Multiple vulnerabilities have been reported in Oracle E-Business Suite, which can be exploited by malicious users to manipulate certain data and by malicious people to disclose potentially sensitive information or manipulate certain data.

1) An error in the Oracle Application Object Library component can be exploited to disclose or manipulate certain data.

2) An error in the Oracle iStore component can be exploited to disclose or manipulate certain data.

3) An error in the Oracle HRMS (Self Service) component can be exploited to disclose certain information.

4) An error in the Oracle Agile Engineering Data Management component can be exploited to disclose certain information.

5) An error in the Oracle Application Object Library component can be exploited to manipulate certain data.

6) An error in the Oracle Transportation Management component can be exploited to disclose certain information.

7) An error in the E-Business Intelligence component can be exploited by authenticated users to manipulate certain data.

8) An error in the Oracle Workflow Cartridge component can be exploited by authenticated users to manipulate certain data.

The vulnerabilities are reported in the following products and versions:
* Oracle E-Business Suite Release 12, versions 12.0.4, 12.0.5, 12.0.6, 12.1.1, and 12.1.2
* Oracle E-Business Suite Release 11i, versions 11.5.10 and 11.5.10.2

Solution
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2010 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html

Deep Links
Links available to Secunia VIM customers