Score
This Critical Patch Update contains 1 new security patch for Oracle Application Express. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-29203 | Oracle Application Express | General (TinyMCE) | HTTP | Yes | 4.7 | Network | Low | None | Required | Changed | Low | None | None | 23.2 |
This Critical Patch Update contains no new security patches for exploitable vulnerabilities but does include third party patches, noted below, for the following non-exploitable third party CVEs for Oracle Big Data Spatial and Graph. Please refer to previous Critical Patch Update Advisories if the last Critical Patch Update was not applied for Oracle Big Data Spatial and Graph. The English text form of this Risk Matrix can be found here.
This Critical Patch Update contains 2 new security patches , plus additional third party patches noted below, for Oracle Essbase. Neither of these vulnerabilities may be remotely exploitable without authentication, i.e., neither may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-37536 | Oracle Essbase | Essbase Web Platform (Apache Xerces-C++) | None | No | 6.7 | Local | Low | High | None | Un- changed | High | High | High | 21.5.6 | |
CVE-2024-26308 | Oracle Essbase | Essbase Web Platform (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 21.5.6 |
This Critical Patch Update contains 1 new security patch , plus additional third party patches noted below, for Oracle GoldenGate. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-48795 | Oracle GoldenGate | General (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 19.1.0.0.0-19.23.0.0.240716, 21.3-21.14 |
This Critical Patch Update contains no new security patches for exploitable vulnerabilities but does include third party patches, noted below, for the following non-exploitable third party CVEs for Oracle Graph Server and Client. Please refer to previous Critical Patch Update Advisories if the last Critical Patch Update was not applied for the Oracle Graph Server and Client. The English text form of this Risk Matrix can be found here.
This Critical Patch Update contains 1 new security patch , plus additional third party patches noted below, for Oracle NoSQL Database. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-48795 | Oracle NoSQL Database | Administration (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | Prior to 19.5.42, Prior to 20.3.40, Prior to 21.2.27, Prior to 22.3.46, Prior to 23.3.32 |
This Critical Patch Update contains 1 new security patch , plus additional third party patches noted below, for Oracle REST Data Services. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-4043 | Oracle REST Data Services | ORDS (Eclipse Parsson) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | Prior to 23.3.1 |
This Critical Patch Update contains 1 new security patch for Oracle TimesTen In-Memory Database. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-29025 | Oracle TimesTen In-Memory Database | TimesTen Install (Netty) | HTTP | No | 4.3 | Network | Low | Low | None | Un- changed | None | None | Low | 22.1.1.1.0-22.1.1.24.0 |
This Critical Patch Update contains 7 new security patches , plus additional third party patches noted below, for Oracle Commerce. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-22262 | Oracle Commerce Guided Search | Content Acquisition System, Workbench (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 11.3.2 | |
CVE-2024-22262 | Oracle Commerce Platform | Platform (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 11.3.0, 11.3.1, 11.3.2 | |
CVE-2023-24998 | Oracle Commerce Guided Search | Workbench (Apache Commons FileUpload) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 11.3.2 | |
CVE-2022-34169 | Oracle Commerce Guided Search | Workbench, Content Acquisition System, Platform Services (Apache Xalan-Java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 11.3.2 | |
CVE-2024-24549 | Oracle Commerce Guided Search | Workbench, Platform Services, Content Acquisition System (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 11.3.2 | |
CVE-2024-28752 | Oracle Commerce Platform | Endeca Integration (Apache CXF) | HTTP | Yes | 7.4 | Network | High | None | None | Un- changed | High | High | None | 11.3.0, 11.3.1, 11.3.2 | |
CVE-2024-29025 | Oracle Commerce Guided Search | Workbench (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 11.3.2 |
This Critical Patch Update contains 20 new security patches , plus additional third party patches noted below, for Oracle Communications Applications. 14 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2022-34381 | Oracle Communications Billing and Revenue Management | Platform (BSAFE Crypto-J) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0 | |
CVE-2024-22257 | Oracle Communications Unified Inventory Management | Security (Spring Security) | HTTP | Yes | 8.2 | Network | Low | None | None | Un- changed | High | Low | None | 7.4.1, 7.4.2 | |
CVE-2024-23807 | Oracle Communications ASAP | Security (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 7.4 | |
CVE-2024-23807 | Oracle Communications Billing and Revenue Management | Platform (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0 | |
CVE-2024-22262 | Oracle Communications BRM - Elastic Charging Engine | Orchestration (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 12.0.0.4-12.0.0.8, 15.0.0.0 | |
CVE-2023-44487 | Oracle Communications Converged Charging System | Installation (Nghttp2) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 2.0.0.0.0, 2.0.0.1.0 | |
CVE-2024-27316 | Oracle Communications Unified Assurance | Core (Apache HTTP Server) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 5.5.0-5.5.21, 6.0.0-6.0.4 | |
CVE-2021-37533 | Oracle Communications Billing and Revenue Management | JCA Adaptor (Apache Commons Net) | HTTP | Yes | 6.5 | Network | Low | None | Required | Un- changed | High | None | None | 12.0.0.4.0-12.0.0.8.0 | |
CVE-2023-46218 | Oracle Communications Converged Charging System | Installation (curl) | HTTP | Yes | 6.5 | Network | Low | None | None | Un- changed | Low | Low | None | 2.0.0.0.0, 2.0.0.1.0 | |
CVE-2023-5981 | Oracle Communications Converged Charging System | Installation (GnuTLS) | HTTP | Yes | 5.9 | Network | High | None | None | Un- changed | High | None | None | 2.0.0.0.0, 2.0.0.1.0 | |
CVE-2023-48795 | Oracle Communications Converged Charging System | Installation (libssh) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 2.0.0.0.0, 2.0.0.1.0 | |
CVE-2023-29081 | Oracle Communications ASAP | Installation (InstallShield) | None | No | 5.5 | Local | Low | Low | None | Un- changed | None | None | High | 7.4 | |
CVE-2024-0232 | Oracle Communications Convergent Charging Controller | Common fns (SQLite) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 6.0.1.0.0, 12.0.1.0.0-12.0.6.0.0, 15.0.0.0.0 | |
CVE-2024-0232 | Oracle Communications Network Charging and Control | Common fns (SQLite) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 6.0.1.0.0, 12.0.1.0.0-12.0.6.0.0, 15.0.0.0.0 | |
CVE-2021-29489 | Oracle Communications Unified Assurance | Core (Highcharts JS) | HTTP | No | 5.4 | Network | Low | Low | Required | Changed | Low | Low | None | 5.5.0-5.5.21, 6.0.0-6.0.4 | |
CVE-2024-29025 | Oracle Communications Converged Charging System | Installation (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 2.0.0.0.0, 2.0.0.1.0 | |
CVE-2020-13956 | Oracle Communications Service Catalog and Design | Platform (Apache HttpClient) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | Low | None | 7.4.0-7.4.2, 8.0.0 | |
CVE-2024-29025 | Oracle Communications Service Catalog and Design | Solution Designer Platform (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 8.0.0 | |
CVE-2023-35116 | Oracle Communications Pricing Design Center | REST Services Manager (jackson-databind) | None | No | 4.7 | Local | High | Low | None | Un- changed | None | None | High | 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0 | |
CVE-2024-29133 | Oracle Communications BRM - Elastic Charging Engine | Security (Apache Commons Configuration) | None | No | 4.4 | Local | Low | Low | None | Un- changed | None | Low | Low | 12.0.0.4-12.0.0.8, 15.0.0.0 |
This Critical Patch Update contains 95 new security patches , plus additional third party patches noted below, for Oracle Communications. 84 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-23897 | Oracle Communications Cloud Native Core Automated Test Suite | Automated Test Suite Framework (Jenkins) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.1.0 | |
CVE-2023-37920 | Oracle Communications Cloud Native Core Binding Support Function | Install (Certifi) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.0-23.4.3 | |
CVE-2024-23897 | Oracle Communications Cloud Native Core Binding Support Function | Install (Jenkins) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.0-23.4.3 | |
CVE-2022-48174 | Oracle Communications Cloud Native Core Network Function Cloud Native Environment | OSO (BusyBox) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.0, 24.1.0 | |
CVE-2023-37920 | Oracle Communications Cloud Native Core Network Repository Function | Install (Certifi) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.2 | |
CVE-2024-23897 | Oracle Communications Cloud Native Core Network Repository Function | Install (Jenkins) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.2 | |
CVE-2023-37920 | Oracle Communications Cloud Native Core Policy | Alarms, KPI, and Measurements (Certifi) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.0-23.4.4 | |
CVE-2024-23897 | Oracle Communications Cloud Native Core Policy | Alarms, KPI, and Measurements (Jenkins) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.0-23.4.4 | |
CVE-2024-23897 | Oracle Communications Cloud Native Core Security Edge Protection Proxy | Automated Test Suite Framework (Jenkins) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.0 | |
CVE-2023-37920 | Oracle Communications Cloud Native Core Security Edge Protection Proxy | Configuration (Certifi) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.0 | |
CVE-2023-37920 | Oracle Communications Cloud Native Core Service Communication Proxy | Install (Certifi) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 23.4.0, 24.1.0 | |
CVE-2023-37920 | Oracle Communications Operations Monitor | Mediation Engine (Certifi) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 5.1, 5.2 | |
CVE-2024-2961 | Oracle Communications Cloud Native Core Unified Data Repository | Signaling (glibc) | HTTP | No | 8.8 | Network | Low | Low | None | Un- changed | High | High | High | 23.4.1 | |
CVE-2024-22257 | Oracle Communications Cloud Native Core Network Repository Function | Install (Spring Security) | HTTP | Yes | 8.2 | Network | Low | None | None | Un- changed | High | Low | None | 23.4.2 | |
CVE-2024-22262 | Oracle Communications Cloud Native Core Binding Support Function | Install (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 23.4.0-23.4.3 | |
CVE-2024-22262 | Oracle Communications Cloud Native Core Network Data Analytics Function | Automated Test Suite (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 24.2.0 | |
CVE-2024-22262 | Oracle Communications Cloud Native Core Network Exposure Function | Signaling (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 23.4.3 | |
CVE-2024-22262 | Oracle Communications Cloud Native Core Network Repository Function | Install (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 23.4.2 | |
CVE-2024-22262 | Oracle Communications Cloud Native Core Policy | Alarms, KPI, and Measurements (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 23.4.0-23.4.4 | |
CVE-2024-22262 | Oracle Communications Cloud Native Core Security Edge Protection Proxy | Signaling (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 23.4.0 | |
CVE-2024-22262 | Oracle Communications Cloud Native Core Service Communication Proxy | Install (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 23.4.2 | |
CVE-2024-23807 | Oracle Communications Diameter Signaling Router | Patches (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 8.6.0.4-8.6.0.8 | |
CVE-2024-22262 | Oracle Communications EAGLE Element Management System | Security (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 46.6.4, 46.6.5 | |
CVE-2024-23807 | Oracle Communications User Data Repository | Security (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 12.11.3, 12.11.4 | |
CVE-2023-52425 | Oracle Communications Cloud Native Core Automated Test Suite | Automated Test Suite Framework (LibExpat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0 | |
CVE-2023-51775 | Oracle Communications Cloud Native Core Automated Test Suite | Automated Test Suite Framework (jose4j) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.1.0 | |
CVE-2023-52425 | Oracle Communications Cloud Native Core Binding Support Function | Install (LibExpat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.3 | |
CVE-2024-6162 | Oracle Communications Cloud Native Core Binding Support Function | Install (Undertow) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.3 | |
CVE-2023-5685 | Oracle Communications Cloud Native Core Binding Support Function | Install (XNIO) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.3 | |
CVE-2024-25062 | Oracle Communications Cloud Native Core Binding Support Function | Install (libxml2) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.3 | |
CVE-2024-27316 | Oracle Communications Cloud Native Core Network Data Analytics Function | Automated Test Suite (Apache HTTP Server) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 24.2.0 | |
CVE-2024-24549 | Oracle Communications Cloud Native Core Network Data Analytics Function | Automated Test Suite (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 24.2.0 | |
CVE-2024-34069 | Oracle Communications Cloud Native Core Network Function Cloud Native Environment | Install (Werkzeug) | HTTP | Yes | 7.5 | Network | High | None | Required | Un- changed | High | High | High | 23.4.0, 24.1.0 | |
CVE-2024-26130 | Oracle Communications Cloud Native Core Network Repository Function | Install (Cryptography) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.2 | |
CVE-2023-51775 | Oracle Communications Cloud Native Core Network Repository Function | Install (jose4j) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.2 | |
CVE-2024-22201 | Oracle Communications Cloud Native Core Network Repository Function | Install (Eclipse Jetty) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.2 | |
CVE-2023-46589 | Oracle Communications Cloud Native Core Policy | Alarms, KPI, and Measurements (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 23.4.0-23.4.4 | |
CVE-2024-26130 | Oracle Communications Cloud Native Core Policy | Alarms, KPI, and Measurements (Cryptography) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.4 | |
CVE-2023-52425 | Oracle Communications Cloud Native Core Policy | Alarms, KPI, and Measurements (LibExpat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.4 | |
CVE-2024-25062 | Oracle Communications Cloud Native Core Policy | Alarms, KPI, and Measurements (libxml2) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.4 | |
CVE-2024-6162 | Oracle Communications Cloud Native Core Policy | Install (Undertow) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.4 | |
CVE-2023-5685 | Oracle Communications Cloud Native Core Policy | Install (XNIO) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0-23.4.4 | |
CVE-2024-26130 | Oracle Communications Cloud Native Core Security Edge Protection Proxy | Automated Test Suite (Cryptography) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0 | |
CVE-2023-52425 | Oracle Communications Cloud Native Core Security Edge Protection Proxy | Oracle Linux (LibExpat) | TCP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 24.1.0 | |
CVE-2024-26130 | Oracle Communications Cloud Native Core Service Communication Proxy | Install (Cryptography) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0, 24.1.0 | |
CVE-2023-52425 | Oracle Communications Cloud Native Core Service Communication Proxy | Install (LibExpat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0, 24.1.0 | |
CVE-2023-51775 | Oracle Communications Cloud Native Core Service Communication Proxy | Install (jose4j) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.1 | |
CVE-2024-22201 | Oracle Communications Cloud Native Core Service Communication Proxy | Install (Eclipse Jetty) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.2 | |
CVE-2024-23672 | Oracle Communications Diameter Signaling Router | Patches (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.6.0.4-8.6.0.6 | |
CVE-2022-42890 | Oracle Communications EAGLE Element Management System | Security (Apache Batik) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | High | None | None | 46.6.4, 46.6.5 | |
CVE-2023-24998 | Oracle Communications EAGLE Element Management System | Security (Apache Commons FileUpload) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 46.6.4, 46.6.5 | |
CVE-2024-24549 | Oracle Communications EAGLE Element Management System | Security (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 46.6.4, 46.6.5 | |
CVE-2022-34169 | Oracle Communications EAGLE Element Management System | Security (Apache Xalan-Java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 46.6.4, 46.6.5 | |
CVE-2024-22201 | Oracle Communications EAGLE Element Management System | Security (Eclipse Jetty) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 46.6.4, 46.6.5 | |
CVE-2023-51775 | Oracle Communications EAGLE Element Management System | Security (jose4j) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 46.6.4, 46.6.5 | |
CVE-2024-26130 | Oracle Communications Network Analytics Data Director | Install (Cryptography) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0, 24.1.0 | |
CVE-2023-51775 | Oracle Communications Network Analytics Data Director | Install (jose4j) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0, 24.1.0 | |
CVE-2023-52425 | Oracle Communications Network Analytics Data Director | Platform (LibExpat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.4.0, 24.1.0 | |
CVE-2024-26130 | Oracle Communications Operations Monitor | Mediation Engine (Cryptography) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 5.1, 5.2 | |
CVE-2023-44487 | Oracle Communications Performance Intelligence | Management (Nghttp2) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 10.5 | |
CVE-2022-34169 | Oracle Communications Policy Management | CMP (Apache Xalan-Java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 12.6.1.0.0, 15.0.0.0.0 | |
CVE-2023-44487 | Oracle Communications Session Border Controller | Routing (Nghttp2) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 4.1.0, 4.2.0, 9.2.0, 9.3.0 | |
CVE-2024-22019 | Oracle Communications User Data Repository | Platform (Node.js) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.11.0 | |
CVE-2024-24549 | Oracle Communications User Data Repository | Security (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.11.3 | |
CVE-2024-28752 | Oracle Communications Cloud Native Core Unified Data Repository | Install (Apache CXF) | HTTP | Yes | 7.4 | Network | High | None | None | Un- changed | High | High | None | 23.4.1 | |
CVE-2024-28752 | Oracle Communications Element Manager | Security (Apache CXF) | SOAP | Yes | 7.4 | Network | High | None | None | Un- changed | High | High | None | 9.0.0-9.0.3 | |
CVE-2024-28752 | Oracle Communications Session Report Manager | General (Apache CXF) | SOAP | Yes | 7.4 | Network | High | None | None | Un- changed | High | High | None | 9.0.0-9.0.3 | |
CVE-2019-10086 | Oracle Communications EAGLE Element Management System | Security (Apache Commons BeanUtils) | HTTP | Yes | 7.3 | Network | Low | None | None | Un- changed | Low | Low | Low | 46.6.4, 46.6.5 | |
CVE-2024-22234 | Oracle Communications Cloud Native Core Policy | Install (Spring Security) | HTTP | Yes | 6.5 | Network | Low | None | None | Un- changed | Low | Low | None | 23.4.0-23.4.4 | |
CVE-2021-37533 | Oracle Communications EAGLE Element Management System | Security (Apache Commons Net) | HTTP | Yes | 6.5 | Network | Low | None | Required | Un- changed | High | None | None | 46.6.4, 46.6.5 | |
CVE-2024-28849 | Oracle Communications Network Analytics Data Director | Configuration (follow-redirects) | HTTP | No | 6.5 | Network | Low | Low | None | Un- changed | High | None | None | 23.4.0, 24.1.0 | |
CVE-2024-0450 | Oracle Communications Cloud Native Core Automated Test Suite | Automated Test Suite Framework (Python) | None | No | 6.2 | Local | Low | None | None | Un- changed | None | None | High | 23.1.0 | |
CVE-2024-0450 | Oracle Communications Network Analytics Data Director | Install (Python) | None | No | 6.2 | Local | Low | None | None | Un- changed | None | None | High | 23.4.0, 24.1.0 | |
CVE-2021-41184 | Oracle Communications EAGLE Element Management System | Security (jQueryUI) | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 46.6.4, 46.6.5 | |
CVE-2022-36033 | Oracle Communications EAGLE Element Management System | Security (jsoup) | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 46.6.4, 46.6.5 | |
CVE-2023-48795 | Oracle Communications Cloud Native Core Binding Support Function | Install/Upgrade (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 23.4.0-23.4.3 | |
CVE-2024-26308 | Oracle Communications Cloud Native Core Network Exposure Function | Install (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 23.4.3 | |
CVE-2024-26308 | Oracle Communications Cloud Native Core Network Function Cloud Native Environment | Configuration (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 24.1.0, 23.4.0 | |
CVE-2024-26308 | Oracle Communications Cloud Native Core Network Repository Function | Install (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 23.4.2 | |
CVE-2024-26308 | Oracle Communications Cloud Native Core Policy | Install (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 23.4.0 | |
CVE-2024-26308 | Oracle Communications Cloud Native Core Security Edge Protection Proxy | Signaling (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 23.4.0 | |
CVE-2024-26308 | Oracle Communications Cloud Native Core Service Communication Proxy | Install (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 23.4.2 | |
CVE-2024-25710 | Oracle Communications Cloud Native Core Unified Data Repository | Signaling (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 23.4.1 | |
CVE-2024-34064 | Oracle Communications Cloud Native Core Network Function Cloud Native Environment | Install (Jinja2) | HTTP | Yes | 5.4 | Network | Low | None | Required | Un- changed | Low | Low | None | 23.4.0, 24.1.0 | |
CVE-2024-29025 | Oracle Communications Cloud Native Core Binding Support Function | Install (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.0-23.4.3 | |
CVE-2024-29025 | Oracle Communications Cloud Native Core Console | Configuration (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.1 | |
CVE-2024-29025 | Oracle Communications Cloud Native Core Network Exposure Function | Platform (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.3 | |
CVE-2024-29025 | Oracle Communications Cloud Native Core Network Repository Function | Install (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.2 | |
CVE-2024-29025 | Oracle Communications Cloud Native Core Policy | Install (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.0-23.4.4 | |
CVE-2024-29025 | Oracle Communications Cloud Native Core Security Edge Protection Proxy | Signaling (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.0 | |
CVE-2024-29025 | Oracle Communications Cloud Native Core Service Communication Proxy | Install (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.0, 24.1.0 | |
CVE-2024-28182 | Oracle Communications Cloud Native Core Unified Data Repository | Install (Nghttp2) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.2 | |
CVE-2023-33201 | Oracle Communications EAGLE Element Management System | Security (Bouncy Castle Java Library) | HTTPS | Yes | 5.3 | Network | Low | None | None | Un- changed | Low | None | None | 46.6.4, 46.6.5 | |
CVE-2024-29025 | Oracle Communications Network Analytics Data Director | Install (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 23.4.0, 24.1.0 | |
CVE-2021-29425 | Oracle Communications EAGLE Element Management System | Security (Apache Commons IO) | HTTP | Yes | 4.8 | Network | High | None | None | Un- changed | Low | Low | None | 46.6.4, 46.6.5 |
This Critical Patch Update contains 4 new security patches for Oracle Construction and Engineering. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-22262 | Primavera Gateway | Admin (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 19.12.0-19.12.19, 20.12.0-20.12.14, 21.12.0-21.12.12 | |
CVE-2024-21742 | Primavera Unifier | Integration (Apache James MIME4J) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | Low | None | 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.13, 23.12.0-23.12.6 | |
CVE-2024-22262 | Primavera Unifier | Document Management (Spring Framework) | HTTP | No | 4.6 | Network | Low | Low | Required | Un- changed | Low | Low | None | 22.12.0-22.12.13, 23.12.0-23.12.6 | |
CVE-2024-23944 | Primavera Unifier | Document Management (Apache ZooKeeper) | HTTP | No | 3.1 | Network | High | Low | None | Un- changed | Low | None | None | 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.13, 23.12.0-23.12.6 |
This Critical Patch Update contains 10 new security patches for Oracle E-Business Suite. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
Oracle E-Business Suite products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle E-Business Suite products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle E-Business Suite risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle E-Business Suite products, Oracle recommends that customers apply the July 2024 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite. For information on what patches need to be applied to your environments, refer to Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (July 2024), My Oracle Support Note 2484000.1 .
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-21149 | Oracle Enterprise Asset Management | Work Definition Issues | HTTP | No | 8.1 | Network | Low | Low | None | Un- changed | High | High | None | 12.2.11-12.2.13 | |
CVE-2024-21152 | Oracle Process Manufacturing Financials | Allocation Rules | HTTP | No | 8.1 | Network | Low | Low | None | Un- changed | High | High | None | 12.2.12-12.2.13 | |
CVE-2024-21153 | Oracle Process Manufacturing Product Development | Quality Management Specs | HTTP | No | 8.1 | Network | Low | Low | None | Un- changed | High | High | None | 12.2.13 | |
CVE-2024-21146 | Oracle Trade Management | GL Accounts | HTTP | No | 8.1 | Network | Low | Low | None | Un- changed | High | High | None | 12.2.3-12.2.13 | |
CVE-2024-21167 | Oracle Trading Community | Party Search UI | HTTP | No | 8.1 | Network | Low | Low | None | Un- changed | High | High | None | 12.2.3-12.2.13 | |
CVE-2024-21169 | Oracle Marketing | Partners | HTTP | Yes | 6.5 | Network | Low | None | None | Un- changed | Low | Low | None | 12.2.3-12.2.13 | |
CVE-2024-21128 | Oracle Application Object Library | APIs | HTTP | No | 5.4 | Network | Low | Low | Required | Changed | Low | Low | None | 12.2.6-12.2.13 | |
CVE-2024-21132 | Oracle Purchasing | Approvals | HTTP | No | 5.4 | Network | Low | Low | Required | Changed | Low | Low | None | 12.2.3-12.2.13 | |
CVE-2024-21143 | Oracle iStore | User Management | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | Low | None | None | 12.2.3-12.2.13 | |
CVE-2024-21148 | Oracle Applications Framework | Personalization | HTTP | No | 4.8 | Network | Low | High | Required | Changed | Low | Low | None | 12.2.3-12.2.13 |
This Critical Patch Update contains 5 new security patches for Oracle Enterprise Manager. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager installed. The English text form of this Risk Matrix can be found here.
Oracle Enterprise Manager products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle Enterprise Manager products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle Enterprise Manager risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle Enterprise Manager products, Oracle recommends that customers apply the July 2024 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Enterprise Manager. For information on what patches need to be applied to your environments, refer to Critical Patch Update July 2024 Patch Availability Document for Oracle Products, My Oracle Support Note 3027815.1 .
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-1370 | Oracle Enterprise Manager Base Platform | Install (json-smart) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 13.5.0.0 | |
CVE-2021-37533 | Oracle Enterprise Manager Base Platform | Install (Apache Commons Net) | HTTP | Yes | 6.5 | Network | Low | None | Required | Un- changed | High | None | None | 13.5.0.0 | |
CVE-2023-48795 | Oracle Application Testing Suite | Install (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 13.3.0.1 | |
CVE-2023-48795 | Oracle Enterprise Manager Base Platform | Agent Next Gen (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 13.5.0.0 | |
CVE-2023-40167 | Oracle Enterprise Manager Base Platform | Agent Next Gen (Eclipse Jetty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | Low | None | 13.5.0.0 |
This Critical Patch Update contains 60 new security patches for Oracle Financial Services Applications. 44 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-47248 | Oracle Financial Services Model Management and Governance | Installer (PyArrow) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 8.1.2.5, 8.1.2.6 | |
CVE-2022-36944 | Oracle Financial Services Model Management and Governance | Installer (Scala) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 8.1.2.5, 8.1.2.6 | |
CVE-2024-32114 | Oracle Financial Services Analytical Applications Infrastructure | Infrastructure (Apache ActiveMQ) | HTTP | Yes | 8.5 | Adjacent Network | Low | None | Required | Changed | High | None | High | 8.1.1, 8.1.2 | |
CVE-2023-50447 | Oracle Banking Branch | Reports (Pillow) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-22262 | Oracle Banking Branch | Reports (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2023-50447 | Oracle Banking Cash Management | Accessibility (Pillow) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-22262 | Oracle Banking Cash Management | Accessibility (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2023-50447 | Oracle Banking Corporate Lending Process Management | Base (Pillow) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-22262 | Oracle Banking Corporate Lending Process Management | Base (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2023-50447 | Oracle Banking Credit Facilities Process Management | Common (Pillow) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-22262 | Oracle Banking Credit Facilities Process Management | Common (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-22262 | Oracle Banking Liquidity Management | Common (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2023-50447 | Oracle Banking Origination | Basic Config/Maintenances (Pillow) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-22262 | Oracle Banking Origination | Basic Config/Maintenances (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-22262 | Oracle Banking Virtual Account Management | Common (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-23807 | Oracle Financial Services Analytical Applications Infrastructure | Infrastructure (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 8.1.1, 8.1.2 | |
CVE-2024-22262 | Oracle Financial Services Analytical Applications Infrastructure | Infrastructure (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 8.0.7, 8.0.8, 8.1.1, 8.1.2 | |
CVE-2024-23807 | Oracle Financial Services Basel Regulatory Capital Basic | Platform (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 8.0.7.3, 8.0.8.3 | |
CVE-2024-23807 | Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach | Platform (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 8.0.7.3, 8.0.8.3 | |
CVE-2024-23807 | Oracle Financial Services Behavior Detection Platform | Platform (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 8.0.8.1, 8.1.1.1, 8.1.2.6, 8.1.2.7 | |
CVE-2024-22262 | Oracle Financial Services Behavior Detection Platform | Platform (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 8.0.8.1, 8.1.1.1, 8.1.2.6, 8.1.2.7 | |
CVE-2024-22262 | Oracle Financial Services Compliance Studio | Reports (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 8.1.2.6, 8.1.2.7 | |
CVE-2024-22262 | Oracle Financial Services Enterprise Case Management | Installer (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 8.0.8.2.8, 8.1.1.1.18, 8.1.2.6.4, 8.1.2.7.3 | |
CVE-2024-22262 | Oracle Financial Services Model Management and Governance | Installer (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 8.1.2.5, 8.1.2.6 | |
CVE-2024-23807 | Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition | Platform (Apache Xerces-C++) | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 8.0.8.0 | |
CVE-2024-22262 | Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition | Platform (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 8.0.8.0 | |
CVE-2024-22262 | Oracle FLEXCUBE Universal Banking | Infrastructure (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-25062 | Oracle Banking Virtual Account Management | Common (libxml2) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-2511 | Oracle Banking Virtual Account Management | Common (OpenSSL) | TLS | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2023-52425 | Oracle Financial Services Behavior Detection Platform | Platform (LibExpat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.0.8.1, 8.1.1.1, 8.1.2.6, 8.1.2.7 | |
CVE-2024-22201 | Oracle Financial Services Compliance Studio | Reports (Eclipse Jetty) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.1.2.6, 8.1.2.7 | |
CVE-2023-26031 | Oracle Financial Services Model Management and Governance | Installer (Apache Hadoop) | HTTP | No | 7.5 | Network | High | Low | None | Un- changed | High | High | High | 8.1.2.5, 8.1.2.6 | |
CVE-2024-24549 | Oracle Financial Services Model Management and Governance | Installer (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.1.2.5, 8.1.2.6 | |
CVE-2023-52425 | Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition | Platform (LibExpat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.0.8.0 | |
CVE-2023-6129 | Oracle Banking Branch | Reports (OpenSSL) | TLS | Yes | 6.5 | Network | High | None | None | Un- changed | None | Low | High | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2023-6129 | Oracle Banking Liquidity Management | Common (OpenSSL) | TLS | Yes | 6.5 | Network | High | None | None | Un- changed | None | Low | High | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2023-44483 | Oracle Financial Services Model Management and Governance | Installer (Apache Santuario XML Security For Java) | HTTP | No | 6.5 | Network | Low | Low | None | Un- changed | High | None | None | 8.1.2.5, 8.1.2.6 | |
CVE-2023-34055 | Oracle Financial Services Model Management and Governance | Installer (Spring Boot) | HTTP | No | 6.5 | Network | Low | Low | None | Un- changed | None | None | High | 8.1.2.5, 8.1.2.6 | |
CVE-2024-24816 | Oracle Banking Deposits and Lines of Credit Servicing | Web UI (CKEditor) | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 2.12.0.0.0 | |
CVE-2024-21188 | Oracle Financial Services Revenue Management and Billing | Chatbot | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 6.0.0.0.0, 6.1.0.0.0 | |
CVE-2024-26308 | Oracle Banking Branch | Reports (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-26308 | Oracle Banking Cash Management | Accessibility (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-26308 | Oracle Banking Corporate Lending Process Management | Base (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-26308 | Oracle Banking Credit Facilities Process Management | Common (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-26308 | Oracle Banking Liquidity Management | Common (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-26308 | Oracle Banking Origination | Basic Config/Maintenances (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-26308 | Oracle Financial Services Analytical Applications Infrastructure | Infrastructure (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 8.0.7, 8.0.8, 8.1.1, 8.1.2 | |
CVE-2024-26308 | Oracle Financial Services Behavior Detection Platform | Platform (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 8.0.8.1, 8.1.1.1, 8.1.2.6, 8.1.2.7 | |
CVE-2024-26308 | Oracle Financial Services Model Management and Governance | Installer (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 8.1.2.5, 8.1.2.6 | |
CVE-2024-26308 | Oracle FLEXCUBE Investor Servicing | Infrastructure Code (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 14.5.0.0.0, 14.7.0.0.0 | |
CVE-2024-29025 | Oracle Banking Branch | Reports (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-29025 | Oracle Banking Credit Facilities Process Management | Common (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-29025 | Oracle Banking Liquidity Management | Common (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-29025 | Oracle Banking Platform | Security (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 2.4.0.0.0 | |
CVE-2024-29025 | Oracle Banking Virtual Account Management | Common (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2023-51074 | Oracle Financial Services Analytical Applications Infrastructure | Infrastructure (JsonPath) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 8.0.7, 8.0.8, 8.1.1, 8.1.2 | |
CVE-2024-29025 | Oracle FLEXCUBE Universal Banking | Infrastructure (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | |
CVE-2024-29133 | Oracle Banking Party Management | Web UI (Apache Commons Configuration) | None | No | 4.4 | Local | Low | Low | None | Un- changed | None | Low | Low | 2.7.0.0.0 | |
CVE-2024-29133 | Oracle Financial Services Compliance Studio | Reports (Apache Commons Configuration) | None | No | 4.4 | Local | Low | Low | None | Un- changed | None | Low | Low | 8.1.2.6, 8.1.2.7 | |
CVE-2024-29133 | Oracle Financial Services Model Management and Governance | Installer (Apache Commons Configuration) | None | No | 4.4 | Local | Low | Low | None | Un- changed | None | Low | Low | 8.1.2.5, 8.1.2.6 |
This Critical Patch Update contains 41 new security patches for Oracle Fusion Middleware. 32 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
To get the full list of current and previously released Critical Patch Update patches for Oracle Fusion Middleware products, refer to My Oracle Support Doc ID 2806740.2 .
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-45853 | Oracle HTTP Server | SSL Module (zlib) | HTTPS | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 12.2.1.4.0 | |
CVE-2023-45853 | Oracle Outside In Technology | Outside In Filters (zlib) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 8.5.7 | |
CVE-2022-45378 | Oracle WebCenter Portal | Portal Core (Apache SOAP) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 12.2.1.4.0 | |
CVE-2023-34034 | Oracle WebCenter Sites | WebCenter Sites (Spring Security) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 12.2.1.4.0 | |
CVE-2024-21181 | Oracle WebLogic Server | Core | T3, IIOP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 12.2.1.4.0, 14.1.1.0.0 | |
CVE-2023-4759 | Oracle Global Lifecycle Management NextGen OUI Framework | NextGen Installer (Eclipse JGit) | HTTP | No | 8.8 | Network | Low | Low | None | Un- changed | High | High | High | 12.2.1.4.0 | |
CVE-2024-22259 | Oracle Identity Manager | Third Party (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 12.2.1.4.0 | |
CVE-2024-22243 | Oracle Middleware Common Libraries and Tools | Third Party (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 12.2.1.4.0 | |
CVE-2024-22262 | Oracle WebLogic Server | Core (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 12.2.1.4.0, 14.1.1.0.0 | |
CVE-2024-22201 | Oracle Coherence | Third Party (Eclipse Jetty) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0, 14.1.1.0.0 | |
CVE-2024-29857 | Oracle Global Lifecycle Management NextGen OUI Framework | NextGen Installer (Bouncy Castle Java Library) | HTTPS | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2023-52425 | Oracle HTTP Server | SSL Module (LibExpat) | HTTPS | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2024-25062 | Oracle HTTP Server | SSL Module (libxml2) | HTTPS | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2022-40152 | Oracle JDeveloper | Oracle JDeveloper (Woodstox) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2023-52425 | Oracle Outside In Technology | DC-Specific Component (LibExpat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.5.7 | |
CVE-2023-24998 | Oracle Service Bus | Centralized Thirdparty Jars (Apache Commons FileUpload) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2023-36478 | Oracle Unified Directory | Containers (Eclipse Jetty) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2023-5072 | Oracle WebCenter Portal | Discussion Forums (JSON-java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2024-21175 | Oracle WebLogic Server | Core | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 12.2.1.4.0, 14.1.1.0.0 | |
CVE-2024-21182 | Oracle WebLogic Server | Core | T3, IIOP | Yes | 7.5 | Network | Low | None | None | Un- changed | High | None | None | 12.2.1.4.0, 14.1.1.0.0 | |
CVE-2024-21183 | Oracle WebLogic Server | Core | T3, IIOP | Yes | 7.5 | Network | Low | None | None | Un- changed | High | None | None | 12.2.1.4.0, 14.1.1.0.0 | |
CVE-2023-2976 | Oracle Global Lifecycle Management NextGen OUI Framework | NextGen Installer (Google Guava) | None | No | 7.1 | Local | Low | Low | None | Un- changed | High | High | None | 12.2.1.4.0 | |
CVE-2023-2976 | Oracle WebCenter Sites | WebCenter Sites (Google Guava) | None | No | 7.1 | Local | Low | Low | None | Un- changed | High | High | None | 12.2.1.4.0 | |
CVE-2021-37533 | Oracle Data Integrator | Rest Service (Apache Commons Net) | HTTP | Yes | 6.5 | Network | Low | None | Required | Un- changed | High | None | None | 12.2.1.4.0 | |
CVE-2023-6129 | Oracle HTTP Server | SSL Module (OpenSSL) | TLS | Yes | 6.5 | Network | High | None | None | Un- changed | None | Low | High | 12.2.1.4.0 | |
CVE-2021-37533 | Oracle WebCenter Content | Content Server (Apache Commons Net) | HTTP | Yes | 6.5 | Network | Low | None | Required | Un- changed | High | None | None | 12.2.1.4.0 | |
CVE-2020-1945 | Oracle Middleware Common Libraries and Tools | Third Party (Apache Ant) | None | No | 6.3 | Local | High | Low | None | Un- changed | High | High | None | 12.2.1.4.0 | |
CVE-2024-21133 | Oracle Reports Developer | Servlet | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 12.2.1.4.0, 12.2.1.19.0 | |
CVE-2023-46750 | Oracle WebCenter Sites | WebCenter Sites (Apache Shiro) | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 12.2.1.4.0 | |
CVE-2023-48795 | Oracle Data Integrator | Runtime Java agent for ODI (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 12.2.1.4.0 | |
CVE-2023-48795 | Oracle Enterprise Data Quality | General (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 12.2.1.4.0 | |
CVE-2023-2976 | Oracle Fusion Middleware | Oracle Database Client for Fusion Middleware (Google Guava) | None | No | 5.5 | Local | Low | Low | None | Un- changed | High | None | None | 12.2.1.4.0 | |
CVE-2024-26308 | Oracle Middleware Common Libraries and Tools | Third Party (Jython) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2023-29081 | Oracle WebCenter Content | Content Integration Suite (InstallShield) | None | No | 5.5 | Local | Low | Low | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2024-26308 | Oracle WebCenter Portal | Security Framework (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2024-26308 | Oracle WebLogic Server | Centralized Thirdparty Jars (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 12.2.1.4.0, 14.1.1.0.0 | |
CVE-2020-13956 | Oracle Access Manager | Third Party (Apache HttpClient) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | Low | None | 12.2.1.4.0 | |
CVE-2020-13956 | Oracle Business Activity Monitoring | BAM (Apache HttpClient) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | Low | None | 12.2.1.4.0 | |
CVE-2024-29025 | Oracle Coherence | Third Party (Netty) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 12.2.1.4.0, 14.1.1.0.0 | |
CVE-2024-0853 | Oracle HTTP Server | SSL Module (curl) | TLS | Yes | 5.3 | Network | Low | None | None | Un- changed | None | Low | None | 12.2.1.4.0 | |
CVE-2021-29425 | Oracle Service Bus | OSB Security (Apache Commons IO) | HTTP | Yes | 4.8 | Network | High | None | None | Un- changed | Low | Low | None | 12.2.1.4.0 |
This Critical Patch Update contains 17 new security patches for Oracle Analytics. 12 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2022-0239 | Oracle Business Intelligence Enterprise Edition | Analytics Server (Stanford CoreNLP) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 7.0.0.0.0 | |
CVE-2022-21797 | Oracle Business Intelligence Enterprise Edition | Pipeline Test Failures (Joblib) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 7.0.0.0.0 | |
CVE-2021-23926 | Oracle Business Intelligence Enterprise Edition | BI FNDN (Apache XMLBeans) | HTTP | Yes | 9.1 | Network | Low | None | None | Un- changed | High | None | High | 12.2.1.4.0 | |
CVE-2023-26031 | Oracle Analytics Desktop | Analytics Server (Apache Hadoop) | HTTP | No | 7.5 | Network | High | Low | None | Un- changed | High | High | High | Prior to 7.7.0 | |
CVE-2023-46589 | Oracle Analytics Desktop | Analytics Visualization (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | Prior to 7.8.0 | |
CVE-2022-40152 | Oracle Business Intelligence Enterprise Edition | Analytics Server (Woodstox) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 7.0.0.0.0 | |
CVE-2023-1436 | Oracle Business Intelligence Enterprise Edition | Analytics Server (jackson-databind) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2023-1370 | Oracle Business Intelligence Enterprise Edition | Analytics Server (json-smart) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 7.0.0.0.0, 12.2.1.4.0 | |
CVE-2023-1436 | Oracle Business Intelligence Enterprise Edition | BI Platform Security (Jettison) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2023-49083 | Oracle Business Intelligence Enterprise Edition | Pipeline Test Failures (Cryptography) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 7.0.0.0.0 | |
CVE-2023-52428 | Oracle Business Intelligence Enterprise Edition | Storage Service Integration (Nimbus JOSE+JWT) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 12.2.1.4.0 | |
CVE-2021-37533 | Oracle Analytics Desktop | Mapviewer (Apache Commons FileUpload) | HTTP | Yes | 6.5 | Network | Low | None | Required | Un- changed | High | None | None | Prior to 7.8.0 | |
CVE-2023-48795 | Oracle Analytics Desktop | Analytics Visualization (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | Prior to 7.8.0 | |
CVE-2024-25710 | Oracle Analytics Desktop | Analytics Server (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | Prior to 7.8.0 | |
CVE-2023-33202 | Oracle Analytics Desktop | Analytics Server (Bouncy Castle Java Library) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | Prior to 7.8.0 | |
CVE-2024-0727 | Oracle Business Intelligence Enterprise Edition | Analytics Server (OpenSSL) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 7.0.0.0.0, 7.6.0.0.0, 12.2.1.4.0 | |
CVE-2024-21139 | Oracle Business Intelligence Enterprise Edition | Analytics Web Answers | HTTP | No | 5.4 | Network | Low | Low | Required | Changed | Low | Low | None | 7.0.0.0.0, 7.6.0.0.0, 12.2.1.4.0 |
This Critical Patch Update contains 5 new security patches for Oracle HealthCare Applications. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-22262 | Oracle Healthcare Data Repository | FHIR Server (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 8.1.4, 8.2.0 | |
CVE-2024-22262 | Oracle Healthcare Master Person Index | Core (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 5.0.0-5.0.9 | |
CVE-2023-2976 | Oracle Healthcare Foundation | Core (Google Guava) | None | No | 7.1 | Local | Low | Low | None | Un- changed | High | High | None | 8.2.0, 8.2.1, 8.2.2, 8.2.3 | |
CVE-2024-26308 | Oracle Healthcare Data Repository | FHIR CLI (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 8.1.4, 8.2.0 | |
CVE-2022-33879 | Oracle Healthcare Foundation | Upload Services (Apache Tika) | None | No | 3.3 | Local | Low | None | Required | Un- changed | None | None | Low | 8.2.0, 8.2.1, 8.2.2, 8.2.4 |
This Critical Patch Update contains 3 new security patches for Oracle Hyperion. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-29081 | Oracle Hyperion Data Relationship Management | Installation and Configuration (InstallShield) | None | No | 5.5 | Local | Low | Low | None | Un- changed | None | None | High | 11.2.17.0.000 | |
CVE-2023-29081 | Oracle Hyperion Financial Close Management | Close Manager (InstallShield) | None | No | 5.5 | Local | Low | Low | None | Un- changed | None | None | High | 11.2.17.0.000 | |
CVE-2023-29081 | Oracle Hyperion Infrastructure Technology | Installation and Configuration (InstallShield) | None | No | 5.5 | Local | Low | Low | None | Un- changed | None | None | High | 11.2.17.0.000 |
This Critical Patch Update contains 10 new security patches for Oracle Insurance Applications. 7 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-22257 | Oracle Insurance Policy Administration J2EE | Architecture (Spring Security) | HTTP | Yes | 8.2 | Network | Low | None | None | Un- changed | High | Low | None | 11.2.12, 11.3.0-11.3.2 | |
CVE-2024-22262 | Oracle Documaker | Docupresentment IDS Server (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 12.6.4, 12.7.1 | |
CVE-2024-22262 | Oracle Insurance Policy Administration J2EE | Architecture (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 11.2.12, 11.3.0-11.3.2 | |
CVE-2022-34169 | Oracle Documaker | Development Tools (Apache Xalan-Java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 12.6.4, 12.7.1 | |
CVE-2022-34169 | Oracle Insurance Policy Administration J2EE | Architecture (Apache Xalan-Java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 11.2.12, 11.3.0-11.3.2 | |
CVE-2024-23635 | Oracle Insurance Policy Administration J2EE | Architecture (AntiSamy) | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 11.2.12 | |
CVE-2023-29081 | Oracle Documaker | Transall (InstallShield) | None | No | 5.5 | Local | Low | Low | None | Un- changed | None | None | High | 12.7.1 | |
CVE-2024-26308 | Oracle Insurance Policy Administration J2EE | Architecture (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 11.2.12, 11.3.0-11.3.2 | |
CVE-2023-21036 | Oracle Insurance Policy Administration J2EE | Architecture (aCropalypse) | None | No | 5.5 | Local | Low | Low | None | Un- changed | High | None | None | 11.2.12, 11.3.0-11.3.2 | |
CVE-2020-13956 | Oracle Documaker | Enterprise Edition (Apache HttpClient) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | Low | None | 12.6.4, 12.7.1 |
This Critical Patch Update contains 7 new security patches for Oracle Java SE. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
The CVSS scores below assume that a user running a Java applet or Java Web Start application has administrator privileges (typical on Windows). When the user does not run with administrator privileges (typical on Solaris and Linux), the corresponding CVSS impact scores for Confidentiality, Integrity, and Availability are "Low" instead of "High", lowering the CVSS Base Score. For example, a Base Score of 9.6 becomes 7.1. Java Management Service, available to all users, can help you find vulnerable Java versions in your systems. Java SE Subscribers and customers running in Oracle Cloud can use Java Management Service to update Java Runtimes and to do further security reviews like identifying potentially vulnerable third party libraries used by your Java programs. Existing Java Management Service user click here to log in to your dashboard. The Java Management Service Documentation provides a list of features available to everyone and those available only to customers. Learn more about using Java Management Service to monitor and secure your Java Installations.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-27983 | Oracle GraalVM for JDK | Node (Node.js) | HTTP/2 | Yes | 8.2 | Network | Low | None | None | Un- changed | None | Low | High | Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1 | |
