlier P-8479V-7.5.5 and earlier 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8479V-7.2.27 and earlier P-8479V-7.3.16 and earlier P-8479V-7.4.14 and earlier P-8479V-7.5.5 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6.35 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3305 P-8478V-5.5.55 and earlier P-8478V-5.6.35 and earlier 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.55 and earlier P-8478V-5.6.35 and earlier Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server). Supported versions that are affected are 3.1.6.8003 and earlier, 3.2.1182 and earlier and 3.3.2.1162 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Enterprise Monitor, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Enterprise Monitor accessible data as well as unauthorized access to critical data or complete access to all MySQL Enterprise Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Enterprise Monitor. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L). Fix has been released CVE-2017-3306 P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier 8.3 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server). Supported versions that are affected are 3.1.6.8003 and earlier, 3.2.1182 and earlier and 3.3.2.1162 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Enterprise Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Enterprise Monitor. CVSS 3.0 Base Score 3.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L). Fix has been released CVE-2017-3307 P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier 3.1 AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Fix has been released CVE-2017-3308 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Fix has been released CVE-2017-3309 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Thread Pooling). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3329 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). The supported version that is affected is 5.7.11 to 5.7.17. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3331 P-8478V-5.7.11 to 5.7.17 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.11 to 5.7.17 Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3337 P-229V-12.1.1 P-229V-12.1.2 P-229V-12.1.3 P-229V-12.2.3 P-229V-12.2.4 P-229V-12.2.5 P-229V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-229V-12.1.1 P-229V-12.1.2 P-229V-12.1.3 P-229V-12.2.3 P-229V-12.2.4 P-229V-12.2.5 P-229V-12.2.6 Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: Interaction History). Supported versions that are affected are 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3393 P-785V-12.2.3 P-785V-12.2.4 P-785V-12.2.5 P-785V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-785V-12.2.3 P-785V-12.2.4 P-785V-12.2.5 P-785V-12.2.6 Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Audience workbench). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3432 P-1379V-12.1.1 P-1379V-12.1.2 P-1379V-12.1.3 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1379V-12.1.1 P-1379V-12.1.2 P-1379V-12.1.3 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3450 P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the Oracle Retail Open Commerce Platform component of Oracle Retail Applications (subcomponent: Web). Supported versions that are affected are 4.0, 5.0, 5.1, 5.3, 6.0,6.1, 15.0 and 16.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Open Commerce Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Open Commerce Platform, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Open Commerce Platform accessible data as well as unauthorized read access to a subset of Oracle Retail Open Commerce Platform accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3451 P-11521V-4.0 P-11521V-5.0 P-11521V-5.1 P-11521V-5.3 P-11521V-6.0 P-11521V-6.1 P-11521V-15.0 P-11521V-16.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11521V-4.0 P-11521V-5.0 P-11521V-5.1 P-11521V-5.3 P-11521V-6.0 P-11521V-6.1 P-11521V-15.0 P-11521V-16.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.35 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3452 P-8478V-5.6.35 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.6.35 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3453 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Fix has been released CVE-2017-3454 P-8478V-5.7.17 and earlier 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.17 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3455 P-8478V-5.7.17 and earlier 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3456 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3457 P-8478V-5.7.17 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3458 P-8478V-5.7.17 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3459 P-8478V-5.7.17 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Audit Plug-in). Supported versions that are affected are 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3460 P-8478V-5.7.17 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3461 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3462 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3463 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3464 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.17 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3465 P-8478V-5.7.17 and earlier 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.7.17 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3467 P-8478V-5.7.17 and earlier 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.7.17 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3468 P-8478V-5.7.17 and earlier 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.7.17 and earlier Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security : Encryption). Supported versions that are affected are 6.3.8 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Workbench. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Workbench accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3469 P-4627V-6.3.8 and earlier 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4627V-6.3.8 and earlier Vulnerability in the Oracle Communications Security Gateway component of Oracle Communications Applications (subcomponent: Network). The supported version that is affected is 3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via ICMP Ping to compromise Oracle Communications Security Gateway. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Security Gateway. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-3470 P-10755V-3.0.0 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10755V-3.0.0 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). Fix has been released CVE-2017-3471 P-9110V-12.0.0 P-9110V-12.1.0 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-12.0.0 P-9110V-12.1.0 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Portfolio Management). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0.1 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Private Banking accessible data as well as unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3472 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0.1 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3473 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Zone). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3474 P-10006V-11.3 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-11.3 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0.1 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. While the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Private Banking. CVSS 3.0 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L). Fix has been released CVE-2017-3475 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 5.0 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0.1 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data as well as unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-3476 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 12.0.0 and 12.