CVE-2016-0635

Severity Score

8.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Master Person Index component in Oracle Health Sciences Applications 2.0.12, 3.0.0, and 4.0.1; the Oracle Documaker component in Oracle Insurance Applications before 12.5; the Oracle Insurance Calculation Engine component in Oracle Insurance Applications 9.7.1, 10.1.2, and 10.2.2; the Oracle Insurance Policy Administration J2EE and Oracle Insurance Rules Palette components in Oracle Insurance Applications 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, and 10.2.2; the Oracle Retail Integration Bus component in Oracle Retail Applications 15.0; the Oracle Retail Order Broker component in Oracle Retail Applications 5.1, 5.2, and 15.0; the Primavera Contract Management component in Oracle Primavera Products Suite 14.2; the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.2, 8.3, 8.4, 15.1, 15.2, and 16.1; the Oracle Financial Services Analytical Applications Infrastructure component in Oracle Financial Services Applications 8.0.0, 8.0.1, 8.0.2, and 8.0.3; the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce 3.1.1, 3.1.2, 11.0, 11.1, and 11.2; the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5; the Oracle Communications BRM - Elastic Charging Engine 11.2.0.0.0 and 11.3.0.0.0; the Oracle Enterprise Repository Enterprise Repository 12.1.3.0.0; the Oracle Financial Services Behavior Detection Platform 8.0.1 and 8.0.2; the Oracle Hyperion Essbase 12.2.1.1; the Oracle Tuxedo System and Applications Monitor (TSAM) 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.1, 12.1.1.1.0, 12.1.3.0.0, and 12.2.2.0.0; the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Spring)) 7.0, 7.1 and 7.2; the Oracle Endeca Information Discovery Integrator 3.2; the Converged Commerce component of Oracle Retail Applications 16.0.1; the Oracle Identity Manager 11.1.2.3.0; Oracle Enterprise Manager for MySQL Database 12.1.0.4; Oracle Retail Invoice Matching 12.0, 13.0, 13.1, 13.2, 14.0, and 14.1; Oracle Communications Performance Intelligence Center (PIC) Software Prior to 10.2.1 and the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: AnswerFlow (Spring Framework)) version 8.5.1.0 - 8.5.1.7 and 8.6.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

Vulnerabilidad no especificada en el componente Enterprise Manager OPS Center en Oracle Enterprise Manager Grid Control versiones 12.1.4, 12.2.2 y 12.3.2; el componente Oracle Health Sciences Information Manager en Oracle Health Sciences versiones 1.2.8.3, 2.0.2.3 y 3.0.1.0; el componente de Oracle Healthcare Master Person index en Oracle Health Sciences Applications versiones 2.0.12, 3.0.0 y 4.0.1; el componente Oracle Insurance Calculation Engine en Oracle Insurance Applications anterior a la versión 12.5; el componente Insurance Calculation Engine de Oracle en las Oracle Insurance Applications versiones 9.7.1, 10.1.2 y 10.2.2; la Insurance Policy Administration de Oracle versión J2EE y los componentes de Oracle Insurance Rules Palette in Oracle Insurance Applications versiones 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0 y 10.2.2; el componente Oracle Retail Integration Bus en Oracle Retail Applications versión 15.0; el componente Oracle Retail Order Broker en Oracle Retail Applications versiones 5.1, 5.2 y 15.0; el componente Primavera Contract Management en Oracle Primavera Products Suite 14.2; el componente de Primavera P6 Enterprise Project Portfolio Management en Oracle primavera Products Suite versiones 8.2, 8.3, 8.4, 15.1, 15.2 y 16,1; el componente Financial Services Analytical Applications Infrastructure de Oracle Financial Services Applications de Oracle Financial Services versiones 8.0.0, 8.0.1, 8.0.2 y 8.0.3; los componentes de Oracle Commerce Guided Search / Oracle Commerce Experience Manager en Oracle Commerce versiones 3.1.1, 3.1.2, 11.0, 11.1 y 11.2; el componente Oracle Agile PLM en Oracle Supply Chain Products Suite versiones 9.3.4 y 9.3.5; en Oracle Communications BRM - Elastic Charging Engine en las versiones 11.2.0.0.0 y 11.3.0.0.0; Oracle Enterprise Repository versión 12.1.3.0.0; en Oracle Financial Services Behavior Detection Platform versiones 8.0.1 y 8.0.2; en Oracle Hyperion Essbase versión 12.2.1.1; en Oracle Tuxedo System and Applications Monitor (TSAM) versiones 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.1, 12.1.1.1.0, 12.1.3.0.0 y 12.2.2.0.0; el componente de Oracle Communications WebRTC Session Controller de la aplicación Oracle Communications (subcomponente: seguridad (Spring)) versiones 7.0, 7.1 y 7.2; en Oracle Endeca Information Discovery Integrator versión 3.2; el componente Converged Commerce de Oracle Retail Applications 16.0.1; Oracle Identity Manager versión 11.1.2.3.0; en Oracle Enterprise Manager para MySQL Database versión 12.1.0.4; Oracle Retail Invoice Matching versiones 12.0, 13.0, 13.1, 13.2, 14.0 y 14.1; en Software Oracle Communications Performance Intelligence Center (PIC) anterior a la versión 10.2.1 y el componente Oracle Knowledge de Oracle Siebel CRM (subcomponente: AnswerFlow (Spring Framework)) versiones 8.5.1.0, 8.5.1.7 y 8.6.0 permite a los usuarios autenticados remotos afectar a la confidencialidad, integridad y disponibilidad por medio de vectores desconocidos.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2015-12-09 CVE Reserved
2016-07-21 CVE Published
2024-08-20 EPSS Updated
2024-10-11 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (17)

URL	Tag	Source
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html	X_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	X_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	X_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	X_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	X_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	X_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	X_refsource_confirm
http://www.securityfocus.com/bid/91787	Third Party Advisory
http://www.securityfocus.com/bid/91869	Vdb Entry
http://www.securitytracker.com/id/1036377	Vdb Entry
http://www.securitytracker.com/id/1036378	Vdb Entry
http://www.securitytracker.com/id/1036393	Vdb Entry
http://www.securitytracker.com/id/1036397	Vdb Entry
http://www.securitytracker.com/id/1037640	Vdb Entry
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	X_refsource_misc
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	2019-04-23

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Oracle Search vendor "Oracle"		Documaker Search vendor "Oracle" for product "Documaker"				<= 12.5 Search vendor "Oracle" for product "Documaker" and version " <= 12.5"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager Ops Center Search vendor "Oracle" for product "Enterprise Manager Ops Center"				12.1.4 Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.1.4"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager Ops Center Search vendor "Oracle" for product "Enterprise Manager Ops Center"				12.2.2 Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.2.2"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager Ops Center Search vendor "Oracle" for product "Enterprise Manager Ops Center"				12.3.2 Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.3.2"		-		Affected
Oracle Search vendor "Oracle"		Health Sciences Information Manager Search vendor "Oracle" for product "Health Sciences Information Manager"				1.2.8.3 Search vendor "Oracle" for product "Health Sciences Information Manager" and version "1.2.8.3"		-		Affected
Oracle Search vendor "Oracle"		Health Sciences Information Manager Search vendor "Oracle" for product "Health Sciences Information Manager"				2.0.2.3 Search vendor "Oracle" for product "Health Sciences Information Manager" and version "2.0.2.3"		-		Affected
Oracle Search vendor "Oracle"		Health Sciences Information Manager Search vendor "Oracle" for product "Health Sciences Information Manager"				3.0.1.0 Search vendor "Oracle" for product "Health Sciences Information Manager" and version "3.0.1.0"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Master Person Index Search vendor "Oracle" for product "Healthcare Master Person Index"				2.0.12 Search vendor "Oracle" for product "Healthcare Master Person Index" and version "2.0.12"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Master Person Index Search vendor "Oracle" for product "Healthcare Master Person Index"				3.0.0 Search vendor "Oracle" for product "Healthcare Master Person Index" and version "3.0.0"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Master Person Index Search vendor "Oracle" for product "Healthcare Master Person Index"				4.0.1 Search vendor "Oracle" for product "Healthcare Master Person Index" and version "4.0.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Calculation Engine Search vendor "Oracle" for product "Insurance Calculation Engine"				9.7.1 Search vendor "Oracle" for product "Insurance Calculation Engine" and version "9.7.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Calculation Engine Search vendor "Oracle" for product "Insurance Calculation Engine"				10.1.2 Search vendor "Oracle" for product "Insurance Calculation Engine" and version "10.1.2"		-		Affected
Oracle Search vendor "Oracle"		Insurance Calculation Engine Search vendor "Oracle" for product "Insurance Calculation Engine"				10.2.2 Search vendor "Oracle" for product "Insurance Calculation Engine" and version "10.2.2"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration J2ee Search vendor "Oracle" for product "Insurance Policy Administration J2ee"				9.6.1 Search vendor "Oracle" for product "Insurance Policy Administration J2ee" and version "9.6.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration J2ee Search vendor "Oracle" for product "Insurance Policy Administration J2ee"				9.7.1 Search vendor "Oracle" for product "Insurance Policy Administration J2ee" and version "9.7.