alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2016-0390 (published 2016-05-15)
Cross-site scripting (XSS) vulnerability in IBM Algorithmics Algo One Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ibm
Affected products: algo_one
CVE-2016-0391 (published 2016-07-02)
The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: ibm
Affected products: bluemix, watson_developer_cloud
CVE-2016-0392 (published 2016-06-19)
IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as distributed in Spectrum Scale RAID, allows local users to gain privileges via a crafted parameter to a setuid program.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: ibm
Affected products: elastic_storage_server, general_parallel_file_system_storage_server
CVE-2016-0393 (published 2016-07-17)
IBM Maximo Asset Management 7.5 before 7.5.0.10-TIV-MBS-IFIX002 and 7.6 before 7.6.0.5-TIV-MAMMT-FP001 allows remote attackers to obtain sensitive URL information by reading log files.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: ibm
Affected products: maximo_asset_management
CVE-2016-0394 (published 2017-02-01)
IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files.
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-275
Affected vendors: ibm
Affected products: integration_bus, websphere_message_broker
CVE-2016-0396 (published 2017-02-01)
IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than expected.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: ibm
Affected products: bigfix_platform
CVE-2016-0397 (published 2016-08-30)
WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: ibm
Affected products: bigfix_webreports
CVE-2016-0398 (published 2016-07-02)
IBM Cognos Analytics (CA) 11.0 before 11.0.2 allows remote attackers to conduct content-spoofing attacks via a crafted URL.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: ibm
Affected products: cognos_analytics
CVE-2016-0399 (published 2016-07-02)
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.9 IFIX007, and 7.6 before 7.6.0.5 FP005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ibm
Affected products: maximo_asset_management
CVE-2016-0400 (published 2016-07-02)
CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: ibm
Affected products: websphere_extreme_scale
CVE-2016-0401 (published 2016-01-21)
Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect integrity via unknown vectors related to Scheduler, a different vulnerability than CVE-2016-0429.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0402 (published 2016-01-21)
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Affected vendors: canonical, oracle
Affected products: jdk, jre, ubuntu_linux
CVE-2016-0403 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect availability via vectors related to SMB Utilities.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0404 (published 2016-01-21)
Unspecified vulnerability in the Oracle Identity Federation component in Oracle Fusion Middleware 11.1.2.2 allows remote attackers to affect integrity via vectors related to Admin.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0405 (published 2016-01-21)
Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4 allows local users to affect confidentiality via vectors related to Cluster Manageability and Serviceability.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:S/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: oracle_and_sun_systems_product_suite
CVE-2016-0406 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity and availability via vectors related to Libc.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:N/I:P/A:P)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0407 (published 2016-04-21)
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Fusion HR Talent Integration.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: oracle
Affected products: peoplesoft_enterprise_human_capital_management_human_resources
CVE-2016-0408 (published 2016-04-21)
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 through 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to the Activity Guide sub-component.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: oracle
Affected products: peoplesoft_enterprise_peopletools
CVE-2016-0409 (published 2016-01-21)
Unspecified vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Security.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: peoplesoft_products
CVE-2016-0411 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1 and 11.2.0.4 allows local users to affect confidentiality, integrity, and availability via vectors related to Agent Next Gen.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0412 (published 2016-01-21)
Unspecified vulnerability in the PeopleSoft Enterprise SCM eProcurement component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect integrity via unknown vectors related to Manage Requisition Status.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: peoplesoft_supply_chain_management_eprocurement
CVE-2016-0413 (published 2016-01-21)
Unspecified vulnerability in the Oracle Identity Federation component in Oracle Fusion Middleware 11.1.1.7 allows remote authenticated users to affect integrity via vectors related to Federation protocol support.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0414 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0418.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0415 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 12.1.0.4, and 12.1.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to UI Framework.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0416 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect integrity via unknown vectors related to System Archive Utility.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0417 (published 2016-01-21)
Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.2 allows local users to affect confidentiality, integrity, and availability via vectors related to HA for MySQL.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: solaris_cluster
CVE-2016-0418 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0414.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:C)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0419 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0431.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0420 (published 2016-01-21)
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via unknown vectors related to Monitoring and Diagnostics.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: jd_edwards_products
CVE-2016-0421 (published 2016-01-21)
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Monitoring and Diagnostics SEC.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Affected vendors: oracle
Affected products: jd_edwards_products
CVE-2016-0422 (published 2016-01-21)
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC, a different vulnerability than CVE-2016-0424.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: jd_edwards_products
CVE-2016-0423 (published 2016-01-21)
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Enterprise Infrastructure SEC.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:C/I:C/A:P)
Affected vendors: oracle
Affected products: jd_edwards_products
CVE-2016-0424 (published 2016-01-21)
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC, a different vulnerability than CVE-2016-0422.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: jd_edwards_products
CVE-2016-0425 (published 2016-01-21)
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Monitoring and Diagnostics.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: jd_edwards_products
CVE-2016-0426 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality and availability via unknown vectors related to Solaris Kernel Zones.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:P)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0427 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Framework.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0428 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Verified Boot.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0429 (published 2016-01-21)
Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect integrity via unknown vectors related to Scheduler, a different vulnerability than CVE-2016-0401.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0430 (published 2016-01-21)
Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support, a different vulnerability than CVE-2016-0439.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0431 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0419.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:H/Au:N/C:N/I:N/A:P)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0432 (published 2016-01-21)
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4808, CVE-2015-6013, CVE-2015-6014, and CVE-2015-6015.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:N/I:N/A:P)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0433 (published 2016-01-21)
Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0434 (published 2016-01-21)
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0436, CVE-2016-0437, and CVE-2016-0438.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: retail_applications
CVE-2016-0435 (published 2016-01-21)
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality and integrity via vectors related to Mobile POS.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:P/A:N)
Affected vendors: oracle
Affected products: retail_applications
CVE-2016-0436 (published 2016-01-21)
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0434, CVE-2016-0437, and CVE-2016-0438.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: retail_applications
CVE-2016-0437 (published 2016-01-21)
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0434, CVE-2016-0436, and CVE-2016-0438.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: retail_applications
CVE-2016-0438 (published 2016-01-21)
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0434, CVE-2016-0436, and CVE-2016-0437.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: retail_applications
CVE-2016-0439 (published 2016-01-21)
Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support, a different vulnerability than CVE-2016-0430.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0440 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect availability via vectors related to NFSv4.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0441 (published 2016-01-21)
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.1.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Embedded Server.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:H/Au:S/C:C/I:C/A:P)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0442 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Loader Service.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0443 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 12.1.0.4, and 12.1.0.5 allows remote attackers to affect confidentiality via unknown vectors related to Agent Next Gen.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0444 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0447 and CVE-2016-0449.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0445 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0446 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality via unknown vectors related to Agent Next Gen.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0447 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0444 and CVE-2016-0449.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0448 (published 2016-01-21)
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Affected vendors: canonical, oracle
Affected products: jdk, jre, ubuntu_linux
CVE-2016-0449 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0444 and CVE-2016-0447.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0450 (published 2016-01-21)
Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect availability via unknown vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Affected vendors: oracle
Affected products: goldengate
CVE-2016-0451 (published 2016-01-21)
Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0452.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Affected vendors: oracle
Affected products: goldengate
CVE-2016-0452 (published 2016-01-21)
Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0451.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Affected vendors: oracle
Affected products: goldengate
CVE-2016-0453 (published 2016-01-21)
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.1.2 allows remote attackers to affect integrity via unknown vectors related to Embedded Server.
Severity: LOW (CVSS 2.0 vector: AV:A/AC:H/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0454 (published 2016-01-21)
Unspecified vulnerability in the Oracle Mobile Application Servlet component in Oracle E-Business Suite 12.1 and 12.2 allows local users to affect confidentiality via vectors related to MWA Server Manager.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: e-business_suite
CVE-2016-0455 (published 2016-01-21)
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality and availability via unknown vectors related to Agent Next Gen.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:S/C:C/I:N/A:P)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0456 (published 2016-01-21)
Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0457. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/copxmllcmservicecontroller.js.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: e-business_suite
CVE-2016-0457 (published 2016-01-21)
Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0456.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/lcmServiceController.jsp.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: e-business_suite
CVE-2016-0458 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via vectors related to Kernel DAX.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:H/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0459 (published 2016-01-21)
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote authenticated users to affect integrity via unknown vectors related to Popup Windows.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: e-business_suite
CVE-2016-0460 (published 2016-01-21)
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.55 allows remote attackers to affect integrity via unknown vectors related to Fluid Homepage and NavBar.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: peoplesoft_enterprise_peopletools
CVE-2016-0461 (published 2016-01-21)
Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect availability via unknown vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
Affected vendors: oracle
Affected products: database_server
CVE-2016-0462 (published 2016-01-21)
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via unknown vectors related to Multichannel Framework, a different vulnerability than CVE-2015-2650.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: peoplesoft_enterprise_peopletools
CVE-2016-0463 (published 2016-01-21)
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote attackers to affect confidentiality via unknown vectors related to Portal.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: peoplesoft_enterprise_peopletools
CVE-2016-0464 (published 2016-01-21)
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to WLS-Console.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0465 (published 2016-01-21)
Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4 allows local users to affect availability via unknown vectors related to Resource Group Manager.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
Affected vendors: oracle
Affected products: oracle_and_sun_systems_product_suite
CVE-2016-0466 (published 2016-01-21)
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Affected vendors: canonical, oracle
Affected products: jdk, jre, ubuntu_linux
CVE-2016-0467 (published 2016-01-21)
Unspecified vulnerability in the Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect integrity via unknown vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: database_server
CVE-2016-0468 (published 2016-04-21)
Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Analytics Web General.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: oracle
Affected products: business_intelligence
CVE-2016-0469 (published 2016-04-21)
Unspecified vulnerability in the Oracle Retail MICROS C2 component in Oracle Retail Applications 9.89.0.0 allows local users to affect confidentiality via vectors related to POS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: oracle
Affected products: micros_c2
CVE-2016-0470 (published 2016-01-21)
Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to BI Publisher Security.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Affected vendors: oracle
Affected products: fusion_middleware
CVE-2016-0471 (published 2016-01-21)
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via unknown vectors related to Multichannel Framework.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: peoplesoft_enterprise_peopletools
CVE-2016-0472 (published 2016-01-21)
Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality and availability via unknown vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:P)
Affected vendors: oracle
Affected products: database_server
CVE-2016-0473 (published 2016-01-21)
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect integrity via unknown vectors related to Fluid Core.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: peoplesoft_enterprise_peopletools
CVE-2016-0474 (published 2016-01-21)
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect integrity via vectors related to PIA Core Technology.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Affected vendors: oracle
Affected products: peoplesoft_enterprise_peopletools
CVE-2016-0475 (published 2016-01-21)
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Affected vendors: oracle
Affected products: jdk, jre, jrockit
CVE-2016-0476 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0477 and CVE-2016-0478.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0477 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0476 and CVE-2016-0478.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the (1) repository, (2) workspace, or (3) scenario parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0478 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0476 and CVE-2016-0477.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scriptName parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0479 (published 2016-04-21)
Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality and integrity via vectors related to Analytics Scorecard.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: oracle
Affected products: business_intelligence
CVE-2016-0480 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0481, CVE-2016-0482, CVE-2016-0485, and CVE-2016-0486.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the TMAPReportImage parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0481 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0482, CVE-2016-0485, and CVE-2016-0486.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scheduleReportName parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: enterprise_manager_grid_control
CVE-2016-0482 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0485, and CVE-2016-0486.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0483 (published 2016-01-21)
Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Affected vendors: canonical, oracle
Affected products: jdk, jre, jrockit, ubuntu_linux
CVE-2016-0484 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scriptPath parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0485 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0482, and CVE-2016-0486.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0486 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0482, and CVE-2016-0485.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the exportFileName parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0487 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0490.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the process method in the ActionServlet servlet, which allows remote attackers to bypass authentication via directory traversal sequences following an unspecified URI string.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0488 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0492.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function in the admin pages, which allows remote attackers to bypass authentication and gain administrator access via directory traversal sequences following a URI entry that does not require authentication.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0489 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Test Manager for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the ActionServlet servlet, which allows remote authenticated users to upload and execute arbitrary files via directory traversal sequences in the tempfilename parameter in a ReportImage action.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0490 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0487.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the UploadServlet servlet, which allows remote attackers to upload and execute arbitrary files via directory traversal sequences in a filename header.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0491 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0492 (published 2016-01-21)
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0488.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function, which allows remote attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication, as demonstrated by olt/Login.do/../../olt/UploadFileUpload.do.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Affected vendors: oracle
Affected products: application_testing_suite
CVE-2016-0493 (published 2016-01-21)
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity and availability via unknown vectors related to Kernel Cryptography.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:N/I:P/A:P)
Affected vendors: oracle
Affected products: solaris
CVE-2016-0494 (published 2016-01-21)
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Affected vendors: canonical, oracle
Affected products: jdk, jre, ubuntu_linux
CVE-2016-0495 (published 2016-01-21)
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and 5.0.14 allows remote attackers to affect availability via unknown vectors related to Core.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Affected vendors: debian, oracle
Affected products: debian_linux, vm_virtualbox