Business Intelligence

CVE-2026-71122 Aug 18, 21:18 HIGH This Week

Full system takeover is achievable in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 via specially crafted HTTP requests targeting the Platform Security component from a high-privileged, network-adjacent attacker. The CVSS 3.1 score of 8.0 reflects a scope-changed exploit with complete Confidentiality, Integrity, and Availability impact, meaning successful compromise can cascade to systems integrated with or hosted alongside the BIEE instance. No public exploit identified at time of analysis, and exploitation requires high attack complexity and high-privilege credentials, but the full-takeover outcome warrants prioritized patching through the August 2026 Oracle CPU.

CVE-2026-71107 Aug 18, 21:18 HIGH This Week

Unauthenticated remote data exposure in Oracle Business Intelligence Enterprise Edition (OBIEE) versions 8.2.0.0.0 and 26.01.0.0.0 allows network-adjacent attackers to read critical or all accessible analytics data via HTTP without credentials. The authentication bypass (per vendor tagging) in the Analytics Server component yields complete confidentiality loss - CVSS C:H - with no integrity or availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's own security team reported and patched this issue in the August 2026 CPU, suggesting internal discovery.

CVE-2026-71099 Aug 18, 21:18 HIGH This Week

Full system takeover of Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 is achievable by a high-privileged attacker over HTTP, targeting the Analytics Web Answers component with no user interaction required. The C:H/I:H/A:H impact triad confirms complete compromise of confidentiality, integrity, and availability once exploitation succeeds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means that any attacker who clears the authentication barrier faces minimal technical obstacles to achieving full takeover.

CVE-2026-71098 Aug 18, 21:18 HIGH This Week

Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows a low-privileged attacker with local logon access to the host infrastructure to fully compromise the application, achieving confidentiality, integrity, and availability takeover. The attack complexity is rated high, indicating non-trivial exploitation conditions must be met. No public exploit or active exploitation has been identified at time of analysis, but full system takeover is the confirmed impact per Oracle's advisory.

CVE-2026-71097 Aug 18, 21:18 HIGH This Week

Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows a low-privileged attacker with OS-level logon to the hosting infrastructure to achieve full takeover of the BIEE instance. The Platform Security component contains an easily exploitable flaw that, once triggered, yields complete confidentiality, integrity, and availability compromise - equivalent to host-level control over the analytics platform. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and absence of user-interaction requirements make this straightforward to exploit once local access is established.

CVE-2026-71096 Aug 18, 21:18 HIGH This Week

Partial authentication bypass in Oracle Business Intelligence Enterprise Edition's BI Platform Security component allows a low-privileged remote attacker to compromise both confidentiality and integrity of critical OBIEE data, with a scope change indicating spillover impact on additional Oracle products within the same environment. Affected versions span three distinct release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - covering a wide enterprise install base. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the combination of high-impact scope change and low privilege requirement elevates urgency even given the high attack complexity.

CVE-2026-71095 Aug 18, 21:18 HIGH This Week

Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 exposes critical data and modification capabilities to low-privileged network attackers through a flaw in the BI Platform Security component, reachable via HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) combined with the 'Authentication Bypass' tag suggests an authenticated-but-low-privileged attacker can escalate access beyond their authorization boundary, achieving complete read and write access to all BI data plus partial availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high data impact make this a meaningful priority for organizations running this version.

CVE-2026-71094 Aug 18, 21:18 HIGH This Week

Complete compromise of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Presentation Services component by a low-privileged attacker who already holds a local logon on the OBIEE host and can engineer interaction from a second user. Successful exploitation yields full confidentiality, integrity, and availability impact - effectively a takeover of the OBIEE instance. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of this analysis.

CVE-2026-71061 Aug 18, 21:18 HIGH This Week

Unauthenticated remote access to critical data in Oracle Business Intelligence Enterprise Edition (BIEE) is possible via a BI Platform Security authentication bypass reachable over HTTP. Affected versions 8.2.0.0.0 and 26.01.0.0.0 allow a network attacker with no credentials to read all data accessible through the BIEE platform, including potentially sensitive business reports, dashboards, and underlying data source content. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero authentication requirement make this a high-priority patching target.

CVE-2026-71056 Aug 18, 21:18 HIGH This Week

Unauthorized data disclosure in Oracle Business Intelligence Enterprise Edition's BI Search component allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible within the platform, with a confirmed scope change that may expose data in additional Oracle products. Affected versions span 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, covering both legacy and current release lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and scope change elevate real-world concern for organizations running internet-accessible OBIEE deployments.

CVE-2026-71055 Aug 18, 21:18 HIGH This Week

Full system takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable by any low-privileged authenticated user over HTTP, with no user interaction required. The Platform Security component flaw yields complete confidentiality, integrity, and availability compromise as described in Oracle's August 2026 Critical Security Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a high-priority remediation target for organizations running OBIEE 12.2.1.4.0.

CVE-2026-61302 Aug 18, 21:16 HIGH This Week

Remote unauthenticated exploitation of Oracle Business Intelligence Enterprise Edition's Pod Admin component allows attackers to access critical analytics data and cause partial service disruption over HTTP without credentials. Versions 8.2.0.0.0 and 26.01.0.0.0 are confirmed affected, with a CVSS 3.1 score of 8.2 reflecting low attack complexity and no authentication or user interaction requirement. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog; Oracle has addressed it in the August 2026 Critical Patch Update.