CVE-2024-21147 | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | Hotspot | Multiple | Yes | 7.4 | Network | High | None | None | Un- changed | High | High | None | Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10 | See Note 1 |
CVE-2024-21145 | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | 2D | Multiple | Yes | 4.8 | Network | High | None | None | Un- changed | Low | Low | None | Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10 | See Note 1 |
CVE-2024-21140 | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | Hotspot | Multiple | Yes | 4.8 | Network | High | None | None | Un- changed | Low | Low | None | Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10 | See Note 1 |
CVE-2024-21144 | Oracle Java SE, Oracle GraalVM Enterprise Edition | Concurrency | Multiple | Yes | 3.7 | Network | High | None | None | Un- changed | None | None | Low | Oracle Java SE: 8u411, 8u411-perf, 11.0.23; Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10 | See Note 2 |
CVE-2024-21131 | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | Hotspot | Multiple | Yes | 3.7 | Network | High | None | None | Un- changed | None | Low | None | Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10 | See Note 1 |
CVE-2024-21138 | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | Hotspot | Multiple | Yes | 3.7 | Network | High | None | None | Un- changed | None | None | Low | Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10 | See Note 1 |
This Critical Patch Update contains 8 new security patches for Oracle JD Edwards. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-38552 | JD Edwards EnterpriseOne Tools | E1 Dev Platform Tech - Cloud (Node.js) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | Prior to 9.2.8.2 | |
CVE-2024-21168 | JD Edwards EnterpriseOne Orchestrator | E1 IOT Orchestrator Security | HTTP | No | 6.5 | Network | Low | Low | None | Un- changed | High | None | None | Prior to 9.2.8.3 | |
CVE-2023-6129 | JD Edwards World Security | World Software Security (OpenSSL) | HTTPS | Yes | 6.5 | Network | High | None | None | Un- changed | None | Low | High | A9.4 | |
CVE-2024-21150 | JD Edwards EnterpriseOne Tools | Web Runtime SEC | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | Prior to 9.2.8.2 | |
CVE-2022-31160 | JD Edwards EnterpriseOne Tools | Web Runtime SEC (jQueryUI) | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | Prior to 9.2.8.2 | |
CVE-2023-33201 | JD Edwards EnterpriseOne Orchestrator | E1 IOT Orchestrator Security (Bouncy Castle Java Library) | HTTPS | Yes | 5.3 | Network | Low | None | None | Un- changed | Low | None | None | Prior to 9.2.8.2 | |
CVE-2023-3817 | JD Edwards EnterpriseOne Tools | Enterprise Infrastructure SEC (OpenSSL) | HTTPS | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | Prior to 9.2.8.2 | |
CVE-2023-35887 | JD Edwards EnterpriseOne Tools | Business Logic Infra SEC (Apache Mina SSHD) | SSH | No | 4.3 | Network | Low | Low | None | Un- changed | Low | None | None | Prior to 9.2.8.2 |
This Critical Patch Update contains 37 new security patches for Oracle MySQL. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-37920 | MySQL Cluster | Cluster: General (Certifi) | Multiple | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 8.0.34 and prior, 8.1.0 and prior | |
CVE-2024-22257 | MySQL Enterprise Monitor | Monitoring: General (Spring Security) | Multiple | Yes | 8.2 | Network | Low | None | None | Un- changed | High | Low | None | 8.0.38 and prior | |
CVE-2021-24112 | MySQL Connectors | Connector/Net (.NET Core) | MySQL Protocol | Yes | 8.1 | Network | High | None | None | Un- changed | High | High | High | 8.4.0 and prior | |
CVE-2024-22262 | MySQL Enterprise Monitor | Monitoring: General (Spring Framework) | Multiple | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 8.0.38 and prior | |
CVE-2023-52425 | MySQL Cluster | Cluster: General (LibExpat) | Multiple | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.0.36 and prior, 8.3.0 and prior | |
CVE-2024-25062 | MySQL Cluster | Cluster: General (libxml2) | Multiple | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-24549 | MySQL Enterprise Monitor | Monitoring: General (Apache Tomcat) | Multiple | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.0.38 and prior | |
CVE-2024-25062 | MySQL Workbench | MySQL Workbench (libxml2) | MySQL Workbench | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 8.0.36 and prior | |
CVE-2024-21177 | MySQL Cluster | Cluster: General | Multiple | No | 6.5 | Network | Low | Low | None | Un- changed | None | None | High | 7.5.34 and prior, 7.6.30 and prior, 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21171 | MySQL Server | Server: Optimizer | MySQL Protocol | No | 6.5 | Network | Low | Low | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21177 | MySQL Server | Server: Optimizer | MySQL Protocol | No | 6.5 | Network | Low | Low | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2023-6129 | MySQL Workbench | MySQL Workbench (OpenSSL) | MySQL Workbench | Yes | 6.5 | Network | High | None | None | Un- changed | None | Low | High | 8.0.36 and prior | |
CVE-2024-21170 | MySQL Connectors | Connector/Python | MySQL Protocol | No | 6.3 | Network | Low | Low | None | Un- changed | Low | Low | Low | 8.4.0 and prior | |
CVE-2024-0450 | MySQL Workbench | MySQL Workbench (Python) | None | No | 6.2 | Local | Low | None | None | Un- changed | None | None | High | 8.0.36 and prior | |
CVE-2023-48795 | MySQL Cluster | Cluster: General (libssh) | Multiple | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21166 | MySQL Server | InnoDB | MySQL Protocol | No | 5.9 | Network | High | High | None | Un- changed | None | High | High | 8.0.36 and prior, 8.3.0 and prior | |
CVE-2023-48795 | MySQL Workbench | MySQL Workbench (libssh) | MySQL Workbench | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 8.0.36 and prior | |
CVE-2024-21163 | MySQL Server | Server: Optimizer | MySQL Protocol | No | 5.5 | Network | Low | High | None | Un- changed | None | Low | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21176 | MySQL Server | Server: Thread Pooling | MySQL Protocol | No | 5.3 | Network | High | Low | None | Un- changed | None | None | High | 8.4.0 and prior | |
CVE-2024-21125 | MySQL Cluster | Cluster: General | Multiple | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 7.5.34 and prior, 7.6.30 and prior, 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-20996 | MySQL Server | InnoDB | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21157 | MySQL Server | InnoDB | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.36 and prior, 8.4.0 and prior | |
CVE-2024-21159 | MySQL Server | InnoDB | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.36 and prior, 8.3.0 and prior | |
CVE-2024-21160 | MySQL Server | InnoDB | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.36 and prior, 8.3.0 and prior | |
CVE-2024-21173 | MySQL Server | InnoDB | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21179 | MySQL Server | InnoDB | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21185 | MySQL Server | InnoDB | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.38, 8.4.1, 9.0.0 | |
CVE-2024-21127 | MySQL Server | Server: DDL | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21129 | MySQL Server | Server: DDL | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21125 | MySQL Server | Server: FTS | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21130 | MySQL Server | Server: Optimizer | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21135 | MySQL Server | Server: Optimizer | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.36 and prior, 8.3.0 and prior | |
CVE-2024-21137 | MySQL Server | Server: Optimizer | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.35 and prior, 8.2.0 and prior | |
CVE-2024-21162 | MySQL Server | Server: Optimizer | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21165 | MySQL Server | Server: Pluggable Auth | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior | |
CVE-2024-21142 | MySQL Server | Server: Security: Privileges | MySQL Protocol | No | 4.9 | Network | Low | High | None | Un- changed | None | None | High | 8.0.37 and prior, 8.4.0 and prior | |
CVE-2024-21134 | MySQL Server | Server: Connection Handling | MySQL Protocol | No | 4.3 | Network | Low | Low | None | Un- changed | None | None | Low | 8.0.37 and prior, 8.4.0 and prior |
This Critical Patch Update contains 11 new security patches for Oracle PeopleSoft. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-21158 | PeopleSoft Enterprise PeopleTools | Portal | HTTP | No | 6.4 | Network | Low | Low | None | Changed | Low | Low | None | 8.59, 8.60, 8.61 | |
CVE-2024-21178 | PeopleSoft Enterprise PeopleTools | Portal | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 8.59, 8.60, 8.61 | |
CVE-2023-48795 | PeopleSoft Enterprise PeopleTools | Web Server (Apache Mina SSHD) | SSH | Yes | 5.9 | Network | High | None | None | Un- changed | None | High | None | 8.60, 8.61 | |
CVE-2024-26308 | PeopleSoft Enterprise PeopleTools | OpenSearch (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 8.59, 8.60, 8.61 | |
CVE-2024-26308 | PeopleSoft Enterprise PeopleTools | Web Server (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 8.59, 8.60, 8.61 | |
CVE-2023-42503 | PeopleSoft Enterprise PeopleTools | Webserver (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 8.59, 8.60, 8.61 | |
CVE-2024-0232 | PeopleSoft Enterprise PeopleTools | XML Publisher (SQLite) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 8.59 | |
CVE-2024-21122 | PeopleSoft Enterprise HCM Shared Components | Text Catalog | HTTP | No | 5.4 | Network | Low | Low | Required | Changed | Low | Low | None | 9.2 | |
CVE-2023-28756 | PeopleSoft Enterprise PeopleTools | PeopleSoft CDA (Ruby) | HTTP | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 8.59, 8.60, 8.61 | |
CVE-2024-21154 | PeopleSoft Enterprise HCM Human Resources | Human Resources | HTTP | No | 4.3 | Network | Low | Low | None | Un- changed | Low | None | None | 9.2 | |
CVE-2024-21180 | PeopleSoft Enterprise PeopleTools | OpenSearch Dashboards | HTTP | No | 4.1 | Network | Low | Low | Required | Changed | Low | None | None | 8.59, 8.60, 8.61 |
This Critical Patch Update contains 5 new security patches for Oracle Retail Applications. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-21136 | Oracle Retail Xstore Office | Security | HTTP | Yes | 8.6 | Network | Low | None | None | Changed | High | None | None | 19.0.5, 20.0.3, 20.0.4, 22.0.0, 23.0.1 | |
CVE-2024-22262 | Oracle Retail Assortment Planning | Application Core (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 15.0.3, 16.0.3 | |
CVE-2024-22262 | Oracle Retail Financial Integration | PeopleSoft Integration Bugs (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | |
CVE-2024-22262 | Oracle Retail Integration Bus | RIB Kernal (Spring Framework) | HTTP | Yes | 8.1 | Network | Low | None | Required | Un- changed | High | High | None | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | |
CVE-2024-26308 | Oracle Retail Predictive Application Server | RPAS Fusion Client (Apache Commons Compress) | None | No | 5.5 | Local | Low | None | Required | Un- changed | None | None | High | 15.0.3, 16.0.3 |
This Critical Patch Update contains 12 new security patches for Oracle Siebel CRM. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2022-37434 | Siebel CRM Deployment | Repository Utilities (zlib) | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed | High | High | High | 24.6 and prior | |
CVE-2023-5764 | Siebel CRM Cloud Applications | Siebel Cloud Manager (Ansible) | None | No | 7.8 | Local | Low | Low | None | Un- changed | High | High | High | 24.3 and prior | |
CVE-2023-47627 | Siebel CRM Cloud Applications | Siebel Cloud Manager (AIOHTTP) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 24.1 and prior | |
CVE-2023-41105 | Siebel CRM Cloud Applications | Siebel Cloud Manager (Python) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 23.11 and prior | |
CVE-2021-36090 | Siebel CRM Deployment | Installation (Apache Commons Compress) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 22.3 and prior | |
CVE-2022-42003 | Siebel CRM Deployment | Installation (jackson-databind) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 24.4 and prior | |
CVE-2022-34169 | Siebel CRM Deployment | Server Infrastructure (Apache Xalan-Java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 22.12 and prior | |
CVE-2023-46589 | Siebel CRM End User | EAI, UI (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 24.2 and prior | |
CVE-2023-5072 | Siebel CRM Integration | EAI (JSON-java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 23.12 and prior | |
CVE-2023-22081 | Siebel CRM Deployment | Installation (Oracle Java SE) | HTTPS | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 24.6 and prior | |
CVE-2023-5678 | Siebel CRM Deployment | Server Infrastructure (OpenSSL) | HTTPS | Yes | 5.3 | Network | Low | None | None | Un- changed | None | None | Low | 24.2 and prior | |
CVE-2023-33201 | Siebel CRM Integration | AI (Bouncy Castle Java Library) | HTTPS | Yes | 5.3 | Network | Low | None | None | Un- changed | Low | None | None | 24.4 and prior |
This Critical Patch Update contains 7 new security patches for Oracle Supply Chain. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-37536 | Oracle Agile Engineering Data Management | Core (Apache Xerces-C++) | HTTP | No | 8.8 | Network | Low | Low | None | Un- changed | High | High | High | 6.2.1.0-6.2.1.9 | |
CVE-2023-37536 | Oracle Autovue for Agile Product Lifecycle Management | Installation (Apache Xerces-C++) | HTTP | No | 8.8 | Network | Low | Low | None | Un- changed | High | High | High | 21.0.2 | |
CVE-2022-34169 | Oracle Agile Engineering Data Management | Core (Apache Xalan-Java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 6.2.1.0-6.2.1.7 | |
CVE-2023-24998 | Oracle Agile Engineering Data Management | File Upload (Apache Commons FileUpload) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 6.2.1.0-6.2.1.9 | |
CVE-2023-46589 | Oracle Agile Engineering Data Management | Installation (Apache Tomcat) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 6.2.1.0-6.2.1.9 | |
CVE-2022-34169 | Oracle Autovue for Agile Product Lifecycle Management | Installation (Apache Xalan-Java) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | High | None | 21.0.2 | |
CVE-2023-44487 | Oracle Autovue for Agile Product Lifecycle Management | Core (Eclipse Jetty) | HTTP/2 | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 21.0.2 |
This Critical Patch Update contains 2 new security patches for Oracle Systems. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-21155 | Oracle ZFS Storage Appliance Kit | User Interface | HTTP | Yes | 4.7 | Network | Low | None | Required | Changed | Low | None | None | 8.8 | |
CVE-2024-21151 | Oracle Solaris | Filesystem | None | No | 3.3 | Local | Low | Low | None | Un- changed | None | None | Low | 11 |
This Critical Patch Update contains 2 new security patches for Oracle Utilities Applications. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2023-52428 | Oracle Utilities Application Framework | General (Nimbus JOSE+JWT) | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1-4.5.0.1.3, 24.1.0.0.0, 24.2.0.0.0 | |
CVE-2024-29857 | Oracle Utilities Application Framework | General (Bouncy Castle Java Library) | HTTPS | Yes | 7.5 | Network | Low | None | None | Un- changed | None | None | High | 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1-4.5.0.1.3, 24.1.0.0.0, 24.2.0.0.0 |
This Critical Patch Update contains 3 new security patches for Oracle Virtualization. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.
CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | CVSS VERSION 3.1 RISK (see ) | Supported Versions Affected | Notes | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confid- entiality | Inte- grity | Avail- ability | |||||||
CVE-2024-21141 | Oracle VM VirtualBox | Core | None | No | 8.2 | Local | Low | High | None | Changed | High | High | High | Prior to 7.0.20 | |
CVE-2024-21161 | Oracle VM VirtualBox | Core | None | No | 5.5 | Local | Low | Low | None | Un- changed | None | None | High | Prior to 7.0.20 | See Note 1 |
CVE-2024-21164 | Oracle VM VirtualBox | Core | None | No | 2.5 | Local | High | High | None | Changed | Low | None | None | Prior to 7.0.20 |
Academic tools.
Critical thinking is a widely accepted educational goal. Its definition is contested, but the competing definitions can be understood as differing conceptions of the same basic concept: careful thinking directed to a goal. Conceptions differ with respect to the scope of such thinking, the type of goal, the criteria and norms for thinking carefully, and the thinking components on which they focus. Its adoption as an educational goal has been recommended on the basis of respect for students’ autonomy and preparing students for success in life and for democratic citizenship. “Critical thinkers” have the dispositions and abilities that lead them to think critically when appropriate. The abilities can be identified directly; the dispositions indirectly, by considering what factors contribute to or impede exercise of the abilities. Standardized tests have been developed to assess the degree to which a person possesses such dispositions and abilities. Educational intervention has been shown experimentally to improve them, particularly when it includes dialogue, anchored instruction, and mentoring. Controversies have arisen over the generalizability of critical thinking across domains, over alleged bias in critical thinking theories and instruction, and over the relationship of critical thinking to other types of thinking.
2.2 dewey’s other examples, 2.3 further examples, 2.4 non-examples, 3. the definition of critical thinking, 4. its value, 5. the process of thinking critically, 6. components of the process, 7. contributory dispositions and abilities, 8.1 initiating dispositions, 8.2 internal dispositions, 9. critical thinking abilities, 10. required knowledge, 11. educational methods, 12.1 the generalizability of critical thinking, 12.2 bias in critical thinking theory and pedagogy, 12.3 relationship of critical thinking to other types of thinking, other internet resources, related entries.
Use of the term ‘critical thinking’ to describe an educational goal goes back to the American philosopher John Dewey (1910), who more commonly called it ‘reflective thinking’. He defined it as
active, persistent and careful consideration of any belief or supposed form of knowledge in the light of the grounds that support it, and the further conclusions to which it tends. (Dewey 1910: 6; 1933: 9)
and identified a habit of such consideration with a scientific attitude of mind. His lengthy quotations of Francis Bacon, John Locke, and John Stuart Mill indicate that he was not the first person to propose development of a scientific attitude of mind as an educational goal.
In the 1930s, many of the schools that participated in the Eight-Year Study of the Progressive Education Association (Aikin 1942) adopted critical thinking as an educational goal, for whose achievement the study’s Evaluation Staff developed tests (Smith, Tyler, & Evaluation Staff 1942). Glaser (1941) showed experimentally that it was possible to improve the critical thinking of high school students. Bloom’s influential taxonomy of cognitive educational objectives (Bloom et al. 1956) incorporated critical thinking abilities. Ennis (1962) proposed 12 aspects of critical thinking as a basis for research on the teaching and evaluation of critical thinking ability.
Since 1980, an annual international conference in California on critical thinking and educational reform has attracted tens of thousands of educators from all levels of education and from many parts of the world. Also since 1980, the state university system in California has required all undergraduate students to take a critical thinking course. Since 1983, the Association for Informal Logic and Critical Thinking has sponsored sessions in conjunction with the divisional meetings of the American Philosophical Association (APA). In 1987, the APA’s Committee on Pre-College Philosophy commissioned a consensus statement on critical thinking for purposes of educational assessment and instruction (Facione 1990a). Researchers have developed standardized tests of critical thinking abilities and dispositions; for details, see the Supplement on Assessment . Educational jurisdictions around the world now include critical thinking in guidelines for curriculum and assessment. Political and business leaders endorse its importance.
