Time And Labor
Monthly
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Oracle rates it CVSS 3.1 8.1 (C:H/I:H) and describes it as easily exploitable, though availability is unaffected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthorized data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (High) with high confidentiality and integrity impact but no availability impact, it was reported by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle Time and Labor (Oracle E-Business Suite 12.2.3-12.2.15, Internal Operations component) allows a low-privileged, network-authenticated attacker to create, delete, or modify all Time and Labor accessible data and partially disrupt the service over HTTP. The CVSS 3.1 base score is 7.1 (I:H/A:L, no confidentiality impact), reflecting an integrity-focused flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Time and Labor module. Scored CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is easily exploitable per Oracle but requires an existing low-privilege account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in the Oracle Critical Patch Update of July 2026.
Partial denial-of-service affecting Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by a low-privileged network attacker over HTTP under high-complexity conditions. Successful exploitation degrades availability of the Internal Operations component only, with zero confidentiality or integrity impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog, placing it at the low end of operational priority.
Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical application data via HTTP under high-complexity conditions. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting insufficient internal authorization enforcement rather than a perimeter access failure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the I:H integrity impact makes successful exploitation consequential for workforce and payroll data integrity.
Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Internal Operations) enables unauthenticated remote attackers to compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content, with scope change indicating impact extends beyond the vulnerable component to additional E-Business Suite products. Affected deployments span versions 12.2.3 through 12.2.15. The Oracle July 2026 CPU addresses this; no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of all accessible labor data, plus limited availability disruption via HTTP. The 'Authentication Bypass' tag in associated intelligence sources introduces a notable discrepancy with the CVSS PR:H rating - if the flaw enables privilege escalation or access-control bypass within the product, the effective impact of an already-privileged session would be materially higher than the base CVSS score of 6.7 suggests. No public exploit code exists and exploitation is not confirmed by CISA KEV at time of analysis.
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Time and Labor (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 exposes a difficult-to-exploit flaw that allows a high-privileged, network-authenticated attacker operating over HTTP to gain complete read access to all Time and Labor data and limited write access (insert, update, delete), with scope change implications affecting additional Oracle EBS components. Tagged as an authentication bypass by ENISA EUVD intelligence, this conflict with the CVSS PR:H requirement warrants investigative scrutiny - it may indicate a secondary authorization bypass rather than a full authentication bypass. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Oracle rates it CVSS 3.1 8.1 (C:H/I:H) and describes it as easily exploitable, though availability is unaffected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthorized data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (High) with high confidentiality and integrity impact but no availability impact, it was reported by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle Time and Labor (Oracle E-Business Suite 12.2.3-12.2.15, Internal Operations component) allows a low-privileged, network-authenticated attacker to create, delete, or modify all Time and Labor accessible data and partially disrupt the service over HTTP. The CVSS 3.1 base score is 7.1 (I:H/A:L, no confidentiality impact), reflecting an integrity-focused flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Time and Labor module. Scored CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is easily exploitable per Oracle but requires an existing low-privilege account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in the Oracle Critical Patch Update of July 2026.
Partial denial-of-service affecting Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by a low-privileged network attacker over HTTP under high-complexity conditions. Successful exploitation degrades availability of the Internal Operations component only, with zero confidentiality or integrity impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog, placing it at the low end of operational priority.
Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical application data via HTTP under high-complexity conditions. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting insufficient internal authorization enforcement rather than a perimeter access failure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the I:H integrity impact makes successful exploitation consequential for workforce and payroll data integrity.
Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Internal Operations) enables unauthenticated remote attackers to compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content, with scope change indicating impact extends beyond the vulnerable component to additional E-Business Suite products. Affected deployments span versions 12.2.3 through 12.2.15. The Oracle July 2026 CPU addresses this; no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of all accessible labor data, plus limited availability disruption via HTTP. The 'Authentication Bypass' tag in associated intelligence sources introduces a notable discrepancy with the CVSS PR:H rating - if the flaw enables privilege escalation or access-control bypass within the product, the effective impact of an already-privileged session would be materially higher than the base CVSS score of 6.7 suggests. No public exploit code exists and exploitation is not confirmed by CISA KEV at time of analysis.
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Time and Labor (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 exposes a difficult-to-exploit flaw that allows a high-privileged, network-authenticated attacker operating over HTTP to gain complete read access to all Time and Labor data and limited write access (insert, update, delete), with scope change implications affecting additional Oracle EBS components. Tagged as an authentication bypass by ENISA EUVD intelligence, this conflict with the CVSS PR:H requirement warrants investigative scrutiny - it may indicate a secondary authorization bypass rather than a full authentication bypass. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.