CVE-2016-3438

Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that that this issue involves multiple cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web script or HTML via three unspecified parameters in an unknown JSP file.

• http://onapsis.com/research/security-advisories/oracle-e-business-suite-cross-site-scripting-xss-cve-2016-3438
• http://packetstormsecurity.com/files/138564/Oracle-E-Business-Suite-12.2-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2016/Aug/136
• http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlVendor Advisory
• http://www.securitytracker.com/id/1035591
• http://onapsis.com/research/security-advisories/oracle-e-business-suite-cross-site-scripting-xss-cve-2016-3438
• http://packetstormsecurity.com/files/138564/Oracle-E-Business-Suite-12.2-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2016/Aug/136
• http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlVendor Advisory
• http://www.securitytracker.com/id/1035591

Published

Apr 21, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3432Unspecified vulnerability in the BI Publisher (formerly XML …
• CVE-2016-3433Unspecified vulnerability in the Oracle Business Intelligenc…
• CVE-2016-3434Unspecified vulnerability in the Oracle Application Object L…
• CVE-2016-3435Unspecified vulnerability in the PeopleSoft Enterprise Peopl…
• CVE-2016-3436Unspecified vulnerability in the Oracle Common Applications …
• CVE-2016-3437Unspecified vulnerability in the Oracle CRM Wireless compone…
• CVE-2016-3439Unspecified vulnerability in the Oracle CRM Wireless compone…
• CVE-2016-3440Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier…
• CVE-2016-3441Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 …7.8
• CVE-2016-3442Unspecified vulnerability in the PeopleSoft Enterprise Peopl…
• CVE-2016-3443Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and…
• CVE-2016-3444Unspecified vulnerability in the Oracle Retail Integration B…