Oracle Webcenter Interaction vulnerabilities

8 CVEs affecting Oracle Webcenter Interaction, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-16959, published 2018-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-16957, published 2018-09-18. Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days. The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. Authentication to the Oracle WCI search service uses this hardcoded password…
CVE-2018-16956, published 2018-09-18. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be renamed to include characters…
CVE-2018-16959, published 2018-09-18. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecure default User Profile community configuration that allows anonymous users to…
CVE-2018-16954, published 2018-09-18. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The login function of the portal is vulnerable to insecure redirection (also called an open redirect). The in_hi_redirect…
CVE-2018-16958, published 2018-09-18. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NET_SessionID primary session cookie, when Internet Information Services (IIS) with ASP.NET is used, is not protected…
CVE-2018-16955, published 2018-09-18. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). The content of the in_hi_redirect parameter, when prefixed with the https://…
CVE-2018-16953, published 2018-09-18. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. The AjaxView::DisplayResponse() function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). User input from the name…
CVE-2018-16952, published 2018-09-18. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal…