Read the docs
TI-2016-00569 Aliases CVE-2016-0635GHSA-7gph-3vpp-prg4

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle…

Priority MEDIUM 48Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Master Person Index component in Oracle Health Sciences Applications 2.0.12, 3.0.0, and 4.0.1; the Oracle Documaker component in Oracle Insurance Applications before 12.5; the Oracle Insurance Calculation Engine component in Oracle Insurance Applications 9.7.1, 10.1.2, and 10.2.2; the Oracle Insurance Policy Administration J2EE and Oracle Insurance Rules Palette components in Oracle Insurance Applications 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, and 10.2.2; the Oracle Retail Integration Bus component in Oracle Retail Applications 15.0; the Oracle Retail Order Broker component in Oracle Retail Applications 5.1, 5.2, and 15.0; the Primavera Contract Management component in Oracle Primavera Products Suite 14.2; the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.2, 8.3, 8.4, 15.1, 15.2, and 16.1; the Oracle Financial Services Analytical Applications Infrastructure component in Oracle Financial Services Applications 8.0.0, 8.0.1, 8.0.2, and 8.0.3; the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce 3.1.1, 3.1.2, 11.0, 11.1, and 11.2; the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5; the Oracle Communications BRM - Elastic Charging Engine 11.2.0.0.0 and 11.3.0.0.0; the Oracle Enterprise Repository Enterprise Repository 12.1.3.0.0; the Oracle Financial Services Behavior Detection Platform 8.0.1 and 8.0.2; the Oracle Hyperion Essbase 12.2.1.1; the Oracle Tuxedo System and Applications Monitor (TSAM) 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.1, 12.1.1.1.0, 12.1.3.0.0, and 12.2.2.0.0; the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Spring)) 7.0, 7.1 and 7.2; the Oracle Endeca Information Discovery Integrator 3.2; the Converged Commerce component of Oracle Retail Applications 16.0.1; the Oracle Identity Manager 11.1.2.3.0; Oracle Enterprise Manager for MySQL Database 12.1.0.4; Oracle Retail Invoice Matching 12.0, 13.0, 13.1, 13.2, 14.0, and 14.1; Oracle Communications Performance Intelligence Center (PIC) Software Prior to 10.2.1 and the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: AnswerFlow (Spring Framework)) version 8.5.1.0 - 8.5.1.7 and 8.6.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05077 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*up to 12.5VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4:*:*:*:*:*:*:*12.1.4VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*12.2.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:*12.3.2VulnerableOracle
cpe:2.3:a:oracle:health_sciences_information_manager:1.2.8.3:*:*:*:*:*:*:*1.2.8.3VulnerableOracle
cpe:2.3:a:oracle:health_sciences_information_manager:2.0.2.3:*:*:*:*:*:*:*2.0.2.3VulnerableOracle
cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1.0:*:*:*:*:*:*:*3.0.1.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_master_person_index:2.0.12:*:*:*:*:*:*:*2.0.12VulnerableOracle
cpe:2.3:a:oracle:healthcare_master_person_index:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_master_person_index:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableOracle
  • cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:* Versions up to 12.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4:*:*:*:*:*:*:* Versions 12.1.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* Versions 12.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:* Versions 12.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_information_manager:1.2.8.3:*:*:*:*:*:*:* Versions 1.2.8.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_information_manager:2.0.2.3:*:*:*:*:*:*:* Versions 2.0.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1.0:*:*:*:*:*:*:* Versions 3.0.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_master_person_index:2.0.12:*:*:*:*:*:*:* Versions 2.0.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_master_person_index:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_master_person_index:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Oracle
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:insurance_calculation_engine:9.7.1:*:*:*:*:*:*:*9.7.1VulnerableOracle
cpe:2.3:a:oracle:insurance_calculation_engine:10.1.2:*:*:*:*:*:*:*10.1.2VulnerableOracle
cpe:2.3:a:oracle:insurance_calculation_engine:10.2.2:*:*:*:*:*:*:*10.2.2VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:9.6.1:*:*:*:*:*:*:*9.6.1VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:9.7.1:*:*:*:*:*:*:*9.7.1VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.0.1:*:*:*:*:*:*:*10.0.1VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.1.2:*:*:*:*:*:*:*10.1.2VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0:*:*:*:*:*:*:*10.2.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.2:*:*:*:*:*:*:*10.2.2VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:9.6.1:*:*:*:*:*:*:*9.6.1VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:9.7.1:*:*:*:*:*:*:*9.7.1VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.0.1:*:*:*:*:*:*:*10.0.1VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.1.2:*:*:*:*:*:*:*10.1.2VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*10.2.0VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.2.2:*:*:*:*:*:*:*10.2.2VulnerableOracle
cpe:2.3:a:oracle:primavera_contract_management:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.2:*:*:*:*:*:*:*8.2VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.3:*:*:*:*:*:*:*8.3VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.4:*:*:*:*:*:*:*8.4VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:*15.1VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:*15.2VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:5.1:*:*:*:*:*:*:*5.1VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:5.2:*:*:*:*:*:*:*5.2VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker_cloud_service:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
  • cpe:2.3:a:oracle:insurance_calculation_engine:9.7.1:*:*:*:*:*:*:* Versions 9.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_calculation_engine:10.1.2:*:*:*:*:*:*:* Versions 10.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_calculation_engine:10.2.2:*:*:*:*:*:*:* Versions 10.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:9.6.1:*:*:*:*:*:*:* Versions 9.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:9.7.1:*:*:*:*:*:*:* Versions 9.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.1.2:*:*:*:*:*:*:* Versions 10.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0:*:*:*:*:*:*:* Versions 10.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.2:*:*:*:*:*:*:* Versions 10.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:9.6.1:*:*:*:*:*:*:* Versions 9.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:9.7.1:*:*:*:*:*:*:* Versions 9.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.1.2:*:*:*:*:*:*:* Versions 10.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:* Versions 10.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.2.2:*:*:*:*:*:*:* Versions 10.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_contract_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker_cloud_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-0635
  2. 2026-10-03 Alias added: GHSA-7gph-3vpp-prg4

References

Patch 1

Other 9

  • TI-2019-10436 initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler… CVSS 3.1CRITICAL 9.8
  • TI-2020-18508 FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between… CVSS 3.1HIGH 8.1
  • TI-2020-18013 FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between… CVSS 3.1HIGH 8.1
  • TI-2020-18012 FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between… CVSS 3.1HIGH 8.1
  • TI-2020-08586 dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by… CVSS 3.1CRITICAL 9.8
  • TI-2020-18504 FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between… CVSS 3.1HIGH 8.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences