Financial Services Revenue Management And Billing
Monthly
Oracle Financial Services Revenue Management and Billing versions 2.9.0.0.0 through 7.2.0.0.0 contain an improper access control flaw in the Security Management System component, enabling an authenticated low-privileged attacker with network access to read critical data. The CVSS score is 6.5 (moderate), and no public exploit code has been identified; EPSS is 0.33% (24th percentile), indicating a low likelihood of exploitation. Affected organizations should prioritize patching based on their risk posture.
Unauthorized read access to critical data in Oracle Financial Services Revenue Management and Billing (supported versions 2.9.0.0.0 through 7.2.0.0.0) is achievable by a high-privileged, network-positioned attacker who can reach the Security Management System component over HTTP, as described in Oracle's October 2025 Critical Patch Update. The flaw is an information-disclosure weakness (CWE-200) rated CVSS 3.1 base 4.9 with confidentiality-only impact (C:H) and a CVSS PR:H precondition, so the realistic actor is an already-trusted administrator/operator or a post-compromise account holder rather than an unauthenticated outsider; no user interaction is required. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is 0.40% (32nd percentile), consistent with low real-world exploitation likelihood.
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable.
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: On Demand Billing). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Oracle Financial Services Revenue Management and Billing versions 2.9.0.0.0 through 7.2.0.0.0 contain an improper access control flaw in the Security Management System component, enabling an authenticated low-privileged attacker with network access to read critical data. The CVSS score is 6.5 (moderate), and no public exploit code has been identified; EPSS is 0.33% (24th percentile), indicating a low likelihood of exploitation. Affected organizations should prioritize patching based on their risk posture.
Unauthorized read access to critical data in Oracle Financial Services Revenue Management and Billing (supported versions 2.9.0.0.0 through 7.2.0.0.0) is achievable by a high-privileged, network-positioned attacker who can reach the Security Management System component over HTTP, as described in Oracle's October 2025 Critical Patch Update. The flaw is an information-disclosure weakness (CWE-200) rated CVSS 3.1 base 4.9 with confidentiality-only impact (C:H) and a CVSS PR:H precondition, so the realistic actor is an already-trusted administrator/operator or a post-compromise account holder rather than an unauthenticated outsider; no user interaction is required. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is 0.40% (32nd percentile), consistent with low real-world exploitation likelihood.
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable.
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: On Demand Billing). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.