Medium severity · published Oct 25, 2016
CVE-2016-5533
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.4, 15.x, and 16.x allows remote authenticated…
5.4
CVSS
0.9%
EPSS
No
On KEV
Description
Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.4, 15.x, and 16.x allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Primavera P6 Enterprise Project Portfolio Management · Oracle
8.4; 15.0; 15.1; 15.2; 16.0; 16.1; +1 more · source: NVD
Affected product
PP
Primavera P6 Enterprise Project Portfolio Management
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5533
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5533
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
www.securityfocus.com
http://www.securityfocus.com/bid/93676
More from Primavera P6 Enterprise Project Portfolio Management
10.0
CVE-2017-3324
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access)
9.9
CVE-2017-3503
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access (Apache Commons BeanUtils))
9.8
CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
9.8
CVE-2018-14718
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic…
9.8
CVE-2018-19362
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic…