Knowledge Management

CVE-2026-61261 Jul 21, 22:18 MEDIUM This Month

Unauthorized data access in Oracle Knowledge Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP without user interaction. Exploitation allows unauthorized read access to a subset of Knowledge Management data and unauthorized insert, update, or delete operations against accessible data records. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the 'Authentication Bypass' tag warrants scrutiny given the CVSS PR:L rating.

CVE-2026-60842 Jul 21, 22:18 MEDIUM This Month

The Search component of Oracle Knowledge Management in E-Business Suite versions 12.2.5 through 12.2.15 allows unauthenticated network attackers to compromise data confidentiality and integrity when a victim user interacts with a crafted HTTP request, with successful exploitation producing a scope change that can impact additional E-Business Suite products. Disclosed via Oracle's July 2026 Critical Patch Update, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) scores 6.1 and is consistent with a reflected injection class - likely Cross-Site Scripting - given the combination of no-privilege network access, required human interaction, and cross-product scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.

CVE-2024-20943 Feb 17, 02:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-20948 Jan 16, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-20940 Jan 16, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Create, Update, Authoring Flow). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

CVE-2021-2198 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2841 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-2719 Apr 23, 19:32 MEDIUM PATCH This Month

Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Web Applications (InfoCenter)). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2660 Apr 23, 19:32 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: Setup, Admin). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10412 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10411 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10410 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: Search). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3367 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3366 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3365 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3364 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3363 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3362 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2016-3542 Jul 21, 10:13 MEDIUM POC PATCH THREAT This Month

Unspecified vulnerability in the Oracle Knowledge Management component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote administrators to affect. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 28.3%.

CVE-2016-3533 Jul 21, 10:13 MEDIUM PATCH This Month

Unspecified vulnerability in the Oracle Knowledge Management component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.