CVE-2019-10086

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

Severity Score

7.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

En Apache Commons Beanutils 1.9.2, se agregó una clase especial BeanIntrospector que permite suprimir la capacidad de un atacante para acceder al cargador de clases a través de la propiedad de clase disponible en todos los objetos Java. Sin embargo, no se esta usando esta característica por defecto de PropertyUtilsBean.

A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-03-26 CVE Reserved
2019-08-20 CVE Published
2024-08-04 CVE Updated
2024-08-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-502: Deserialization of Untrusted Data

CAPEC

References (57)

URL	Tag	Source
http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e	Mailing List
https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e%40%3Cissues.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098%40%3Cissues.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825%40%3Ccommits.dolphinscheduler.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58%40%3Cdev.atlas.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe%40%3Cissues.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1%40%3Cdev.atlas.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c%40%3Ccommits.dolphinscheduler.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6%40%3Cdev.atlas.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997%40%3Cissues.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba%40%3Ccommits.atlas.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2%40%3Cissues.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957%40%3Cissues.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b%40%3Ccommits.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1%40%3Cissues.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534%40%3Cissues.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.org%3E	Mailing List
https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html	Mailing List
https://www.oracle.com/security-alerts/cpujan2020.html	Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	X_refsource_misc

URL	Date	SRC

URL	Date	SRC
https://www.oracle.com//security-alerts/cpujul2021.html	2023-11-07
https://www.oracle.com/security-alerts/cpuApr2021.html	2023-11-07
https://www.oracle.com/security-alerts/cpuapr2020.html	2023-11-07
https://www.oracle.com/security-alerts/cpuapr2022.html	2023-11-07
https://www.oracle.com/security-alerts/cpujan2021.html	2023-11-07
https://www.oracle.com/security-alerts/cpujan2022.html	2023-11-07
https://www.oracle.com/security-alerts/cpujul2020.html	2023-11-07
https://www.oracle.com/security-alerts/cpuoct2021.html	2023-11-07

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html	2023-11-07
https://access.redhat.com/errata/RHSA-2019:4317	2023-11-07
https://access.redhat.com/errata/RHSA-2020:0057	2023-11-07
https://access.redhat.com/errata/RHSA-2020:0194	2023-11-07
https://access.redhat.com/errata/RHSA-2020:0804	2023-11-07
https://access.redhat.com/errata/RHSA-2020:0805	2023-11-07
https://access.redhat.com/errata/RHSA-2020:0806	2023-11-07
https://access.redhat.com/errata/RHSA-2020:0811	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO	2023-11-07
https://access.redhat.com/security/cve/CVE-2019-10086	2024-08-26
https://bugzilla.redhat.com/show_bug.cgi?id=1767483	2024-08-26

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.2.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.2.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.2.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.2.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.2.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.2.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	8.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "8.0"	-	Safe
Apache Search vendor "Apache"		Commons Beanutils Search vendor "Apache" for product "Commons Beanutils"				>= 1.0 <= 1.9.3 Search vendor "Apache" for product "Commons Beanutils" and version " >= 1.0 <= 1.9.3"		-		Affected
Apache Search vendor "Apache"		Nifi Search vendor "Apache" for product "Nifi"				1.14.0 Search vendor "Apache" for product "Nifi" and version "1.14.0"		-		Affected
Apache Search vendor "Apache"		Nifi Search vendor "Apache" for product "Nifi"				1.15.0 Search vendor "Apache" for product "Nifi" and version "1.15.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.0 Search vendor "Opensuse" for product "Leap" and version "15.0"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.1 Search vendor "Opensuse" for product "Leap" and version "15.1"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				30 Search vendor "Fedoraproject" for product "Fedora" and version "30"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				31 Search vendor "Fedoraproject" for product "Fedora" and version "31"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				7.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Eus Search vendor "Redhat" for product "Enterprise Linux Eus"				7.7 Search vendor "Redhat" for product "Enterprise Linux Eus" and version "7.7"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Aus Search vendor "Redhat" for product "Enterprise Linux Server Aus"				7.7 Search vendor "Redhat" for product "Enterprise Linux Server Aus" and version "7.7"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Tus Search vendor "Redhat" for product "Enterprise Linux Server Tus"				7.7 Search vendor "Redhat" for product "Enterprise Linux Server Tus" and version "7.7"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				7.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.3 Search vendor "Oracle" for product "Agile Plm" and version "9.3.3"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.5 Search vendor "Oracle" for product "Agile Plm" and version "9.3.5"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.6 Search vendor "Oracle" for product "Agile Plm" and version "9.3.6"		-		Affected
Oracle Search vendor "Oracle"		Agile Product Lifecycle Management Integration Pack Search vendor "Oracle" for product "Agile Product Lifecycle Management Integration Pack"				3.5 Search vendor "Oracle" for product "Agile Product Lifecycle Management Integration Pack" and version "3.5"		e-business_suite		Affected
Oracle Search vendor "Oracle"		Agile Product Lifecycle Management Integration Pack Search vendor "Oracle" for product "Agile Product Lifecycle Management Integration Pack"				3.5 Search vendor "Oracle" for product "Agile Product Lifecycle Management Integration Pack" and version "3.5"		sap		Affected
Oracle Search vendor "Oracle"		Agile Product Lifecycle Management Integration Pack Search vendor "Oracle" for product "Agile Product Lifecycle Management Integration Pack"				3.6 Search vendor "Oracle" for product "Agile Product Lifecycle Management Integration Pack" and version "3.6"		e-business_suite		Affected
Oracle Search vendor "Oracle"		Agile Product Lifecycle Management Integration Pack Search vendor "Oracle" for product "Agile Product Lifecycle Management Integration Pack"				3.6 Search vendor "Oracle" for product "Agile Product Lifecycle Management Integration Pack" and version "3.6"		sap		Affected
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				13.3.0.1 Search vendor "Oracle" for product "Application Testing Suite" and version "13.3.0.1"		-		Affected
Oracle Search vendor "Oracle"		Banking Platform Search vendor "Oracle" for product "Banking Platform"				2.4.0 Search vendor "Oracle" for product "Banking Platform" and version "2.4.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Platform Search vendor "Oracle" for product "Banking Platform"				2.7.1 Search vendor "Oracle" for product "Banking Platform" and version "2.7.1"		-		Affected
Oracle Search vendor "Oracle"		Banking Platform Search vendor "Oracle" for product "Banking Platform"				2.9.0 Search vendor "Oracle" for product "Banking Platform" and version "2.9.0"		-		Affected
Oracle Search vendor "Oracle"		Blockchain Platform Search vendor "Oracle" for product "Blockchain Platform"				< 21.1.2 Search vendor "Oracle" for product "Blockchain Platform" and version " < 21.1.2"		-		Affected
Oracle Search vendor "Oracle"		Communications Billing And Revenue Management Search vendor "Oracle" for product "Communications Billing And Revenue Management"				7.5 Search vendor "Oracle" for product "Communications Billing And Revenue Management" and version "7.5"		-		Affected
Oracle Search vendor "Oracle"		Communications Billing And Revenue Management Search vendor "Oracle" for product "Communications Billing And Revenue Management"				12.0.0.3.0 Search vendor "Oracle" for product "Communications Billing And Revenue Management" and version "12.0.0.3.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Billing And Revenue Management Elastic Charging Engine Search vendor "Oracle" for product "Communications Billing And Revenue Management Elastic Charging Engine"				11.3.0.9 Search vendor "Oracle" for product "Communications Billing And Revenue Management Elastic Charging Engine" and version "11.3.0.9"		-		Affected
Oracle Search vendor "Oracle"		Communications Billing And Revenue Management Elastic Charging Engine Search vendor "Oracle" for product "Communications Billing And Revenue Management Elastic Charging Engine"				12.0.0.3 Search vendor "Oracle" for product "Communications Billing And Revenue Management Elastic Charging Engine" and version "12.0.0.3"		-		Affected
Oracle Search vendor "Oracle"		Communications Cloud Native Core Console Search vendor "Oracle" for product "Communications Cloud Native Core Console"				1.4.0 Search vendor "Oracle" for product "Communications Cloud Native Core Console" and version "1.4.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Cloud Native Core Policy Search vendor "Oracle" for product "Communications Cloud Native Core Policy"				1.9.0 Search vendor "Oracle" for product "Communications Cloud Native Core Policy" and version "1.9.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Cloud Native Core Unified Data Repository Search vendor "Oracle" for product "Communications Cloud Native Core Unified Data Repository"				1.6.0 Search vendor "Oracle" for product "Communications Cloud Native Core Unified Data Repository" and version "1.6.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Convergence Search vendor "Oracle" for product "Communications Convergence"				3.0.2.2.0 Search vendor "Oracle" for product "Communications Convergence" and version "3.0.2.2.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Design Studio Search vendor "Oracle" for product "Communications Design Studio"				7.3.4 Search vendor "Oracle" for product "Communications Design Studio" and version "7.3.4"		-		Affected
Oracle Search vendor "Oracle"		Communications Design Studio Search vendor "Oracle" for product "Communications Design Studio"				7.3.5 Search vendor "Oracle" for product "Communications Design Studio" and version "7.3.5"		-		Affected
Oracle Search vendor "Oracle"		Communications Design Studio Search vendor "Oracle" for product "Communications Design Studio"				7.4.0 Search vendor "Oracle" for product "Communications Design Studio" and version "7.4.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Evolved Communications Application Server Search vendor "Oracle" for product "Communications Evolved Communications Application Server"				7.1 Search vendor "Oracle" for product "Communications Evolved Communications Application Server" and version "7.1"		-		Affected
Oracle Search vendor "Oracle"		Communications Metasolv Solution Search vendor "Oracle" for product "Communications Metasolv Solution"				6.3.0 Search vendor "Oracle" for product "Communications Metasolv Solution" and version "6.3.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Metasolv Solution Search vendor "Oracle" for product "Communications Metasolv Solution"				6.3.1 Search vendor "Oracle" for product "Communications Metasolv Solution" and version "6.3.1"		-		Affected
Oracle Search vendor "Oracle"		Communications Network Integrity Search vendor "Oracle" for product "Communications Network Integrity"				7.3.6 Search vendor "Oracle" for product "Communications Network Integrity" and version "7.3.6"		-		Affected
Oracle Search vendor "Oracle"		Communications Performance Intelligence Center Search vendor "Oracle" for product "Communications Performance Intelligence Center"				10.4.0.3 Search vendor "Oracle" for product "Communications Performance Intelligence Center" and version "10.4.0.3"		-		Affected
Oracle Search vendor "Oracle"		Communications Pricing Design Center Search vendor "Oracle" for product "Communications Pricing Design Center"				12.0.0.3.0 Search vendor "Oracle" for product "Communications Pricing Design Center" and version "12.0.0.3.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Unified Inventory Management Search vendor "Oracle" for product "Communications Unified Inventory Management"				7.3.4 Search vendor "Oracle" for product "Communications Unified Inventory Management" and version "7.3.4"		-		Affected
Oracle Search vendor "Oracle"		Communications Unified Inventory Management Search vendor "Oracle" for product "Communications Unified Inventory Management"				7.3.5 Search vendor "Oracle" for product "Communications Unified Inventory Management" and version "7.3.5"		-		Affected
Oracle Search vendor "Oracle"		Communications Unified Inventory Management Search vendor "Oracle" for product "Communications Unified Inventory Management"				7.4.0 Search vendor "Oracle" for product "Communications Unified Inventory Management" and version "7.4.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Unified Inventory Management Search vendor "Oracle" for product "Communications Unified Inventory Management"				7.4.1 Search vendor "Oracle" for product "Communications Unified Inventory Management" and version "7.4.1"		-		Affected
Oracle Search vendor "Oracle"		Customer Management And Segmentation Foundation Search vendor "Oracle" for product "Customer Management And Segmentation Foundation"				18.0 Search vendor "Oracle" for product "Customer Management And Segmentation Foundation" and version "18.0"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager For Virtualization Search vendor "Oracle" for product "Enterprise Manager For Virtualization"				13.4.0.0 Search vendor "Oracle" for product "Enterprise Manager For Virtualization" and version "13.4.0.0"		-		Affected
Oracle Search vendor "Oracle"		Financial Services Revenue Management And Billing Analytics Search vendor "Oracle" for product "Financial Services Revenue Management And Billing Analytics"				2.7 Search vendor "Oracle" for product "Financial Services Revenue Management And Billing Analytics" and version "2.7"		-		Affected
Oracle Search vendor "Oracle"		Financial Services Revenue Management And Billing Analytics Search vendor "Oracle" for product "Financial Services Revenue Management And Billing Analytics"				2.8 Search vendor "Oracle" for product "Financial Services Revenue Management And Billing Analytics" and version "2.8"		-		Affected
Oracle Search vendor "Oracle"		Flexcube Private Banking Search vendor "Oracle" for product "Flexcube Private Banking"				12.0.0 Search vendor "Oracle" for product "Flexcube Private Banking" and version "12.0.0"		-		Affected
Oracle Search vendor "Oracle"		Flexcube Private Banking Search vendor "Oracle" for product "Flexcube Private Banking"				12.1.0 Search vendor "Oracle" for product "Flexcube Private Banking" and version "12.1.0"		-		Affected
Oracle Search vendor "Oracle"		Fusion Middleware Search vendor "Oracle" for product "Fusion Middleware"				11.1.1.9 Search vendor "Oracle" for product "Fusion Middleware" and version "11.1.1.9"		-		Affected
Oracle Search vendor "Oracle"		Fusion Middleware Search vendor "Oracle" for product "Fusion Middleware"				12.2.1.3.0 Search vendor "Oracle" for product "Fusion Middleware" and version "12.2.1.3.0"		-		Affected
Oracle Search vendor "Oracle"		Fusion Middleware Search vendor "Oracle" for product "Fusion Middleware"				12.2.1.4.0 Search vendor "Oracle" for product "Fusion Middleware" and version "12.2.1.4.0"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Foundation Search vendor "Oracle" for product "Healthcare Foundation"				7.1.5 Search vendor "Oracle" for product "Healthcare Foundation" and version "7.1.5"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Foundation Search vendor "Oracle" for product "Healthcare Foundation"				7.2.2 Search vendor "Oracle" for product "Healthcare Foundation" and version "7.2.2"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Foundation Search vendor "Oracle" for product "Healthcare Foundation"				7.3.0 Search vendor "Oracle" for product "Healthcare Foundation" and version "7.3.0"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Foundation Search vendor "Oracle" for product "Healthcare Foundation"				7.3.1 Search vendor "Oracle" for product "Healthcare Foundation" and version "7.3.1"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Foundation Search vendor "Oracle" for product "Healthcare Foundation"				8.0.1 Search vendor "Oracle" for product "Healthcare Foundation" and version "8.0.1"		-		Affected
Oracle Search vendor "Oracle"		Hospitality Opera 5 Search vendor "Oracle" for product "Hospitality Opera 5"				5.5 Search vendor "Oracle" for product "Hospitality Opera 5" and version "5.5"		-		Affected
Oracle Search vendor "Oracle"		Hospitality Opera 5 Search vendor "Oracle" for product "Hospitality Opera 5"				5.6 Search vendor "Oracle" for product "Hospitality Opera 5" and version "5.6"		-		Affected
Oracle Search vendor "Oracle"		Hospitality Reporting And Analytics Search vendor "Oracle" for product "Hospitality Reporting And Analytics"				9.1.0 Search vendor "Oracle" for product "Hospitality Reporting And Analytics" and version "9.1.0"		-		Affected
Oracle Search vendor "Oracle"		Insurance Data Gateway Search vendor "Oracle" for product "Insurance Data Gateway"				1.0.2.3 Search vendor "Oracle" for product "Insurance Data Gateway" and version "1.0.2.3"		-		Affected
Oracle Search vendor "Oracle"		Jd Edwards Enterpriseone Orchestrator Search vendor "Oracle" for product "Jd Edwards Enterpriseone Orchestrator"				< 9.2.5.3 Search vendor "Oracle" for product "Jd Edwards Enterpriseone Orchestrator" and version " < 9.2.5.3"		-		Affected
Oracle Search vendor "Oracle"		Jd Edwards Enterpriseone Orchestrator Search vendor "Oracle" for product "Jd Edwards Enterpriseone Orchestrator"				9.2.5.3 Search vendor "Oracle" for product "Jd Edwards Enterpriseone Orchestrator" and version "9.2.5.3"		-		Affected
Oracle Search vendor "Oracle"		Jd Edwards Enterpriseone Tools Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools"				< 9.2.5.3 Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" and version " < 9.2.5.3"		-		Affected
Oracle Search vendor "Oracle"		Jd Edwards Enterpriseone Tools Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools"				9.2.5.3 Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" and version "9.2.5.3"		-		Affected
Oracle Search vendor "Oracle"		Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"				8.56 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.56"		-		Affected
Oracle Search vendor "Oracle"		Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"				8.57 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.57"		-		Affected
Oracle Search vendor "Oracle"		Peoplesoft Enterprise Pt Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Pt Peopletools"				8.56 Search vendor "Oracle" for product "Peoplesoft Enterprise Pt Peopletools" and version "8.56"		-		Affected
Oracle Search vendor "Oracle"		Peoplesoft Enterprise Pt Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Pt Peopletools"				8.57 Search vendor "Oracle" for product "Peoplesoft Enterprise Pt Peopletools" and version "8.57"		-		Affected
Oracle Search vendor "Oracle"		Peoplesoft Enterprise Pt Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Pt Peopletools"				8.58 Search vendor "Oracle" for product "Peoplesoft Enterprise Pt Peopletools" and version "8.58"		-		Affected
Oracle Search vendor "Oracle"		Primavera Gateway Search vendor "Oracle" for product "Primavera Gateway"				>= 16.2.0 <= 16.2.11 Search vendor "Oracle" for product "Primavera Gateway" and version " >= 16.2.0 <= 16.2.11"		-		Affected
Oracle Search vendor "Oracle"		Primavera Gateway Search vendor "Oracle" for product "Primavera Gateway"				>= 17.12.0 <= 17.12.6 Search vendor "Oracle" for product "Primavera Gateway" and version " >= 17.12.0 <= 17.12.6"		-		Affected
Oracle Search vendor "Oracle"		Real-time Decisions Solutions Search vendor "Oracle" for product "Real-time Decisions Solutions"				3.2.0.0 Search vendor "Oracle" for product "Real-time Decisions Solutions" and version "3.2.0.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Advanced Inventory Planning Search vendor "Oracle" for product "Retail Advanced Inventory Planning"				14.1 Search vendor "Oracle" for product "Retail Advanced Inventory Planning" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Back Office Search vendor "Oracle" for product "Retail Back Office"				14.1 Search vendor "Oracle" for product "Retail Back Office" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Central Office Search vendor "Oracle" for product "Retail Central Office"				14.1 Search vendor "Oracle" for product "Retail Central Office" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Invoice Matching Search vendor "Oracle" for product "Retail Invoice Matching"				16.0.3 Search vendor "Oracle" for product "Retail Invoice Matching" and version "16.0.3"		-		Affected
Oracle Search vendor "Oracle"		Retail Merchandising System Search vendor "Oracle" for product "Retail Merchandising System"				5.0.3.1 Search vendor "Oracle" for product "Retail Merchandising System" and version "5.0.3.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Point-of-service Search vendor "Oracle" for product "Retail Point-of-service"				14.1 Search vendor "Oracle" for product "Retail Point-of-service" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Predictive Application Server Search vendor "Oracle" for product "Retail Predictive Application Server"				16.0 Search vendor "Oracle" for product "Retail Predictive Application Server" and version "16.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Price Management Search vendor "Oracle" for product "Retail Price Management"				14.0 Search vendor "Oracle" for product "Retail Price Management" and version "14.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Price Management Search vendor "Oracle" for product "Retail Price Management"				14.0.1 Search vendor "Oracle" for product "Retail Price Management" and version "14.0.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Price Management Search vendor "Oracle" for product "Retail Price Management"				15.0 Search vendor "Oracle" for product "Retail Price Management" and version "15.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Price Management Search vendor "Oracle" for product "Retail Price Management"				16.0 Search vendor "Oracle" for product "Retail Price Management" and version "16.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Returns Management Search vendor "Oracle" for product "Retail Returns Management"				14.1 Search vendor "Oracle" for product "Retail Returns Management" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service"				7.1 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "7.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service"				15.0 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "15.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service"				16.0 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "16.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service"				17.0 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "17.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service"				18.0 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "18.0"		-		Affected
Oracle Search vendor "Oracle"		Service Bus Search vendor "Oracle" for product "Service Bus"				11.1.1.9.0 Search vendor "Oracle" for product "Service Bus" and version "11.1.1.9.0"		-		Affected
Oracle Search vendor "Oracle"		Service Bus Search vendor "Oracle" for product "Service Bus"				12.2.1.3.0 Search vendor "Oracle" for product "Service Bus" and version "12.2.1.3.0"		-		Affected
Oracle Search vendor "Oracle"		Service Bus Search vendor "Oracle" for product "Service Bus"				12.2.1.4.0 Search vendor "Oracle" for product "Service Bus" and version "12.2.1.4.0"		-		Affected
Oracle Search vendor "Oracle"		Solaris Cluster Search vendor "Oracle" for product "Solaris Cluster"				4.4 Search vendor "Oracle" for product "Solaris Cluster" and version "4.4"		-		Affected
Oracle Search vendor "Oracle"		Time And Labor Search vendor "Oracle" for product "Time And Labor"				>= 12.2.6 <= 12.2.11 Search vendor "Oracle" for product "Time And Labor" and version " >= 12.2.6 <= 12.2.11"		-		Affected
Oracle Search vendor "Oracle"		Utilities Framework Search vendor "Oracle" for product "Utilities Framework"				>= 4.3.0.1.0 <= 4.3.0.6.0 Search vendor "Oracle" for product "Utilities Framework" and version " >= 4.3.0.1.0 <= 4.3.0.6.0"		-		Affected
Oracle Search vendor "Oracle"		Utilities Framework Search vendor "Oracle" for product "Utilities Framework"				4.2.0.2.0 Search vendor "Oracle" for product "Utilities Framework" and version "4.2.0.2.0"		-		Affected
Oracle Search vendor "Oracle"		Utilities Framework Search vendor "Oracle" for product "Utilities Framework"				4.2.0.3.0 Search vendor "Oracle" for product "Utilities Framework" and version "4.2.0.3.0"		-		Affected
Oracle Search vendor "Oracle"		Utilities Framework Search vendor "Oracle" for product "Utilities Framework"				4.4.0.0.0 Search vendor "Oracle" for product "Utilities Framework" and version "4.4.0.0.0"		-		Affected
Oracle Search vendor "Oracle"		Utilities Framework Search vendor "Oracle" for product "Utilities Framework"				4.4.0.2.0 Search vendor "Oracle" for product "Utilities Framework" and version "4.4.0.2.0"		-		Affected
Oracle Search vendor "Oracle"		Utilities Framework Search vendor "Oracle" for product "Utilities Framework"				4.4.0.3.0 Search vendor "Oracle" for product "Utilities Framework" and version "4.4.0.3.0"		-		Affected
Oracle Search vendor "Oracle"		Weblogic Server Search vendor "Oracle" for product "Weblogic Server"				10.3.6.0.0 Search vendor "Oracle" for product "Weblogic Server" and version "10.3.6.0.0"		-		Affected