deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11723
Published: 2019-07-23
Description: A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This vulnerability affects Firefox < 68.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11724
Published: 2019-07-23
Description: Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another site. This additional permission is unnecessary and is a potential vector for malicious attacks. This vulnerability affects Firefox < 68.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-863
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11725
Published: 2019-07-23
Description: When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not blocked, leading to the loading of unsafe resources and bypassing safebrowsing protections. This vulnerability affects Firefox < 68.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11727
Published: 2019-07-23
Description: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11728
Published: 2019-07-23
Description: The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a user when web content is loaded. This vulnerability affects Firefox < 68.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-668
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11729
Published: 2019-07-23
Description: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-11730
Published: 2019-07-23
Description: A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-9800
Published: 2019-07-23
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1540166%2C1534593%2C1546327%2C1540136%2C1538736%2C1538042%2C1535612%2C1499719%2C1499108%2C1538619%2C1535194%2C1516325%2C1542324%2C1542097%2C1532465%2C1533554%2C1541580; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-9811
Published: 2019-07-23
Description: As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 8.3 (HIGH)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-9814
Published: 2019-07-23
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 67.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%2C1543159%2C1539393%2C1459932%2C1459182%2C1516425; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%2C1543159%2C1539393%2C1459932%2C1459182%2C1516425
CVE: CVE-2019-9815
Published: 2019-07-23
Description: If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. *Note: users need to update to macOS 10.14.5 in order to take advantage of this change.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1546544; https://mdsattacks.com/; https://www.mozilla.org/security/advisories/mfsa2019-13/
CVE: CVE-2019-9816
Published: 2019-07-23
Description: A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1536768; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-9817
Published: 2019-07-23
Description: Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1540221; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-9818
Published: 2019-07-23
Description: A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. *Note: this vulnerability only affects Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 8.3 (HIGH)
CWE: CWE-362, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1542581; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-9819
Published: 2019-07-23
Description: A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1532553; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-9820
Published: 2019-07-23
Description: A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1536405; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-9821
Published: 2019-07-23
Description: A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. This vulnerability affects Firefox < 67.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1539125; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1539125
CVE: CVE-2018-18669
Published: 2019-07-23
Description: GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board title contents" parameter, aka the adm/board_form_update.php bo_subject parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-94ec20582215bda9f55fadcefe68c168; https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172; https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Jsish 2.4.84 2.0484 is affected by: Reachable Assertion. The impact is: denial of service. The component is: function Jsi_ValueArrayIndex (jsiValue.c:366). The attack vector is: executing crafted javascript code. The fixed version is: after commit 738ead193aff380a7e3d7ffb8e11e446f76867f3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://jsish.org/fossil/jsi/tktview/b3278d1a441477d50363d28df79bbf58de2448af; https://jsish.org/fossil/jsi/tktview/b3278d1a441477d50363d28df79bbf58de2448af
CVE: CVE-2019-12162
Published: 2019-07-23
Description: Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-494
References: https://support.upwork.com/hc/en-us/categories/[PII_REDACTED]54; https://vuldb.com/?id.138406; https://support.upwork.com/hc/en-us/categories/[PII_REDACTED]54
CVE: CVE-2018-18671
Published: 2019-07-23
Description: GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/board_form_update.php bo_mobile_content_head parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-05e83ad5f4c0624ed6ff385aed1bf33b; https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172; https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
CVE: CVE-2018-18673
Published: 2019-07-23
Description: GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" parameter, aka the adm/menu_list_update.php me_link parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-bf0e19438d64230c1541bcbf9746e6e5; https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172; https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
CVE: CVE-2018-18670
Published: 2019-07-23
Description: GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter, aka the adm/config_form_update.php cf_1~10 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-d1ecbee80f57fde59063c4fafcef1bce; https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172; https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
CVE: CVE-2018-18672
Published: 2019-07-23
Description: GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board head contents" parameter, aka the adm/board_form_update.php bo_content_head parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-05e83ad5f4c0624ed6ff385aed1bf33b; https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172; https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
CVE: CVE-2018-18675
Published: 2019-07-23
Description: GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board title contents" parameter, aka the adm/board_form_update.php bo_mobile_subject parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-94ec20582215bda9f55fadcefe68c168; https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172; https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
CVE: CVE-2018-18676
Published: 2019-07-23
Description: GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter, aka the adm/board_form_update.php bo_mobile_content_tail parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-653a2b5a93ed2ca9b8c809ba723638c1; https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172; https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
CVE: CVE-2019-13570
Published: 2019-07-23
Description: The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://ajdg.solutions/2019/07/11/adrotate-pro-5-3-important-update-for-security-and-ads-txt/; https://wpvulndb.com/vulnerabilities/9475; https://ajdg.solutions/2019/07/11/adrotate-pro-5-3-important-update-for-security-and-ads-txt/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ServiceStack/ServiceStack/commit/a0e0d7de20f5d1712f1793f925496def4383c610; https://github.com/ServiceStack/ServiceStack/commit/a0e0d7de20f5d1712f1793f925496def4383c610
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The impact is: Remote code execution with the same privileges as the servers. The component is: Two web servers in the projects expose three vulnerable endpoints that can be accessed remotely. The endpoints are defined at: - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/merlin_model_server/api.js#L34 - /alignment: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#L28 - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#L65. The attack vector is: Attacker sends a GET request to the vulnerable endpoint with a specially formatted query parameter. The fixed version is: After commit f6660e6d8f0d1d931359d591dbdec580fef36d36.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/google/voice-builder/commit/c145d4604df67e6fc625992412eef0bf9a85e26b; https://github.com/google/voice-builder/commit/f6660e6d8f0d1d931359d591dbdec580fef36d36; https://github.com/google/voice-builder/commit/c145d4604df67e6fc625992412eef0bf9a85e26b
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Jeesite 1.2.7 is affected by: SQL Injection. The impact is: sensitive information disclosure. The component is: updateProcInsIdByBusinessId() function in src/main/java/com.thinkgem.jeesite/modules/act/ActDao.java has SQL Injection vulnerability. The attack vector is: network connectivity,authenticated. The fixed version is: 4.0 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/dao/ActDao.java; https://github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/dao/ActDao.java
CVE: CVE-2019-14243
Published: 2019-07-23
Description: headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://caddy.community/t/dos-in-http-proxyprotocol-plugin/6014; https://github.com/mastercactapus/caddy-proxyprotocol/issues/8; https://github.com/mastercactapus/proxyprotocol/commit/5c4a101121fc3e868026189c7a73f7f19eef90ac
CVE: CVE-2018-2883
Published: 2019-07-23
Description: Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications (subcomponent: Internal Operations). Supported versions that are affected are 7.0 and 7.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Office. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Xstore Office accessible data as well as unauthorized read access to a subset of Oracle Retail Xstore Office accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Xstore Office. CVSS 3.0 Base Score 5.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L).
CVSS Score: 5.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2018-3111
Published: 2019-07-23
Description: Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications (subcomponent: Internal Operations). The supported version that is affected is 7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Xstore Office accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Xstore Office. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L).
CVSS Score: 7.6 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2018-3315
Published: 2019-07-23
Description: Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation component of Oracle Retail Applications (subcomponent: Customer). Supported versions that are affected are 16.0 and 17.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. While the vulnerability is in Oracle Retail Customer Management and Segmentation Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail Customer Management and Segmentation Foundation accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail Customer Management and Segmentation Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS Score: 8.2 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html