Search: 17.9-6

CVE-2026-101449 is a low-severity vulnerability in Oracle Siebel CRM Deployment (Siebel Management Console component) affecting versions 17.0 through 26.9. It allows an attacker with physical access to the system to gain unauthorized read access to some data within the Siebel CRM Deployment. The vulnerability has a CVSS 3.1 base score of 2.4, indicating limited confidentiality impact without integrity or availability effects. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for multiple products including Siebel CRM. Users are strongly advised to apply the available patches promptly to mitigate this issue.

CVE-2026-101448 is a vulnerability in Oracle Siebel CRM Deployment's Siebel Management Console component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some accessible data within the Siebel CRM Deployment. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches addressing this and other vulnerabilities.

CVE-2026-101446 is a critical vulnerability in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) affecting versions 17.0 through 26.9. It allows a low privileged attacker with network access via HTTP to compromise the application, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 9.9. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.

CVE-2026-101408 is a vulnerability in Oracle Siebel CRM's Siebel Apps - Marketing component (Email Marketing) affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. Successful exploitation requires human interaction from a user other than the attacker and may impact additional products beyond Siebel Apps - Marketing. The CVSS 3.1 base score is 6.1, indicating a medium severity with confidentiality and integrity impacts.

CVE-2026-101406 is a vulnerability in Oracle Siebel Apps - Marketing versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some accessible data within the product. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.7, reflecting limited confidentiality impact and no impact on integrity or availability.

CVE-2026-101405 is a vulnerability in Oracle Siebel Apps - Marketing versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTPS to perform unauthorized read and write operations on some accessible data within the application. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.8, reflecting limited confidentiality and integrity impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating that patches are available.

CVE-2026-101404 is a vulnerability in Oracle Siebel CRM's Marketing component affecting versions 17.0 through 26.9. It requires a high privileged attacker with logon access to the infrastructure where the product runs. Exploitation could lead to unauthorized read, update, insert, or delete access to some accessible data and partial denial of service. The vulnerability is rated low severity with a CVSS 3.1 base score of 3.9.

CVE-2026-101403 is a vulnerability in Oracle Siebel CRM's Email Marketing component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product, requiring user interaction from a third party. Successful exploitation can lead to unauthorized access to critical data and limited unauthorized modification of some data. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity.

A vulnerability in Oracle Siebel CRM's Siebel Apps - Marketing component (Email Marketing) affects versions 17.0 through 26.9. This vulnerability allows an unauthenticated attacker with network access via HTTP to cause a partial denial of service. The vulnerability is rated with a low severity CVSS score of 3.7, primarily impacting availability. Oracle has published a Critical Patch Update advisory addressing multiple vulnerabilities, including this one, and strongly recommends applying patches promptly.

CVE-2026-101401 is a vulnerability in Oracle Siebel CRM's Marketing component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with logon access to the infrastructure where the application runs to cause a partial denial of service. The vulnerability is rated low severity with a CVSS 3.1 base score of 2.9, impacting availability only. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.

CVE-2026-101400 is a vulnerability in Oracle Siebel CRM's Marketing component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with logon access to the infrastructure where the product runs to cause a partial denial of service. The vulnerability is difficult to exploit and impacts availability with no confidentiality or integrity impact. The CVSS 3.1 base score is 2.9, indicating low severity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.

CVE-2026-101399 is a vulnerability in Oracle Siebel CRM's Marketing component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via SMTP to cause a partial denial of service (DoS) on the Siebel Apps - Marketing product. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with impact limited to availability.

A vulnerability in Oracle Siebel CRM's Marketing component (versions 17.0 through 26.9) allows a high privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data. The vulnerability is difficult to exploit and has a low impact on confidentiality with no impact on integrity or availability. The CVSS 3.1 base score is 2.2. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.

CVE-2026-101396 is a vulnerability in Oracle Siebel Apps - Marketing versions 17.0 through 26.9. It allows a low privileged attacker with logon access to the infrastructure where the application runs to compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data within Siebel Apps - Marketing. The vulnerability has a CVSS 3.1 base score of 4.7, indicating a medium severity with integrity impact but no confidentiality or availability impact.

CVE-2026-101395 is a vulnerability in Oracle Siebel CRM's Siebel Apps - Marketing component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. Successful exploitation requires user interaction from a person other than the attacker and may impact additional products beyond Siebel Apps - Marketing. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts.

CVE-2026-101394 is a vulnerability in Oracle Siebel CRM's Marketing component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible marketing data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on integrity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.

CVE-2026-101393 is a vulnerability in Oracle Siebel Apps - Marketing versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to potentially perform unauthorized update, insert, or delete operations on accessible data. Exploitation requires human interaction from a user other than the attacker. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity primarily impacting data integrity.

CVE-2026-101392 is a vulnerability in Oracle Siebel Apps - Marketing versions 17.0 through 26.9. It allows a low privileged attacker with logon access to the infrastructure where the application runs to compromise the application, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.

CVE-2026-101391 is a vulnerability in Oracle Siebel CRM's Siebel Apps - Marketing component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. Successful exploitation requires user interaction from someone other than the attacker and may impact additional products beyond Siebel Apps - Marketing. The CVSS 3.1 base score is 6.1, indicating a medium severity vulnerability with confidentiality and integrity impacts.

ApostropheCMS versions prior to 4.33.0 and sanitize-html versions from 2.17.7 up to but not including 2.18.0 contain a cross-site scripting (XSS) vulnerability. This occurs due to a bypass in the SMIL URL protection when namespace-prefixed SVG animation elements and certain URL-targeting attributes are allowed, enabling unsafe URI rewriting and script execution upon user interaction. The default sanitizer configuration is not universally affected. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.