CVE-2018-2870

CRITICAL Year: 2018
CVSS v3 Score
9.1
Critical
CVSS v2 Score
6.4
Medium
Weakness Type
NVD-CWE-Other
View all →

Vulnerability Description

Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite (subcomponent: General Utilities). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Human Resources accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Related Vulnerabilities

CVE-2011-3188

CRITICAL
CVSS:9.1(Critical)

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote ...

NVD-CWE-Other2011

CVE-2012-2926

CRITICAL
CVSS:9.1(Critical)

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4....

NVD-CWE-Other2012

CVE-2012-3152

CRITICAL
CVSS:9.1(Critical)

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unk...

NVD-CWE-Other2012

CVE-2016-0699

CRITICAL
CVSS:9.1(Critical)

Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attackers to affect confidentiality and integrity via ve...

NVD-CWE-Other2016

CVE-2016-1034

CRITICAL
CVSS:9.1(Critical)

The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspeci...

NVD-CWE-Other2016

CVE-2016-11049

CRITICAL
CVSS:9.1(Critical)

An issue was discovered on Samsung mobile devices with software through 2016-01-16 (Shannon333/308/310 chipsets). The IMEI may be retrieved and modified because of an error in managing key information...

NVD-CWE-Other2016