CVE-2026-60674 Jul 21, 22:18 HIGH This Week

Unauthenticated data compromise in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) lets a remote attacker reach the BI Platform Security component over HTTP and read all BI-accessible data plus perform limited unauthorized writes. Oracle rates it CVSS 3.1 8.2 and the reporter tags it an authentication bypass, meaning no credentials are needed against affected default deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and no-privilege requirement make it a high-priority patch in the July 2026 Oracle Critical Patch Update.

CVE-2026-60671 Jul 21, 22:18 HIGH This Week

Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

CVE-2026-21976 Jan 20, 22:16 HIGH This Week

Business Intelligence versions up to 7.6.0.0.0 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 7.1).

CVE-2024-21139 Jul 16, 23:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Answers). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-21099 Apr 16, 22:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Data Visualization). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-21064 Apr 16, 22:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Answers). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-21001 Apr 16, 22:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-20913 Feb 17, 02:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-20904 Jan 16, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2023-22109 Oct 17, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Dashboards). Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22082 Oct 17, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22061 Jul 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22027 Jul 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22021 Jul 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22020 Jul 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22013 Jul 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22012 Jul 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22011 Jul 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-21965 Apr 18, 20:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-21952 Apr 18, 20:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-21910 Apr 18, 20:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-21892 Jan 18, 00:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-21891 Jan 18, 00:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-21861 Jan 18, 00:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-21609 Oct 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-21492 Apr 19, 21:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-21448 Apr 19, 21:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-21421 Apr 19, 21:15 HIGH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-21419 Apr 19, 21:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-23307 Jan 18, 16:15 Maven HIGH PATCH This Week

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2022-23305 Jan 18, 16:15 Maven CRITICAL PATCH GHSA Act Now

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

CVE-2022-23302 Jan 18, 16:15 Maven HIGH PATCH This Week

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-45105 Dec 18, 12:15 Maven MEDIUM PATCH This Month

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

CVE-2021-4104 Dec 14, 12:15 Maven HIGH Act Now

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 72.2% and no vendor patch available.

CVE-2021-2456 Jul 21, 00:15 CRITICAL Act Now

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-30468 Jun 16, 12:15 Maven HIGH PATCH This Week

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

CVE-2021-2191 Apr 22, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-2152 Apr 22, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable.

CVE-2021-22696 Apr 02, 10:15 Maven HIGH PATCH This Week

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

CVE-2021-23841 Feb 16, 17:15 Cargo MEDIUM PATCH This Month

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

CVE-2021-23840 Feb 16, 17:15 Cargo HIGH PATCH This Week

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.

CVE-2021-23839 Feb 16, 17:15 LOW PATCH Monitor

OpenSSL 1.0.2 supports SSLv2. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.

CVE-2021-2041 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2021-2025 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2005 Jan 20, 15:15 MEDIUM This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI Platform Security). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2003 Jan 20, 15:15 MEDIUM This Month

Vulnerability in the Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Dashboards). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-17530 Dec 11, 02:15 Maven CRITICAL POC KEV PATCH THREAT Act Now

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-1971 Dec 08, 16:15 MEDIUM PATCH This Month

The X.509 GeneralName type is a generic type for representing different types of names. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

CVE-2020-13954 Nov 12, 13:15 Maven MEDIUM PATCH This Month

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-14864 Oct 21, 15:15 HIGH POC KEV THREAT This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-14843 Oct 21, 15:15 HIGH PATCH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-14815 Oct 21, 15:15 HIGH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-14766 Oct 21, 15:15 HIGH PATCH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Administration). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-14690 Jul 15, 18:15 HIGH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-14626 Jul 15, 18:15 HIGH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2020-14609 Jul 15, 18:15 HIGH PATCH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Answers). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-14548 Jul 15, 18:15 LOW Monitor

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2020-9480 Jun 23, 22:15 LIB CRITICAL POC PATCH THREAT Act Now

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.

CVE-2020-11023 Apr 29, 21:15 LIB MEDIUM POC KEV PATCH THREAT This Month

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-2950 Apr 15, 14:15 CRITICAL PATCH Act Now

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2537 Jan 15, 17:15 HIGH PATCH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2535 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2531 Jan 15, 17:15 LOW PATCH Monitor

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI Platform Security). Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required.

CVE-2019-10219 Nov 08, 15:15 Maven MEDIUM POC PATCH This Month

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-3012 Oct 16, 18:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI Platform Security). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2905 Oct 16, 18:15 HIGH PATCH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2900 Oct 16, 18:15 HIGH PATCH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2897 Oct 16, 18:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2019-2605 Apr 23, 19:32 LOW PATCH Monitor

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Web Catalog). Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, no authentication required.

CVE-2019-1559 Feb 27, 23:29 MEDIUM PATCH This Month

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.

CVE-2018-3204 Oct 17, 01:31 HIGH PATCH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-8013 May 24, 16:29 Maven CRITICAL PATCH Act Now

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2018-2715 Jan 18, 02:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: BI Platform Security). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-10163 Oct 19, 17:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web General). Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-10060 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web General). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10058 Aug 08, 15:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web Administration). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity.

CVE-2016-7103 Mar 15, 16:59 LIB MEDIUM POC PATCH This Month

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2016-3544 Jul 21, 10:13 HIGH PATCH This Week

Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 11.2.1.0.0 allows remote authenticated users to. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity.