Sales For Handhelds
Monthly
Full system takeover of Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated attacker with HTTP network access, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Internal Operations component and requires no user interaction or elevated privileges beyond a basic account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version range make this a credible lateral-movement or privilege-escalation risk within Oracle EBS environments.
Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.
Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(PocketPC)). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Full system takeover of Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated attacker with HTTP network access, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Internal Operations component and requires no user interaction or elevated privileges beyond a basic account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version range make this a credible lateral-movement or privilege-escalation risk within Oracle EBS environments.
Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.
Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(PocketPC)). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.