Health Sciences Data Management Workbench
Monthly
Data disclosure in Oracle Health Sciences Data Management Workbench 3.4.0.1.3 and 3.4.1.0.10 allows an authenticated high-privilege attacker with HTTP network access to read critical data via the Logger component. The vulnerability has low attack complexity and no user-interaction requirement, but the high-privilege prerequisite (CVSS PR:H) makes it primarily an insider or post-compromise confidentiality risk; impact is limited to unauthorized read access with no integrity or availability effect. EPSS is 0.30% (21st percentile), no public exploit identified at time of analysis, and this CVE is not confirmed actively exploited (CISA KEV).
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has...
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Health Sciences Data Management Workbench component of Oracle Health Sciences Applications (subcomponent: User Interface). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Data disclosure in Oracle Health Sciences Data Management Workbench 3.4.0.1.3 and 3.4.1.0.10 allows an authenticated high-privilege attacker with HTTP network access to read critical data via the Logger component. The vulnerability has low attack complexity and no user-interaction requirement, but the high-privilege prerequisite (CVSS PR:H) makes it primarily an insider or post-compromise confidentiality risk; impact is limited to unauthorized read access with no integrity or availability effect. EPSS is 0.30% (21st percentile), no public exploit identified at time of analysis, and this CVE is not confirmed actively exploited (CISA KEV).
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has...
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Health Sciences Data Management Workbench component of Oracle Health Sciences Applications (subcomponent: User Interface). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.