Unauthenticated/Unauthorized Access - 15326 CVEs (Page 90/128)

About “Unauthenticated/Unauthorized Access”

A curated feed of “Unauthenticated/Unauthorized Access”-related CVEs appears below. We currently track 15326 CVEs for this tag (all time). In the last 365 days, 3832 were published. Average CVSS is 7.4 (all time; 7.4 over 365d), and 61% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-862 - Missing Authorization, CWE-306 - Missing Authentication for Critical Function, CWE-639 - Authorization Bypass Through User-Controlled Key.

In our taxonomy this topic maps to a HIGH impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2020-08-13

High

CVE-2020-8707

Buffer overflow in daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via a…

CVSS: 8.8 CWE: CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') View on NVD

High

CVE-2020-8706

Buffer overflow in a daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via…

CVSS: 8.8 CWE: CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') View on NVD

Medium

CVE-2019-14630

Reliance on untrusted inputs in a security decision in some Intel(R) Thunderbolt(TM) controllers may allow unauthenticated user to potentially enable information disclosure via physical access.

CVSS: 4.6 CWE: N/A View on NVD

2020-08-12

Low

CVE-2020-6653

Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A malicious app or unauthorized user can…

CVSS: 3.8 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

High

CVE-2020-6301

SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settle trips, resulting in escalation of priv…

CVSS: 8.1 CWE: CWE-862 - Missing Authorization View on NVD

High

CVE-2020-6298

SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Generic Market Data (GMD) and change related GMD key figure val…

CVSS: 8.1 CWE: CWE-862 - Missing Authorization View on NVD

Medium

CVE-2020-6293

SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files bu…

CVSS: 6.5 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type View on NVD

2020-08-11

Medium

CVE-2020-13176

The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stor…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Critical

CVE-2020-17466

Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redirect responses.

CVSS: 9.8 CWE: CWE-670 - Always-Incorrect Control Flow Implementation View on NVD

Critical

CVE-2020-11552

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vul…

CVSS: 9.8 CWE: CWE-269 - Improper Privilege Management View on NVD

2020-08-10

High

CVE-2020-16277

An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.

CVSS: 8.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

High

CVE-2020-16276

An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.

CVSS: 8.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

High

CVE-2020-12777

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.

CVSS: 7.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

2020-08-07

High

CVE-2020-15063

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.

CVSS: 8.8 CWE: CWE-287 - Improper Authentication View on NVD

High

CVE-2020-15059

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.

CVSS: 8.8 CWE: CWE-287 - Improper Authentication View on NVD

High

CVE-2020-15055

TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.

CVSS: 8.8 CWE: CWE-287 - Improper Authentication View on NVD

High

CVE-2019-7005

A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gain sensitive information. Affected versio…

CVSS: 7.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Critical

CVE-2020-16169

Authentication Bypass Using an Alternate Path or Channel in temi Robox OS prior to120, temi Android app up to 1.3.7931 allows remote attackers to gain elevated privileges on the temi and have it auto…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2020-08-05

Critical

CVE-2020-5609

Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.0…

CVSS: 9.8 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

Critical

CVE-2020-5608

CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.0…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2020-08-04

Critical

CVE-2020-5616

[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News0…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2020-07-31

High

CVE-2020-5384

Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker could potentially exploit this vulnerabil…

CVSS: 8.4 CWE: CWE-288 - Authentication Bypass Using an Alternate Path or Channel View on NVD

Critical

CVE-2020-3382

A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative…

CVSS: 9.8 CWE: CWE-798 - Use of Hard-coded Credentials View on NVD

High

CVE-2020-3376

A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions on…

CVSS: 7.3 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

2020-07-29

High

CVE-2020-2077

SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by…

CVSS: 7.5 CWE: CWE-276 - Incorrect Default Permissions View on NVD

Critical

CVE-2020-2076

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, b…

CVSS: 9.8 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

2020-07-28

High

CVE-2020-13997

In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.

CVSS: 7.5 CWE: CWE-209 - Generation of Error Message Containing Sensitive Information View on NVD

Medium

CVE-2020-13971

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be…

CVSS: 5.4 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

High

CVE-2020-15416

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vuln…

CVSS: 8.8 CWE: CWE-121 - Stack-based Buffer Overflow View on NVD

High

CVE-2020-10924

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this…

CVSS: 8.8 CWE: CWE-121 - Stack-based Buffer Overflow View on NVD

High

CVE-2020-10923

CVSS: 8.8 CWE: CWE-305 - Authentication Bypass by Primary Weakness View on NVD

Critical

CVE-2020-16088

iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches.

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2020-07-27

High

CVE-2020-12845

Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resour…

CVSS: 7.5 CWE: CWE-476 - NULL Pointer Dereference View on NVD

2020-07-25

High

CVE-2020-10604

In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connecti…

CVSS: 7.5 CWE: CWE-248 - Uncaught Exception View on NVD

2020-07-23

High

CVE-2020-15633

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is n…

CVSS: 8.8 CWE: CWE-288 - Authentication Bypass Using an Alternate Path or Channel View on NVD

High

CVE-2020-15632

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability…

CVSS: 8.8 CWE: CWE-303 - Incorrect Implementation of Authentication Algorithm View on NVD

Critical

CVE-2020-15492

An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem acc…

CVSS: 9.8 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

High

CVE-2020-10918

This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit th…

CVSS: 7.5 CWE: CWE-287 - Improper Authentication View on NVD

High

CVE-2020-15688

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via c…

CVSS: 8.8 CWE: CWE-294 - Authentication Bypass by Capture-replay View on NVD

2020-07-22

High

CVE-2020-15896

An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and…

CVSS: 7.5 CWE: CWE-287 - Improper Authentication View on NVD

2020-07-20

Critical

CVE-2020-12029

All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoi…

CVSS: 9.0 CWE: CWE-20 - Improper Input Validation View on NVD

2020-07-18

Medium

CVE-2020-9101

There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to ins…

CVSS: 6.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

2020-07-16

High

CVE-2020-13405

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.

CVSS: 7.5 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

Critical

CVE-2020-3144

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router could…

CVSS: 9.8 CWE: CWE-284 - Improper Access Control View on NVD

Critical

CVE-2020-3140

A vulnerability in the web management interface of Cisco Prime License Manager (PLM) Software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vu…

CVSS: 9.8 CWE: CWE-255 View on NVD

Critical

CVE-2020-15027

ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This was patched in 2020.7 and in a hotfix fo…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2020-07-15

High

CVE-2020-2984

Vulnerability in the Oracle Configuration Manager product of Oracle Enterprise Manager (component: Discovery and collection script). The supported version that is affected is 12.1.2.0.6. Easily explo…

CVSS: 7.1 CWE: N/A View on NVD

High

CVE-2020-2983

Vulnerability in the Oracle Data Masking and Subsetting product of Oracle Enterprise Manager (component: Data Masking). Supported versions that are affected are 13.3.0.0 and 13.4.0.0. Easily exploita…

CVSS: 7.1 CWE: N/A View on NVD

High

CVE-2020-2982

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.3.0.0 and 13.4.0.0. E…

CVSS: 7.1 CWE: N/A View on NVD

High

CVE-2020-2981

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 18.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with lo…

CVSS: 7.0 CWE: N/A View on NVD

High

CVE-2020-2967

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and…

CVSS: 7.5 CWE: N/A View on NVD

Medium

CVE-2020-2966

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easil…

CVSS: 5.4 CWE: N/A View on NVD

Medium

CVE-2020-2562

Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Investor Module). Supported versions that are affected are 16.1.0.0-16.1.5.1, 18.0.0.0-1…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

High

CVE-2020-14723

Vulnerability in the Oracle Help Technologies product of Oracle Fusion Middleware (component: Web UIX). Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Easily exploitable vulnerab…

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2020-14722

Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are affected are 3.0.0-3.2.0. Difficult to expl…

CVSS: 5.8 CWE: N/A View on NVD

High

CVE-2020-14720

Vulnerability in the Oracle Internet Expenses product of Oracle E-Business Suite (component: Mobile Expenses Admin Utilities). Supported versions that are affected are 12.2.4-12.2.9. Easily exploitab…

CVSS: 7.7 CWE: N/A View on NVD

Medium

CVE-2020-14717

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easil…

CVSS: 4.7 CWE: N/A View on NVD

Medium

CVE-2020-14716

CVSS: 4.7 CWE: N/A View on NVD

Medium

CVE-2020-14706

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 17.1.0.0-17.…

CVSS: 5.9 CWE: N/A View on NVD

Critical

CVE-2020-14705

Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Process Management). The supported version that is affected is Prior to 19.1.0.0.0. Easily exploitable vulnerability al…

CVSS: 9.6 CWE: N/A View on NVD

Medium

CVE-2020-14704

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exp…

CVSS: 6.0 CWE: CWE-908 - Use of Uninitialized Resource View on NVD

Medium

CVE-2020-14703

CVSS: 6.0 CWE: CWE-908 - Use of Uninitialized Resource View on NVD

Critical

CVE-2020-14701

Vulnerability in the Oracle SD-WAN Aware product of Oracle Communications Applications (component: User Interface). The supported version that is affected is 8.2. Easily exploitable vulnerability all…

CVSS: 10.0 CWE: N/A View on NVD

Medium

CVE-2020-14700

CVSS: 5.3 CWE: CWE-125 - Out-of-bounds Read View on NVD

Medium

CVE-2020-14698

CVSS: 5.3 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2020-14696

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Layout Templates). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily expl…

CVSS: 7.2 CWE: N/A View on NVD

Medium

CVE-2020-14695

CVSS: 5.3 CWE: CWE-125 - Out-of-bounds Read View on NVD

Medium

CVE-2020-14694

CVSS: 5.3 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2020-14690

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14688

CVSS: 8.2 CWE: N/A View on NVD

Critical

CVE-2020-14687

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable v…

CVSS: 9.8 CWE: N/A View on NVD

High

CVE-2020-14686

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability…

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2020-14684

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affect…

CVSS: 4.3 CWE: N/A View on NVD

High

CVE-2020-14682

Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulner…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14681

Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: DBI Setups). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerabilit…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14679

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable…

CVSS: 7.5 CWE: N/A View on NVD

Medium

CVE-2020-14673

CVSS: 5.3 CWE: N/A View on NVD

High

CVE-2020-14671

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vuln…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14670

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Settings). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily expl…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14669

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauth…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14668

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14667

CVSS: 7.6 CWE: N/A View on NVD

High

CVE-2020-14666

Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable…

CVSS: 8.2 CWE: N/A View on NVD

Critical

CVE-2020-14665

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Invoice). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vuln…

CVSS: 9.1 CWE: N/A View on NVD

High

CVE-2020-14664

Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u251. Difficult to exploit vulnerability allows unauthenticated attacke…

CVSS: 8.3 CWE: N/A View on NVD

Medium

CVE-2020-14661

CVSS: 4.7 CWE: N/A View on NVD

High

CVE-2020-14660

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2020-14659

CVSS: 4.7 CWE: N/A View on NVD

Critical

CVE-2020-14658

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploi…

CVSS: 9.1 CWE: N/A View on NVD

High

CVE-2020-14657

CVSS: 7.6 CWE: N/A View on NVD

Medium

CVE-2020-14655

Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: SSL API). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Difficult to exp…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14652

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14650

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2020-14648

CVSS: 5.3 CWE: N/A View on NVD

Critical

CVE-2020-14645

CVSS: 9.8 CWE: N/A View on NVD

Critical

CVE-2020-14644

CVSS: 9.8 CWE: N/A View on NVD

High

CVE-2020-14642

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: CacheStore). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.…

CVSS: 7.5 CWE: CWE-404 - Improper Resource Shutdown or Release View on NVD

Medium

CVE-2020-14641

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high…

CVSS: 4.9 CWE: N/A View on NVD

Medium

CVE-2020-14640

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. E…

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2020-14639

CVSS: 7.5 CWE: N/A View on NVD

Medium

CVE-2020-14638

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2020-14637

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2020-14636

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2020-14635

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Logging). Supported versions that are affected are 12.2.5-12.2.9. Easily exploitable vulnerabilit…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2020-14629

CVSS: 6.0 CWE: N/A View on NVD

Medium

CVE-2020-14627

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability…

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2020-14626

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1…

CVSS: 8.1 CWE: N/A View on NVD

Critical

CVE-2020-14625

CVSS: 9.8 CWE: N/A View on NVD

Medium

CVE-2020-14622

CVSS: 4.9 CWE: N/A View on NVD

Medium

CVE-2020-14621

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2020-14618

Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Mobile App). The supported version that is affected is Prior to 20.6. Difficult to exploit vulnerabil…

CVSS: 5.9 CWE: N/A View on NVD

Medium

CVE-2020-14617

Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform, Mobile App). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8 and 19.1…

CVSS: 5.7 CWE: N/A View on NVD

Medium

CVE-2020-14615

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Medium

CVE-2020-14613

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced User Interface). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploi…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

High

CVE-2020-14611

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerab…

CVSS: 8.6 CWE: N/A View on NVD

High

CVE-2020-14610

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). The supported version that is affected is 12.2.9. Easily exploitable vuln…

CVSS: 7.6 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

High

CVE-2020-14609

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Answers). Supported versions that are affected are 5.5.0.0.0, 11.1.1…

CVSS: 8.6 CWE: N/A View on NVD

High

CVE-2020-14608

Vulnerability in the Oracle Fusion Middleware MapViewer product of Oracle Fusion Middleware (component: Tile Server). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerab…

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2020-14607

Vulnerability in the Oracle Fusion Middleware MapViewer product of Oracle Fusion Middleware (component: Tile Server). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploi…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Critical

CVE-2020-14606

Vulnerability in the Oracle SD-WAN Edge product of Oracle Communications Applications (component: User Interface). Supported versions that are affected are 8.2 and 9.0. Easily exploitable vulnerabili…

CVSS: 10.0 CWE: N/A View on NVD