|
CVE-2015-2918
|
Medium
|
2015-12-31
|
No exploit published
|
No public exploit
|
The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
|
|
CVE-2015-2913
|
Medium
|
2015-12-31
|
No exploit published
|
No public exploit
|
server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.
|
|
CVE-2015-2912
|
High
|
2015-12-31
|
No exploit published
|
No public exploit
|
The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.
|
|
CVE-2015-1836
|
High
|
2015-12-21
|
No exploit published
|
No public exploit
|
Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
|
|
CVE-2015-1772
|
High
|
2015-12-21
|
No exploit published
|
No public exploit
|
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
|
|
CVE-2015-5304
|
Low
|
2015-12-16
|
No exploit published
|
No public exploit
|
Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors.
|
|
CVE-2015-5004
|
Medium
|
2015-12-15
|
No fix identified
|
No public exploit
|
The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
|
|
CVE-2015-8103
|
Critical
|
2015-11-25
|
Protected by RASP
|
Working exploit published
|
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
|
|
CVE-2015-5326
|
Medium
|
2015-11-25
|
No exploit published
|
No public exploit
|
Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.
|
|
CVE-2015-5325
|
High
|
2015-11-25
|
No exploit published
|
No public exploit
|
Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.
|
|
CVE-2015-5324
|
Medium
|
2015-11-25
|
No exploit published
|
No public exploit
|
Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.
|
|
CVE-2015-5323
|
Medium
|
2015-11-25
|
No exploit published
|
No public exploit
|
Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
|
|
CVE-2015-5322
|
Medium
|
2015-11-25
|
Protected by RASP
|
No public exploit
|
Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.
|
|
CVE-2015-5321
|
Medium
|
2015-11-25
|
No exploit published
|
No public exploit
|
The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.
|
|
CVE-2015-5320
|
Medium
|
2015-11-25
|
No exploit published
|
No public exploit
|
Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.
|
|
CVE-2015-5319
|
Medium
|
2015-11-25
|
Protected by RASP
|
No public exploit
|
XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.
|
|
CVE-2015-5318
|
Medium
|
2015-11-25
|
No exploit published
|
No public exploit
|
Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.
|
|
CVE-2015-5317
|
High
|
2015-11-25
|
Mitigation candidate
|
Exploited in the wild
|
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
|
|
CVE-2014-3665
|
Medium
|
2015-11-25
|
No exploit published
|
No public exploit
|
Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.
|
|
CVE-2015-5253
|
Medium
|
2015-11-18
|
No exploit published
|
No public exploit
|
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
|
|
CVE-2015-4852
|
Critical
|
2015-11-18
|
Protected by RASP
|
Exploited in the wild
|
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
|
|
CVE-2015-8126
|
High
|
2015-11-13
|
Mitigated by environment configuration
|
No public exploit
|
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
|
|
CVE-2014-8873
|
High
|
2015-11-09
|
No fix identified
|
No public exploit
|
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
|
|
CVE-2015-2017
|
Medium
|
2015-11-08
|
No fix identified
|
No public exploit
|
CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
|
|
CVE-2015-5210
|
Medium
|
2015-11-02
|
No exploit published
|
No public exploit
|
Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter.
|
|
CVE-2015-1775
|
Medium
|
2015-11-02
|
No exploit published
|
No public exploit
|
Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
|
|
CVE-2015-5262
|
Medium
|
2015-10-27
|
Mitigation candidate
|
No public exploit
|
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
|
|
CVE-2015-5220
|
Medium
|
2015-10-27
|
No exploit published
|
No public exploit
|
The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (memory consumption) via a large request header.
|
|
CVE-2015-5188
|
Medium
|
2015-10-27
|
No exploit published
|
No public exploit
|
Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
|
|
CVE-2015-5178
|
Medium
|
2015-10-27
|
No exploit published
|
No public exploit
|
The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
|
|
CVE-2015-4917
|
Low
|
2015-10-22
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4892.
|
|
CVE-2015-4916
|
Medium
|
2015-10-22
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4908.
|
|
CVE-2015-4914
|
Low
|
2015-10-22
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Listener.
|
|
CVE-2015-4912
|
Medium
|
2015-10-22
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via vectors related to SSO Engine.
|
|
CVE-2015-4909
|
Medium
|
2015-10-22
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote attackers to affect integrity via vectors related to ADF Faces.
|
|
CVE-2015-4908
|
Medium
|
2015-10-22
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4916.
|
|
CVE-2015-4903
|
Medium
|
2015-10-22
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.
|
|
CVE-2015-4902
|
Medium
|
2015-10-22
|
No fix identified
|
Exploited in the wild
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
|
|
CVE-2015-4899
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality via unknown vectors related to Security.
|
|
CVE-2015-4898
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via vectors related to Diagnostics and DMZ.
|
|
CVE-2015-4892
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4917.
|
|
CVE-2015-4887
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to ePerformance.
|
|
CVE-2015-4886
|
Medium
|
2015-10-21
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request involving the OA_HTML/copxml servlet.
|
|
CVE-2015-4884
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Single Signon.
|
|
CVE-2015-4883
|
High
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860.
|
|
CVE-2015-4882
|
Medium
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.
|
|
CVE-2015-4881
|
High
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835.
|
|
CVE-2015-4880
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4867.
|
|
CVE-2015-4878
|
Low
|
2015-10-21
|
Mitigation candidate
|
Working exploit published
|
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4877.
|
|
CVE-2015-4877
|
Low
|
2015-10-21
|
Mitigation candidate
|
Working exploit published
|
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4878.
|
|
CVE-2015-4876
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect integrity via unknown vectors related to Pivot Grid.
|
|
CVE-2015-4875
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows remote attackers to affect availability via unknown vectors related to Agent Next Gen.
|
|
CVE-2015-4874
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen.
|
|
CVE-2015-4872
|
Medium
|
2015-10-21
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.
|
|
CVE-2015-4871
|
Medium
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
|
|
CVE-2015-4868
|
High
|
2015-10-21
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 8u60 and Java SE Embedded 8u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
|
|
CVE-2015-4867
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4880.
|
|
CVE-2015-4865
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality via vectors related to Business Objects - BC4J.
|
|
CVE-2015-4860
|
High
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.
|
|
CVE-2015-4859
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Agent Next Gen.
|
|
CVE-2015-4854
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Single Signon. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML via the Domain parameter in the CfgOCIReturn servlet.
|
|
CVE-2015-4851
|
Medium
|
2015-10-21
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in the Oracle iSupplier Portal component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to XML input. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/oramipp_lpr.
|
|
CVE-2015-4850
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Talent Acquisition Management.
|
|
CVE-2015-4849
|
Medium
|
2015-10-21
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Punch-in. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to cause a denial of service or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/IspPunchInServlet.
|
|
CVE-2015-4848
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Integration with Peoplesoft.
|
|
CVE-2015-4847
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via vectors related to OCI.
|
|
CVE-2015-4846
|
Low
|
2015-10-21
|
Protected by RASP
|
No public exploit
|
Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality and integrity via vectors related to SQL Extensions. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is a SQL injection vulnerability, which allows remote authenticated users to execute arbitrary SQL commands via a request involving the afamexts.sql SQL extension.
|
|
CVE-2015-4845
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via vectors related to Java APIs - AOL/J. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to enumerate database users via a series of requests to Aoljtest.js.
|
|
CVE-2015-4844
|
High
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
|
|
CVE-2015-4843
|
High
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
|
|
CVE-2015-4842
|
Medium
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.
|
|
CVE-2015-4841
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM IP2014 and IP2015 allows remote attackers to affect confidentiality via unknown vectors related to Services.
|
|
CVE-2015-4840
|
Medium
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.
|
|
CVE-2015-4839
|
High
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to DB Listener, a different vulnerability than CVE-2015-4798.
|
|
CVE-2015-4838
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote authenticated users to affect confidentiality via vectors related to ADF Faces.
|
|
CVE-2015-4835
|
High
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881.
|
|
CVE-2015-4832
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.7, 11.1.2.2, and 11.1.2.3 allows remote attackers to affect integrity via vectors related to OIM Legacy UI.
|
|
CVE-2015-4828
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via vectors related to FIN Resource Management (Security).
|
|
CVE-2015-4827
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Retail Open Commerce Platform component in Oracle Retail Applications 3.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Framework.
|
|
CVE-2015-4825
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise FIN Expenses component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Expense Report General.
|
|
CVE-2015-4824
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
|
|
CVE-2015-4823
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Hyperion Installation Technology component in Oracle Hyperion 11.1.2.3 allows local users to affect confidentiality via unknown vectors related to Essbase Rapid Deploy.
|
|
CVE-2015-4818
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 allows remote authenticated users to affect confidentiality and integrity via vectors related to PIA Core Technology.
|
|
CVE-2015-4812
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 allows remote attackers to affect confidentiality via vectors related to OSSL Module.
|
|
CVE-2015-4811
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDKutside In PDF Export SDK, a different vulnerability than CVE-2015-4809.
|
|
CVE-2015-4809
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDK, a different vulnerability than CVE-2015-4811.
|
|
CVE-2015-4806
|
Medium
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
|
|
CVE-2015-4805
|
High
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.
|
|
CVE-2015-4804
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Management component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
|
|
CVE-2015-4799
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 7.6.2, 11.1.1.6.1, and 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Security.
|
|
CVE-2015-4798
|
High
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to DB Listener, a different vulnerability than CVE-2015-4839.
|
|
CVE-2015-4797
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security.
|
|
CVE-2015-4795
|
High
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Utilities Work and Asset Management component in Oracle Industry Applications 1.9.1.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Add-On Applications.
|
|
CVE-2015-4793
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Communications Convergence component in Oracle Communications Applications 2.0 and 3.0.1 allows remote attackers to affect confidentiality via unknown vectors related to Mail Proxy.
|
|
CVE-2015-4762
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 and 12.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Online patching.
|
|
CVE-2015-4734
|
Medium
|
2015-10-21
|
Mitigated by environment configuration
|
No public exploit
|
Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.
|
|
CVE-2015-2633
|
Low
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.0.1 and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Ops Center.
|
|
CVE-2015-2608
|
High
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in (1) the Oracle Communications Diameter Signaling Router (DSR) component in Oracle Communications Applications 4.1.6 and earlier, 5.1.0 and earlier, 6.0.2 and earlier, and 7.1.0 and earlier; (2) the Oracle Communications Performance Intelligence Center Software component in Oracle Communications Applications 9.0.3 and earlier and 10.1.5 and earlier; (3) the Oracle Communications Policy Management component in Oracle Communications Applications 9.9.0 and earlier, 10.5.0 and earlier, 11.5.0 and earlier, and 12.1.0 and earlier; and (4) the Oracle Communications Tekelec HLR Router component in Oracle Communications Applications 4.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to PMAC.
|
|
CVE-2015-1829
|
Medium
|
2015-10-21
|
No fix identified
|
No public exploit
|
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect availability via unknown vectors related to Web Listener.
|
|
CVE-2015-1814
|
High
|
2015-10-16
|
No exploit published
|
No public exploit
|
The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
|
VRT
391,192 CVEs tracked ·
15,442 in RASP scope ·
data as of 17 hours ago