Content Manager
Monthly
Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.
Oracle Content Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite expose a medium-severity flaw in the Cover Letter component, exploitable by any low-privileged authenticated user over HTTP without user interaction. Successful exploitation allows unauthorized read access to a subset of Content Manager data, unauthorized insert/update/delete of accessible records, and partial denial of service against the component. No public exploit code and no CISA KEV listing have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.
Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Content Item Manager). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Content). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote Access Control Bypass in Micro Focus Content Manager. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Content Manager component of Oracle E-Business Suite (subcomponent: Cover Letter). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM Content Manager Enterprise Edition Resource Manager 8.4.3 and 9.5 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A potential security vulnerability has been identified in HPE Content Manager Workgroup Service v9.00. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 93.7%.
Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.
Oracle Content Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite expose a medium-severity flaw in the Cover Letter component, exploitable by any low-privileged authenticated user over HTTP without user interaction. Successful exploitation allows unauthorized read access to a subset of Content Manager data, unauthorized insert/update/delete of accessible records, and partial denial of service against the component. No public exploit code and no CISA KEV listing have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.
Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Content Item Manager). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Content). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote Access Control Bypass in Micro Focus Content Manager. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Content Manager component of Oracle E-Business Suite (subcomponent: Cover Letter). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM Content Manager Enterprise Edition Resource Manager 8.4.3 and 9.5 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A potential security vulnerability has been identified in HPE Content Manager Workgroup Service v9.00. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 93.7%.