Oracle Agile Product Lifecycle Management vulnerabilities

CVE-2024-20953 [HIGH] CWE-502 CVE-2024-20953: Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supp Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3

CVE-2024-21287 [HIGH] CWE-863 CVE-2024-21287: Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulne

CVE-2019-0227 [HIGH] CWE-918 CVE-2019-0227: A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that wa A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to t

CVE-2025-21556 [CRITICAL] CWE-863 CVE-2025-21556: Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Int Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. While the vulnerability is in Oracle Agile PL

CVE-2016-3556 [CRITICAL] CVE-2016-3556: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to EM Integration.

CVE-2016-3554 [HIGH] CVE-2016-3554: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to PC / BOM, MCAD, and Design.

CVE-2016-5523 [HIGH] CVE-2016-5523: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to AutoVue Java Applet.

CVE-2016-5515 [HIGH] CVE-2016-5515: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RMIServlet.

CVE-2016-5514 [HIGH] CVE-2016-5514: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to ExportServlet.

CVE-2018-11040 [HIGH] CWE-829 CVE-2018-11040: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported vers Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framewor

CVE-2025-21564 [HIGH] CWE-732 CVE-2025-21564: Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Int Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can resu

CVE-2025-21565 [HIGH] CWE-863 CVE-2025-21565: Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized

CVE-2016-3526 [HIGH] CVE-2016-3526: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality via vectors related to SDK, a different vulnerability than CVE-2016-3529 and CVE-2016-3560.

CVE-2016-3561 [HIGH] CVE-2016-3561: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SDK.

CVE-2016-5526 [HIGH] CWE-284 CVE-2016-5526: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Apache Tomcat.

CVE-2025-21560 [MEDIUM] CWE-863 CVE-2025-21560: Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Softw Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can

CVE-2016-3538 [HIGH] CVE-2016-3538: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and availability via vectors related to File Folders / Attachment, a different vulnerability than CVE-2016-3539.

CVE-2016-3539 [HIGH] CVE-2016-3539: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and availability via vectors related to File Folders / Attachment, a different vulnerability than CVE-2016-3538.

CVE-2016-3530 [HIGH] CVE-2016-3530: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect integrity and availability via vectors related to PGC / Import.

CVE-2018-1257 [MEDIUM] CVE-2018-1257: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupport Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of