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration J2ee Search vendor "Oracle" for product "Insurance Policy Administration J2ee"				10.0.1 Search vendor "Oracle" for product "Insurance Policy Administration J2ee" and version "10.0.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration J2ee Search vendor "Oracle" for product "Insurance Policy Administration J2ee"				10.1.2 Search vendor "Oracle" for product "Insurance Policy Administration J2ee" and version "10.1.2"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration J2ee Search vendor "Oracle" for product "Insurance Policy Administration J2ee"				10.2.0 Search vendor "Oracle" for product "Insurance Policy Administration J2ee" and version "10.2.0"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration J2ee Search vendor "Oracle" for product "Insurance Policy Administration J2ee"				10.2.2 Search vendor "Oracle" for product "Insurance Policy Administration J2ee" and version "10.2.2"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				9.6.1 Search vendor "Oracle" for product "Insurance Rules Palette" and version "9.6.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				9.7.1 Search vendor "Oracle" for product "Insurance Rules Palette" and version "9.7.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				10.0.1 Search vendor "Oracle" for product "Insurance Rules Palette" and version "10.0.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				10.1.2 Search vendor "Oracle" for product "Insurance Rules Palette" and version "10.1.2"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				10.2.0 Search vendor "Oracle" for product "Insurance Rules Palette" and version "10.2.0"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				10.2.2 Search vendor "Oracle" for product "Insurance Rules Palette" and version "10.2.2"		-		Affected
Oracle Search vendor "Oracle"		Primavera Contract Management Search vendor "Oracle" for product "Primavera Contract Management"				14.2 Search vendor "Oracle" for product "Primavera Contract Management" and version "14.2"		-		Affected
Oracle Search vendor "Oracle"		Primavera P6 Enterprise Project Portfolio Management Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management"				8.2 Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management" and version "8.2"		-		Affected
Oracle Search vendor "Oracle"		Primavera P6 Enterprise Project Portfolio Management Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management"				8.3 Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management" and version "8.3"		-		Affected
Oracle Search vendor "Oracle"		Primavera P6 Enterprise Project Portfolio Management Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management"				8.4 Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management" and version "8.4"		-		Affected
Oracle Search vendor "Oracle"		Primavera P6 Enterprise Project Portfolio Management Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management"				15.1 Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management" and version "15.1"		-		Affected
Oracle Search vendor "Oracle"		Primavera P6 Enterprise Project Portfolio Management Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management"				15.2 Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management" and version "15.2"		-		Affected
Oracle Search vendor "Oracle"		Primavera P6 Enterprise Project Portfolio Management Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management"				16.1 Search vendor "Oracle" for product "Primavera P6 Enterprise Project Portfolio Management" and version "16.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Integration Bus Search vendor "Oracle" for product "Retail Integration Bus"				15.0 Search vendor "Oracle" for product "Retail Integration Bus" and version "15.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Order Broker Cloud Service Search vendor "Oracle" for product "Retail Order Broker Cloud Service"				5.1 Search vendor "Oracle" for product "Retail Order Broker Cloud Service" and version "5.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Order Broker Cloud Service Search vendor "Oracle" for product "Retail Order Broker Cloud Service"				5.2 Search vendor "Oracle" for product "Retail Order Broker Cloud Service" and version "5.2"		-		Affected
Oracle Search vendor "Oracle"		Retail Order Broker Cloud Service Search vendor "Oracle" for product "Retail Order Broker Cloud Service"				15.0 Search vendor "Oracle" for product "Retail Order Broker Cloud Service" and version "15.0"		-		Affected