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3477 P-9110V-12.0.0 P-9110V-12.1.0 4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-12.0.0 P-9110V-12.1.0 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3478 P-9110V-12.0.0 P-9110V-12.1.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-12.0.0 P-9110V-12.1.0 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0.1 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Private Banking. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2017-3479 P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-2.0.0 P-9110V-2.0.1 P-9110V-2.2.0.1 P-9110V-12.0.1 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0 and 12.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N). Fix has been released CVE-2017-3480 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Fix has been released CVE-2017-3481 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3482 P-9052V-12.0.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9052V-12.0.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Limits and Collateral). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle FLEXCUBE Enterprise Limits and Collateral Management executes to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3483 P-9100V-12.0.0 P-9100V-12.1.0 4.4 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Limits and Collateral). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3484 P-9100V-12.0.0 P-9100V-12.1.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 6.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H). Fix has been released CVE-2017-3485 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 6.8 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 Vulnerability in the SQL*Plus component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Difficult to exploit vulnerability allows high privileged attacker having Local Logon privilege with logon to the infrastructure where SQL*Plus executes to compromise SQL*Plus. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in SQL*Plus, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of SQL*Plus. Note: This score is for Windows platform version 11.2.0.4 of Database. For Windows platform version 12.1.0.2 and Linux, the score is 6.3 with scope Unchanged. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3486 P-50V-11.2.0.4 P-50V-12.1.0.2 7.2 AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-50V-11.2.0.4 P-50V-12.1.0.2 Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Unit Trust). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3487 P-9099V-12.0.1 P-9099V-12.0.2 P-9099V-12.0.3 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.2.0 P-9099V-12.3.0 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9099V-12.0.1 P-9099V-12.0.2 P-9099V-12.0.3 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.2.0 P-9099V-12.3.0 Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Unit Trust). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-3488 P-9099V-12.0.1 P-9099V-12.0.2 P-9099V-12.0.3 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.2.0 P-9099V-12.3.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9099V-12.0.1 P-9099V-12.0.2 P-9099V-12.0.3 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.2.0 P-9099V-12.3.0 Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Security Management System). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3489 P-9099V-12.0.1 P-9099V-12.0.2 P-9099V-12.0.3 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.2.0 P-9099V-12.3.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9099V-12.0.1 P-9099V-12.0.2 P-9099V-12.0.3 P-9099V-12.0.4 P-9099V-12.1.0 P-9099V-12.2.0 P-9099V-12.3.0 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Limits and Collateral). Supported versions that are affected are 12.0.0 and 12.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3490 P-9100V-12.0.0 P-9100V-12.1.0 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Limits and Collateral). Supported versions that are affected are 12.0.1 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3491 P-9100V-12.0.1 P-9100V-12.1.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9100V-12.0.1 P-9100V-12.1.0 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3492 P-9100V-12.0.0 P-9100V-12.1.0 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. While the vulnerability is in Oracle FLEXCUBE Enterprise Limits and Collateral Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Enterprise Limits and Collateral Management. CVSS 3.0 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). Fix has been released CVE-2017-3493 P-9100V-12.0.0 P-9100V-12.1.0 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Retail Teller). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2 and 12.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N). Fix has been released CVE-2017-3494 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Pre-Login). Supported versions that are affected are 12.0.2 and 12.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Direct Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Direct Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Direct Banking accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N). Fix has been released CVE-2017-3495 P-9111V-12.0.2 P-9111V-12.0.3 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9111V-12.0.2 P-9111V-12.0.3 Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.0 and 12.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Enterprise Limits and Collateral Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Enterprise Limits and Collateral Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Enterprise Limits and Collateral Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3496 P-9100V-12.0.0 P-9100V-12.1.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9100V-12.0.0 P-9100V-12.1.0 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Remote Administration Daemon). The supported version that is affected is 11.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-3497 P-10006V-11.3 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-11.3 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3498 P-10006V-11.3 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-11.3 Vulnerability in the Oracle Social Network component of Oracle Fusion Middleware (subcomponent: Android Client). The supported version that is affected is prior to 11.1.12.0.0 (17019101). Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Social Network. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Social Network accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3499 P-9432V-prior to 11.1.12.0.0 (17019101) 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9432V-prior to 11.1.12.0.0 (17019101) Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite (subcomponent: Primavera Desktop Integration). Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Gateway. While the vulnerability is in Primavera Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Gateway accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway. CVSS 3.0 Base Score 8.7 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H). Fix has been released CVE-2017-3500 P-10605V-1.0 P-10605V-1.1 P-10605V-14.2 P-10605V-15.1 P-10605V-15.2 P-10605V-16.1 P-10605V-16.2 8.7 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10605V-1.0 P-10605V-1.1 P-10605V-14.2 P-10605V-15.1 P-10605V-15.2 P-10605V-16.1 P-10605V-16.2 Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform). Supported versions that are affected are 9.13, 9.14, 10.0, 10.1, 15.1 and 15.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3501 P-10354V-9.13 P-10354V-9.14 P-10354V-10.0 P-10354V-10.1 P-10354V-15.1 P-10354V-15.2 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10354V-9.13 P-10354V-9.14 P-10354V-10.0 P-10354V-10.1 P-10354V-15.1 P-10354V-15.2 Vulnerability in the PeopleSoft Enterprise FIN Receivables component of Oracle PeopleSoft Products (subcomponent: Receivables). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Receivables. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Receivables accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3502 P-5021V-9.2 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5021V-9.2 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access (Apache Commons BeanUtils)). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. While the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Primavera P6 Enterprise Project Portfolio Management. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3503 P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Automatic Service Request (ASR) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Automatic Service Request (ASR). CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2017-3504 P-9042V-Prior to 5.7 5.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Automatic Service Request (ASR) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Automatic Service Request (ASR). CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Fix has been released CVE-2017-3505 P-9042V-Prior to 5.7 5.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3506 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Console Design). Supported versions that are affected are 12.1.3.0.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Service Bus accessible data as well as unauthorized read access to a subset of Oracle Service Bus accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Service Bus. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Fix has been released CVE-2017-3507 P-5308V-12.1.3.0.0 P-5308V-12.2.1.0.0 P-5308V-12.2.1.1.0 P-5308V-12.2.1.2.0 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5308V-12.1.3.0.0 P-5308V-12.2.1.0.0 P-5308V-12.2.1.1.0 P-5308V-12.2.1.2.0 Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite (subcomponent: Primavera Desktop Integration). Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Primavera Gateway. While the vulnerability is in Primavera Gateway, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Primavera Gateway. CVSS 3.0 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3508 P-10605V-1.0 P-10605V-1.1 P-10605V-14.2 P-10605V-15.1 P-10605V-15.2 P-10605V-16.1 P-10605V-16.2 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10605V-1.0 P-10605V-1.1 P-10605V-14.2 P-10605V-15.1 P-10605V-15.2 P-10605V-16.1 P-10605V-16.2 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3509 P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121 4.2 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel Zones virtualized NIC driver). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris accessible data. CVSS 3.0 Base Score 7.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N). Fix has been released CVE-2017-3510 P-10006V-11.3 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-11.3 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3511 P-856V-Java SE: 7u131 P-856V-8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 7.7 AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-856V-Java SE: 7u131 P-856V-8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u131 and 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3512 P-856V-Java SE: 7u131 P-856V-8u121 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-856V-Java SE: 7u131 P-856V-8u121 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N). Fix has been released CVE-2017-3513 P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 2.5 AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3514 P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121 Vulnerability in the Oracle User Management component of Oracle E-Business Suite (subcomponent: User Name/Password Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle User Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle User Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle User Management accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). Fix has been released CVE-2017-3515 P-1475V-12.1.3 P-1475V-12.2.3 P-1475V-12.2.4 P-1475V-12.2.5 P-1475V-12.2.6 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1475V-12.1.3 P-1475V-12.2.3 P-1475V-12.2.4 P-1475V-12.2.5 P-1475V-12.2.6 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel Zones virtualized NIC driver). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Fix has been released CVE-2017-3516 P-10006V-11.3 7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-11.3 Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime SEC). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Fix has been released CVE-2017-3517 P-4781V-9.2 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4781V-9.2 Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control (subcomponent: Discovery Framework). Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3518 P-1370V-12.1.0 P-1370V-13.1.0 P-1370V-13.2.0 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1370V-12.1.0 P-1370V-13.1.0 P-1370V-13.2.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Security). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3519 P-5085V-8.54 P-5085V-8.55 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Core). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). Fix has been released CVE-2017-3520 P-5085V-8.54 P-5085V-8.55 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise SCM Purchasing component of Oracle PeopleSoft Products (subcomponent: Supplier Registration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3521 P-5133V-9.2 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5133V-9.2 Vulnerability in the PeopleSoft Enterprise SCM eSupplier Connection component of Oracle PeopleSoft Products (subcomponent: Vendor). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eSupplier Connection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM eSupplier Connection accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eSupplier Connection accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3522 P-5122V-9.2 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5122V-9.2 Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and eariler. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3523 P-8576V-5.1.40 and eariler 8.5 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8576V-5.1.40 and eariler Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing component of Oracle PeopleSoft Products (subcomponent: Bidder Registration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Strategic Sourcing accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Strategic Sourcing accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3524 P-5136V-9.2 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5136V-9.2 Vulnerability in the PeopleSoft Enterprise SCM Service Procurement component of Oracle PeopleSoft Products (subcomponent: Usability). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Service Procurement. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Service Procurement accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Service Procurement accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3525 P-5135V-9.2 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5135V-9.2 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3526 P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Core). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3527 P-5085V-8.54 P-5085V-8.55 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). Fix has been released CVE-2017-3528 P-1472V-12.1.3 P-1472V-12.2.3 P-1472V-12.2.4 P-1472V-12.2.5 P-1472V-12.2.6 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1472V-12.1.3 P-1472V-12.2.3 P-1472V-12.2.4 P-1472V-12.2.5 P-1472V-12.2.6 Vulnerability in the Oracle Transportation Manager component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1 and 6.4.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Transportation Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Transportation Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Transportation Manager accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3530 P-1991V-6.2 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 P-1991V-6.4.0 P-1991V-6.4.1 P-1991V-6.4.2 6.1 AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1991V-6.2 P-1991V-6.3.0 P-1991V-6.3.1 P-1991V-6.3.2 P-1991V-6.3.3 P-1991V-6.3.4 P-1991V-6.3.5 P-1991V-6.3.6 P-1991V-6.3.7 P-1991V-6.4.0 P-1991V-6.4.1 P-1991V-6.4.2 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Servlet Runtime). Supported versions that are affected are 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 7.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L). Fix has been released CVE-2017-3531 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 7.2 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the Oracle Retail Warehouse Management System component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.2, 14.0 and 15.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Warehouse Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Warehouse Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Warehouse Management System accessible data as well as unauthorized read access to a subset of Oracle Retail Warehouse Management System accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3532 P-1847V-13.2 P-1847V-14.0 P-1847V-15.0 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1847V-13.2 P-1847V-14.0 P-1847V-15.0 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3533 P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3534 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 P-9052V-12.1.0 P-9052V-12.2.0 P-9052V-12.3.0 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2 and 12.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N). Fix has been released CVE-2017-3535 P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 4.7 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9052V-11.3.0 P-9052V-11.4.0 P-9052V-12.0.1 P-9052V-12.0.2 P-9052V-12.0.3 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Security). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3536 P-5085V-8.54 P-5085V-8.55 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Oracle Real-Time Scheduler component of Oracle Utilities Applications (subcomponent: Mobile Communications Platform). Supported versions that are affected are 2.2.0.3.13, 2.3.0.0 and 2.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Real-Time Scheduler. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Real-Time Scheduler, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Real-Time Scheduler accessible data as well as unauthorized read access to a subset of Oracle Real-Time Scheduler accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3537 P-2238V-2.2.0.3.13 P-2238V-2.3.0.0 P-2238V-2.3.0.1 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2238V-2.2.0.3.13 P-2238V-2.3.0.0 P-2238V-2.3.0.1 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Supported versions that are affected are Prior to 5.0.34 and Prior to 5.1.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). Fix has been released CVE-2017-3538 P-8370V-Prior to 5.0.34 P-8370V-Prior to 5.1.16 7.5 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.34 P-8370V-Prior to 5.1.16 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3539 P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Sites as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data and unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). Fix has been released CVE-2017-3540 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-3541 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Sites. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2017-3542 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Sites. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2017-3543 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3544 P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-856V-Java SE: 6u141 P-856V-7u131 P-856V-8u121; Java SE Embedded: 8u121; JRockit: R28.3.13 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Blob Server). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Fix has been released CVE-2017-3545 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3546 P-5085V-8.54 P-5085V-8.55 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N). Fix has been released CVE-2017-3547 P-5085V-8.54 P-5085V-8.55 7.4 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Fix has been released CVE-2017-3548 P-5085V-8.54 P-5085V-8.55 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5085V-8.54 P-5085V-8.55 Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3549 P-433V-12.1.1 P-433V-12.1.2 P-433V-12.1.3 P-433V-12.2.3 P-433V-12.2.4 P-433V-12.2.5 P-433V-12.2.6 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-433V-12.1.1 P-433V-12.1.2 P-433V-12.1.3 P-433V-12.2.3 P-433V-12.2.4 P-433V-12.2.5 P-433V-12.2.6 Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: Admin Console). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Customer Interaction History, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Customer Interaction History accessible data as well as unauthorized update, insert or delete access to some of Oracle Customer Interaction History accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3550 P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1374V-12.1.1 P-1374V-12.1.2 P-1374V-12.1.3 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Smartcard Libraries). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris as well as unauthorized update, insert or delete access to some of Solaris accessible data and unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H). Fix has been released CVE-2017-3551 P-10006V-11.3 6.6 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-11.3 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Room Image/Picture Setup). Supported versions that are affected are 5.4.0.x, 5.4.1.x, 5.4.2.x, 5.4.3.x, 5.5.0.x and 5.5.1.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3552 P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Rules Engine). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3553 P-1980V-11.1.2.3.0 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1980V-11.1.2.3.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Catalog Mover). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3554 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle iReceivables component of Oracle E-Business Suite (subcomponent: Self Registration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle iReceivables. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3555 P-1106V-12.1.1 P-1106V-12.1.2 P-1106V-12.1.3 P-1106V-12.2.3 P-1106V-12.2.4 P-1106V-12.2.5 P-1106V-12.2.6 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1106V-12.1.1 P-1106V-12.1.2 P-1106V-12.1.3 P-1106V-12.2.3 P-1106V-12.2.4 P-1106V-12.2.5 P-1106V-12.2.6 Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: File Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3556 P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-510V-12.1.3 P-510V-12.2.3 P-510V-12.2.4 P-510V-12.2.5 P-510V-12.2.6 Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Print Server). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3557 P-1379V-12.1.3 P-1379V-12.2.3 P-1379V-12.2.4 P-1379V-12.2.5 P-1379V-12.2.6 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-1379V-12.1.3 P-1379V-12.2.3 P-1379V-12.2.4 P-1379V-12.2.5 P-1379V-12.2.6 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-3558 P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 8.5 AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H). Fix has been released CVE-2017-3559 P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 7.9 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OXI Interface). Supported versions that are affected are 5.4.0.x, 5.4.1.x, 5.4.2.x, 5.4.3.x, 5.5.0.x and 5.5.1.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3560 P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3561 P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3563 P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: RBAC). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3564 P-10006V-11.3 8.2 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-11.3 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: RBAC). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris accessible data as well as unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 7.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). Fix has been released CVE-2017-3565 P-10006V-11.3 7.9 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-11.3 Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise OJVM. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of OJVM. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3567 P-5V-11.2.0.4 P-5V-12.1.0.2 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5V-11.2.0.4 P-5V-12.1.0.2 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Printing and Login). Supported versions that are affected are 5.4.0.x, 5.4.1.x, 5.4.2.x, 5.4.3.x, 5.5.0.x and 5.5.1.x. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality OPERA 5 Property Services executes to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.0 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L). Fix has been released CVE-2017-3568 P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x 6.5 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Business Events). Supported versions that are affected are 5.4.0.x, 5.4.1.x, 5.4.2.x, 5.4.3.x, 5.5.0.x and 5.5.1.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized read access to a subset of Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Fix has been released CVE-2017-3569 P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x 5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: eSettlements). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FSCM accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3570 P-4987V-9.1 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4987V-9.1 Vulnerability in the PeopleSoft Enterprise SCM eBill Payment component of Oracle PeopleSoft Products (subcomponent: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eBill Payment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM eBill Payment accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eBill Payment accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3571 P-5115V-9.2 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5115V-9.2 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: MDEX). Supported versions that are affected are 6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1 and 6.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3572 P-9633V-6.2.2 P-9633V-6.3.0 P-9633V-6.4.1.2 P-9633V-6.5.0 P-9633V-6.5.1 P-9633V-6.5.2 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9633V-6.2.2 P-9633V-6.3.0 P-9633V-6.4.1.2 P-9633V-6.5.0 P-9633V-6.5.1 P-9633V-6.5.2 Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Printing). Supported versions that are affected are 5.4.0.x, 5.4.1.x, 5.4.2.x, 5.4.3.x, 5.5.0.x and 5.5.1.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized read access to a subset of Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3573 P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA License code configuration). Supported versions that are affected are 5.4.0.x, 5.4.1.x, 5.4.2.x, 5.4.3.x, 5.5.0.x and 5.5.1.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-3574 P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11580V-5.4.0.x P-11580V-5.4.1.x P-11580V-5.4.2.x P-11580V-5.4.3.x P-11580V-5.5.0.x P-11580V-5.5.1.x Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H). Fix has been released CVE-2017-3575 P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 7.9 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3576 P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3577 P-5183V-9.2 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5183V-9.2 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: RAS subsystems). The supported version that is affected is AK 2013. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Sun ZFS Storage Appliance Kit (AK) executes to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3578 P-10026V-AK 2013 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10026V-AK 2013 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3579 P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: RAS subsystems). The supported version that is affected is AK 2013. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3580 P-10026V-AK 2013 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10026V-AK 2013 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in takeover of Automatic Service Request (ASR). CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3581 P-9042V-Prior to 5.7 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Oracle SuperCluster Specific Software component of Oracle Sun Systems Products Suite (subcomponent: Backup/Restore Utility). Supported versions that are affected are 2.3.8 and 2.3.13. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle SuperCluster Specific Software executes to compromise Oracle SuperCluster Specific Software. Successful attacks of this vulnerability can result in takeover of Oracle SuperCluster Specific Software. CVSS 3.0 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3582 P-10011V-2.3.8 P-10011V-2.3.13 8.4 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10011V-2.3.8 P-10011V-2.3.13 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3583 P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5579V-8.3 P-5579V-8.4 P-5579V-15.1 P-5579V-15.2 P-5579V-16.1 P-5579V-16.2 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: RAS subsystems). The supported version that is affected is AK 2013. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Sun ZFS Storage Appliance Kit (AK) executes to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3584 P-10026V-AK 2013 7.8 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10026V-AK 2013 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: User Interface subsystem). The supported version that is affected is AK 2013. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Sun ZFS Storage Appliance Kit (AK) accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3585 P-10026V-AK 2013 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10026V-AK 2013 Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Fix has been released CVE-2017-3586 P-8576V-5.1.41 and earlier 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8576V-5.1.41 and earlier Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H). Fix has been released CVE-2017-3587 P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 8.4 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8370V-Prior to 5.0.38 P-8370V-Prior to 5.1.20 Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3589 P-8576V-5.1.41 and earlier 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8576V-5.1.41 and earlier Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 2.1.5 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Fix has been released CVE-2017-3590 P-8576V-2.1.5 and earlier 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8576V-2.1.5 and earlier Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Catalog Mover). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N). Fix has been released CVE-2017-3591 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payables. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payables accessible data as well as unauthorized access to critical data or complete access to all Oracle Payables accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3592 P-506V-12.1.1 P-506V-12.1.2 P-506V-12.1.3 P-506V-12.2.3 P-506V-12.2.4 P-506V-12.2.5 P-506V-12.2.6 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-506V-12.1.1 P-506V-12.1.2 P-506V-12.1.3 P-506V-12.2.3 P-506V-12.2.4 P-506V-12.2.5 P-506V-12.2.6 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-3593 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-3594 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 5.9 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Fix has been released CVE-2017-3595 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Sites. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Fix has been released CVE-2017-3596 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 7.6 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3597 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 5.7 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3598 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions that are affected are 5.6.35 and earlier and 5.7.17 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3599 P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. Note: CVE-2017-3600 is equivalent to CVE-2016-5483. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3600 P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8478V-5.5.54 and earlier P-8478V-5.6.35 and earlier P-8478V-5.7.17 and earlier Vulnerability in the Oracle API Gateway component of Oracle Fusion Middleware (subcomponent: Oracle API Gateway). The supported version that is affected is 11.1.2.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle API Gateway. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle API Gateway accessible data as well as unauthorized access to critical data or complete access to all Oracle API Gateway accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3601 P-9195V-11.1.2.4.0 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9195V-11.1.2.4.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3602 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3603 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3604 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3605 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3606 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3607 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3608 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3609 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3610 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3611 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3612 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3613 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3614 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3615 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3616 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3617 P-2051V-Prior to 6.2.32 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2051V-Prior to 6.2.32 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data as well as unauthorized access to critical data or complete access to all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Fix has been released CVE-2017-3618 P-9042V-Prior to 5.7 7.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3619 P-9042V-Prior to 5.7 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in takeover of Automatic Service Request (ASR). CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3620 P-9042V-Prior to 5.7 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9042V-Prior to 5.7 Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: IPC Frameworks). The supported version that is affected is AK 2013. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3621 P-10026V-AK 2013 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10026V-AK 2013 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)). The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3622 is assigned for the "Extremeparr". CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-3622 P-10006V-10 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-10 Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). For supported versions that are affected see note. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3623 is assigned for "Ebbisland". Solaris 10 systems which have had any Kernel patch installed after, or updated via patching tools since 2012-01-26 are not impacted. Also, any Solaris 10 system installed with Solaris 10 1/13 (Solaris 10 Update 11) are not vulnerable. Solaris 11 is not impacted by this issue. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-3623 P-10006V-None 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10006V-None Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.7, 11.1.1.9, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). Fix has been released CVE-2017-3625 P-2271V-11.1.1.7 P-2271V-11.1.1.9 P-2271V-12.2.1.0 P-2271V-12.2.1.1 P-2271V-12.2.1.2 8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-2271V-11.1.1.7 P-2271V-11.1.1.9 P-2271V-12.2.1.0 P-2271V-12.2.1.1 P-2271V-12.2.1.2 Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Fix has been released CVE-2017-3626 P-8493V-3.1.2 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8493V-3.1.2 Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: General (OpenSSL)). Supported versions that are affected are 3.1.6.8003 and earlier, 3.2.1182 and earlier and 3.3.2.1162 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Enterprise Monitor accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3731 P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier Vulnerability in the Secure Global Desktop component of Oracle Virtualization (subcomponent: Core (OpenSSL)). Supported versions that are affected are 4.71, 5.2 and 5.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Secure Global Desktop. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Secure Global Desktop. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Fix has been released CVE-2017-3731 P-8539V-4.71 P-8539V-5.2 P-8539V-5.3 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8539V-4.71 P-8539V-5.2 P-8539V-5.3 Vulnerability in the Oracle Communications Security Gateway component of Oracle Communications Applications (subcomponent: Routing (OpenSSL)). The supported version that is affected is 3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Security Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Security Gateway accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-10755V-3.0.0 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10755V-3.0.0 Vulnerability in the MySQL Enterprise Backup component of Oracle MySQL (subcomponent: Backup: ENTRBACK (OpenSSL)). Supported versions that are affected are 3.12.3 and earlier and 4.0.3 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise Backup. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Enterprise Backup accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-4629V-3.12.3 and earlier P-4629V-4.0.3 and earlier 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4629V-3.12.3 and earlier P-4629V-4.0.3 and earlier Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Project Manager (OpenSSL)). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Fix has been released CVE-2017-3732 P-5580V-8.3 P-5580V-8.4 P-5580V-15.1 P-5580V-15.2 P-5580V-16.1 P-5580V-16.2 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5580V-8.3 P-5580V-8.4 P-5580V-15.1 P-5580V-15.2 P-5580V-16.1 P-5580V-16.2 Vulnerability in the Oracle Communications Policy Management component of Oracle Communications Applications (subcomponent: Security (Struts 2)). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management. While the vulnerability is in Oracle Communications Policy Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-10900V-12.2 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10900V-12.2 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3 and 12.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. While the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle FLEXCUBE Private Banking. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9110V-12.0.1 P-9110V-12.0.2 P-9110V-12.0.3 P-9110V-12.1.0 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9110V-12.0.1 P-9110V-12.0.2 P-9110V-12.0.3 P-9110V-12.1.0 Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 7.3.3, 7.3.4 and 7.3.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. While the vulnerability is in Oracle Financial Services Analytical Applications Infrastructure, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-5680V-7.3.3 P-5680V-7.3.4 P-5680V-7.3.5 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5680V-7.3.3 P-5680V-7.3.4 P-5680V-7.3.5 Vulnerability in the Oracle Financial Services Reconciliation Framework component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 8.0.0, 8.0.1 and 8.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Reconciliation Framework. While the vulnerability is in Oracle Financial Services Reconciliation Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Reconciliation Framework. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-5748V-8.0.0 P-5748V-8.0.1 P-5748V-8.0.2 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5748V-8.0.0 P-5748V-8.0.1 P-5748V-8.0.2 Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 6.0.0, 6.1.0, 6.1.1, 8.0.1, 8.0.2, 8.0.3 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Asset Liability Management. While the vulnerability is in Oracle Financial Services Asset Liability Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Asset Liability Management. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-5662V-6.0.0 P-5662V-6.1.0 P-5662V-6.1.1 P-5662V-8.0.1 P-5662V-8.0.2 P-5662V-8.0.3 P-5662V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5662V-6.0.0 P-5662V-6.1.0 P-5662V-6.1.1 P-5662V-8.0.1 P-5662V-8.0.2 P-5662V-8.0.3 P-5662V-8.0.4 Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 6.1.2, 6.1.3, 8.0.2 and 8.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Basel Regulatory Capital Basic. While the vulnerability is in Oracle Financial Services Basel Regulatory Capital Basic, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Basel Regulatory Capital Basic. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9612V-6.1.2 P-9612V-6.1.3 P-9612V-8.0.2 P-9612V-8.0.3 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9612V-6.1.2 P-9612V-6.1.3 P-9612V-8.0.2 P-9612V-8.0.3 Vulnerability in the Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 6.1.2, 6.1.3, 8.0.2 and 8.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach. While the vulnerability is in Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9450V-6.1.2 P-9450V-6.1.3 P-9450V-8.0.2 P-9450V-8.0.3 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9450V-6.1.2 P-9450V-6.1.3 P-9450V-8.0.2 P-9450V-8.0.3 Vulnerability in the Oracle Financial Services Data Foundation component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 8.0.1, 8.0.2,8.0.3 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Data Foundation. While the vulnerability is in Oracle Financial Services Data Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Data Foundation. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9180V-8.0.1 P-9180V-8.0.2 P-9180V-8.0.3 P-9180V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9180V-8.0.1 P-9180V-8.0.2 P-9180V-8.0.3 P-9180V-8.0.4 Vulnerability in the Oracle Financial Services Data Integration Hub component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 8.0.1, 8.0.2,8.0.3 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Data Integration Hub. While the vulnerability is in Oracle Financial Services Data Integration Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Data Integration Hub. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-11289V-8.0.1 P-11289V-8.0.2 P-11289V-8.0.3 P-11289V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11289V-8.0.1 P-11289V-8.0.2 P-11289V-8.0.3 P-11289V-8.0.4 Vulnerability in the Oracle Financial Services Enterprise Financial Performance Analytics component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). The supported version that is affected is 8.0.0 to 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Enterprise Financial Performance Analytics. While the vulnerability is in Oracle Financial Services Enterprise Financial Performance Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Enterprise Financial Performance Analytics. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-4279V-8.0.0 to 8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-4279V-8.0.0 to 8.0.4 Vulnerability in the Oracle Financial Services Funds Transfer Pricing component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 6.0.0, 6.1.0, 6.1.1, 8.0.1, 8.0.2, 8.0.3 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Funds Transfer Pricing. While the vulnerability is in Oracle Financial Services Funds Transfer Pricing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Funds Transfer Pricing. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-5659V-6.0.0 P-5659V-6.1.0 P-5659V-6.1.1 P-5659V-8.0.1 P-5659V-8.0.2 P-5659V-8.0.3 P-5659V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5659V-6.0.0 P-5659V-6.1.0 P-5659V-6.1.1 P-5659V-8.0.1 P-5659V-8.0.2 P-5659V-8.0.3 P-5659V-8.0.4 Vulnerability in the Oracle Financial Services Hedge Management and IFRS Valuations component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 6.1.1, 8.0.1, 8.0.2, 8.0.3 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Hedge Management and IFRS Valuations. While the vulnerability is in Oracle Financial Services Hedge Management and IFRS Valuations, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Hedge Management and IFRS Valuations. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9332V-6.1.1 P-9332V-8.0.1 P-9332V-8.0.2 P-9332V-8.0.3 P-9332V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9332V-6.1.1 P-9332V-8.0.1 P-9332V-8.0.2 P-9332V-8.0.3 P-9332V-8.0.4 Vulnerability in the Oracle Financial Services Institutional Performance Analytics component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). The supported version that is affected is 8.0.0 to 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Institutional Performance Analytics. While the vulnerability is in Oracle Financial Services Institutional Performance Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Institutional Performance Analytics. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-10215V-8.0.0 to 8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10215V-8.0.0 to 8.0.4 Vulnerability in the Oracle Financial Services Liquidity Risk Management component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 8.0.1, 8.0.2 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Liquidity Risk Management. While the vulnerability is in Oracle Financial Services Liquidity Risk Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Liquidity Risk Management. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9096V-8.0.1 P-9096V-8.0.2 P-9096V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9096V-8.0.1 P-9096V-8.0.2 P-9096V-8.0.4 Vulnerability in the Oracle Financial Services Loan Loss Forecasting and Provisioning component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 1.5.0, 1.5.1, 8.0.1, 8.0.2, 8.0.3 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Loan Loss Forecasting and Provisioning. While the vulnerability is in Oracle Financial Services Loan Loss Forecasting and Provisioning, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Loan Loss Forecasting and Provisioning. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9474V-1.5.0 P-9474V-1.5.1 P-9474V-8.0.1 P-9474V-8.0.2 P-9474V-8.0.3 P-9474V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9474V-1.5.0 P-9474V-1.5.1 P-9474V-8.0.1 P-9474V-8.0.2 P-9474V-8.0.3 P-9474V-8.0.4 Vulnerability in the Oracle Financial Services Pricing Management/Transfer Pricing Component component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). The supported version that is affected is 8.0.0 to 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Pricing Management/Transfer Pricing Component. While the vulnerability is in Oracle Financial Services Pricing Management/Transfer Pricing Component, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Pricing Management/Transfer Pricing Component. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-5749V-8.0.0 to 8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5749V-8.0.0 to 8.0.4 Vulnerability in the Oracle Financial Services Profitability Management component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 6.0.0, 6.1.0, 6.1.1, 8.0.1, 8.0.2, 8.0.3 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Profitability Management. While the vulnerability is in Oracle Financial Services Profitability Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Profitability Management. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-5658V-6.0.0 P-5658V-6.1.0 P-5658V-6.1.1 P-5658V-8.0.1 P-5658V-8.0.2 P-5658V-8.0.3 P-5658V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5658V-6.0.0 P-5658V-6.1.0 P-5658V-6.1.1 P-5658V-8.0.1 P-5658V-8.0.2 P-5658V-8.0.3 P-5658V-8.0.4 Vulnerability in the Oracle Financial Services Retail Customer Analytics component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). The supported version that is affected is 8.0.0 to 8.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Retail Customer Analytics. While the vulnerability is in Oracle Financial Services Retail Customer Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Retail Customer Analytics. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-10214V-8.0.0 to 8.0.3 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10214V-8.0.0 to 8.0.3 Vulnerability in the Oracle Financial Services Retail Performance Analytics component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). The supported version that is affected is 8.0.0 to 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Retail Performance Analytics. While the vulnerability is in Oracle Financial Services Retail Performance Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Retail Performance Analytics. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-10216V-8.0.0 to 8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-10216V-8.0.0 to 8.0.4 Vulnerability in the Oracle Insurance Data Foundation component of Oracle Financial Services Applications (subcomponent: Core (Struts 2)). Supported versions that are affected are 8.0.1, 8.0.2,8.0.3 and 8.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Insurance Data Foundation. While the vulnerability is in Oracle Insurance Data Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Insurance Data Foundation. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9755V-8.0.1 P-9755V-8.0.2 P-9755V-8.0.3 P-9755V-8.0.4 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9755V-8.0.1 P-9755V-8.0.2 P-9755V-8.0.3 P-9755V-8.0.4 Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: General (Struts 2)). Supported versions that are affected are 3.1.6.8003 and earlier, 3.2.1182 and earlier, 3.3.2.1162 and earlier and . Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. While the vulnerability is in MySQL Enterprise Monitor, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8480V-3.1.6.8003 and earlier P-8480V-3.2.1182 and earlier P-8480V-3.3.2.1162 and earlier Vulnerability in the Siebel Apps - E-Billing component of Oracle Siebel CRM (subcomponent: Security (Struts 2)). Supported versions that are affected are 6.1, 6.2, 7.0 and 7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - E-Billing. While the vulnerability is in Siebel Apps - E-Billing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Siebel Apps - E-Billing. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-8969V-6.1 P-8969V-6.2 P-8969V-7.0 P-8969V-7.1 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-8969V-6.1 P-8969V-6.2 P-8969V-7.0 P-8969V-7.1 Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Third Party Tools (Struts 2)). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. Note: The fix for CVE-2017-5638 also addresses CVE-2016-4436. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-9617V-11.1.1.8.0 P-9617V-12.2.1.0.0 P-9617V-12.2.1.1.0 P-9617V-12.2.1.2.0 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Samples (Struts 2)). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-5242V-10.3.6.0 P-5242V-12.1.3.0 P-5242V-12.2.1.0 P-5242V-12.2.1.1 P-5242V-12.2.1.2 Vulnerability in the Oracle Retail XBRi Loss Prevention component of Oracle Retail Applications (subcomponent: Internal Operations (Struts 2)). Supported versions that are affected are 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0 and 10.8.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail XBRi Loss Prevention. While the vulnerability is in Oracle Retail XBRi Loss Prevention, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Retail XBRi Loss Prevention. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Fix has been released CVE-2017-5638 P-11506V-10.0.1 P-11506V-10.5.0 P-11506V-10.6.0 P-11506V-10.7.0 P-11506V-10.8.0 P-11506V-10.8.1 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CPUApr2017 Oracle customers with valid support contracts http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html P-11506V-10.0.1 P-11506V-10.5.0 P-11506V-10.6.0 P-11506V-10.7.0 P-11506V-10.8.0 P-11506V-10.8.1