For details on this history, see the Supplement on History .
Before considering the definition of critical thinking, it will be helpful to have in mind some examples of critical thinking, as well as some examples of kinds of thinking that would apparently not count as critical thinking.
Dewey (1910: 68–71; 1933: 91–94) takes as paradigms of reflective thinking three class papers of students in which they describe their thinking. The examples range from the everyday to the scientific.
Transit : “The other day, when I was down town on 16th Street, a clock caught my eye. I saw that the hands pointed to 12:20. This suggested that I had an engagement at 124th Street, at one o'clock. I reasoned that as it had taken me an hour to come down on a surface car, I should probably be twenty minutes late if I returned the same way. I might save twenty minutes by a subway express. But was there a station near? If not, I might lose more than twenty minutes in looking for one. Then I thought of the elevated, and I saw there was such a line within two blocks. But where was the station? If it were several blocks above or below the street I was on, I should lose time instead of gaining it. My mind went back to the subway express as quicker than the elevated; furthermore, I remembered that it went nearer than the elevated to the part of 124th Street I wished to reach, so that time would be saved at the end of the journey. I concluded in favor of the subway, and reached my destination by one o’clock.” (Dewey 1910: 68-69; 1933: 91-92)
Ferryboat : “Projecting nearly horizontally from the upper deck of the ferryboat on which I daily cross the river is a long white pole, having a gilded ball at its tip. It suggested a flagpole when I first saw it; its color, shape, and gilded ball agreed with this idea, and these reasons seemed to justify me in this belief. But soon difficulties presented themselves. The pole was nearly horizontal, an unusual position for a flagpole; in the next place, there was no pulley, ring, or cord by which to attach a flag; finally, there were elsewhere on the boat two vertical staffs from which flags were occasionally flown. It seemed probable that the pole was not there for flag-flying.
“I then tried to imagine all possible purposes of the pole, and to consider for which of these it was best suited: (a) Possibly it was an ornament. But as all the ferryboats and even the tugboats carried poles, this hypothesis was rejected. (b) Possibly it was the terminal of a wireless telegraph. But the same considerations made this improbable. Besides, the more natural place for such a terminal would be the highest part of the boat, on top of the pilot house. (c) Its purpose might be to point out the direction in which the boat is moving.
“In support of this conclusion, I discovered that the pole was lower than the pilot house, so that the steersman could easily see it. Moreover, the tip was enough higher than the base, so that, from the pilot's position, it must appear to project far out in front of the boat. Morevoer, the pilot being near the front of the boat, he would need some such guide as to its direction. Tugboats would also need poles for such a purpose. This hypothesis was so much more probable than the others that I accepted it. I formed the conclusion that the pole was set up for the purpose of showing the pilot the direction in which the boat pointed, to enable him to steer correctly.” (Dewey 1910: 69-70; 1933: 92-93)
Bubbles : “In washing tumblers in hot soapsuds and placing them mouth downward on a plate, bubbles appeared on the outside of the mouth of the tumblers and then went inside. Why? The presence of bubbles suggests air, which I note must come from inside the tumbler. I see that the soapy water on the plate prevents escape of the air save as it may be caught in bubbles. But why should air leave the tumbler? There was no substance entering to force it out. It must have expanded. It expands by increase of heat, or by decrease of pressure, or both. Could the air have become heated after the tumbler was taken from the hot suds? Clearly not the air that was already entangled in the water. If heated air was the cause, cold air must have entered in transferring the tumblers from the suds to the plate. I test to see if this supposition is true by taking several more tumblers out. Some I shake so as to make sure of entrapping cold air in them. Some I take out holding mouth downward in order to prevent cold air from entering. Bubbles appear on the outside of every one of the former and on none of the latter. I must be right in my inference. Air from the outside must have been expanded by the heat of the tumbler, which explains the appearance of the bubbles on the outside. But why do they then go inside? Cold contracts. The tumbler cooled and also the air inside it. Tension was removed, and hence bubbles appeared inside. To be sure of this, I test by placing a cup of ice on the tumbler while the bubbles are still forming outside. They soon reverse” (Dewey 1910: 70–71; 1933: 93–94).
Dewey (1910, 1933) sprinkles his book with other examples of critical thinking. We will refer to the following.
Weather : A man on a walk notices that it has suddenly become cool, thinks that it is probably going to rain, looks up and sees a dark cloud obscuring the sun, and quickens his steps (1910: 6–10; 1933: 9–13).
Disorder : A man finds his rooms on his return to them in disorder with his belongings thrown about, thinks at first of burglary as an explanation, then thinks of mischievous children as being an alternative explanation, then looks to see whether valuables are missing, and discovers that they are (1910: 82–83; 1933: 166–168).
Typhoid : A physician diagnosing a patient whose conspicuous symptoms suggest typhoid avoids drawing a conclusion until more data are gathered by questioning the patient and by making tests (1910: 85–86; 1933: 170).
Blur : A moving blur catches our eye in the distance, we ask ourselves whether it is a cloud of whirling dust or a tree moving its branches or a man signaling to us, we think of other traits that should be found on each of those possibilities, and we look and see if those traits are found (1910: 102, 108; 1933: 121, 133).
Suction pump : In thinking about the suction pump, the scientist first notes that it will draw water only to a maximum height of 33 feet at sea level and to a lesser maximum height at higher elevations, selects for attention the differing atmospheric pressure at these elevations, sets up experiments in which the air is removed from a vessel containing water (when suction no longer works) and in which the weight of air at various levels is calculated, compares the results of reasoning about the height to which a given weight of air will allow a suction pump to raise water with the observed maximum height at different elevations, and finally assimilates the suction pump to such apparently different phenomena as the siphon and the rising of a balloon (1910: 150–153; 1933: 195–198).
Diamond : A passenger in a car driving in a diamond lane reserved for vehicles with at least one passenger notices that the diamond marks on the pavement are far apart in some places and close together in others. Why? The driver suggests that the reason may be that the diamond marks are not needed where there is a solid double line separating the diamond line from the adjoining lane, but are needed when there is a dotted single line permitting crossing into the diamond lane. Further observation confirms that the diamonds are close together when a dotted line separates the diamond lane from its neighbour, but otherwise far apart.
Rash : A woman suddenly develops a very itchy red rash on her throat and upper chest. She recently noticed a mark on the back of her right hand, but was not sure whether the mark was a rash or a scrape. She lies down in bed and thinks about what might be causing the rash and what to do about it. About two weeks before, she began taking blood pressure medication that contained a sulfa drug, and the pharmacist had warned her, in view of a previous allergic reaction to a medication containing a sulfa drug, to be on the alert for an allergic reaction; however, she had been taking the medication for two weeks with no such effect. The day before, she began using a new cream on her neck and upper chest; against the new cream as the cause was mark on the back of her hand, which had not been exposed to the cream. She began taking probiotics about a month before. She also recently started new eye drops, but she supposed that manufacturers of eye drops would be careful not to include allergy-causing components in the medication. The rash might be a heat rash, since she recently was sweating profusely from her upper body. Since she is about to go away on a short vacation, where she would not have access to her usual physician, she decides to keep taking the probiotics and using the new eye drops but to discontinue the blood pressure medication and to switch back to the old cream for her neck and upper chest. She forms a plan to consult her regular physician on her return about the blood pressure medication.
Candidate : Although Dewey included no examples of thinking directed at appraising the arguments of others, such thinking has come to be considered a kind of critical thinking. We find an example of such thinking in the performance task on the Collegiate Learning Assessment (CLA+), which its sponsoring organization describes as
a performance-based assessment that provides a measure of an institution’s contribution to the development of critical-thinking and written communication skills of its students. (Council for Aid to Education 2017)
A sample task posted on its website requires the test-taker to write a report for public distribution evaluating a fictional candidate’s policy proposals and their supporting arguments, using supplied background documents, with a recommendation on whether to endorse the candidate.
Immediate acceptance of an idea that suggests itself as a solution to a problem (e.g., a possible explanation of an event or phenomenon, an action that seems likely to produce a desired result) is “uncritical thinking, the minimum of reflection” (Dewey 1910: 13). On-going suspension of judgment in the light of doubt about a possible solution is not critical thinking (Dewey 1910: 108). Critique driven by a dogmatically held political or religious ideology is not critical thinking; thus Paulo Freire (1968 [1970]) is using the term (e.g., at 1970: 71, 81, 100, 146) in a more politically freighted sense that includes not only reflection but also revolutionary action against oppression. Derivation of a conclusion from given data using an algorithm is not critical thinking.
What is critical thinking? There are many definitions. Ennis (2016) lists 14 philosophically oriented scholarly definitions and three dictionary definitions. Following Rawls (1971), who distinguished his conception of justice from a utilitarian conception but regarded them as rival conceptions of the same concept, Ennis maintains that the 17 definitions are different conceptions of the same concept. Rawls articulated the shared concept of justice as
a characteristic set of principles for assigning basic rights and duties and for determining… the proper distribution of the benefits and burdens of social cooperation. (Rawls 1971: 5)
Bailin et al. (1999b) claim that, if one considers what sorts of thinking an educator would take not to be critical thinking and what sorts to be critical thinking, one can conclude that educators typically understand critical thinking to have at least three features.
One could sum up the core concept that involves these three features by saying that critical thinking is careful goal-directed thinking. This core concept seems to apply to all the examples of critical thinking described in the previous section. As for the non-examples, their exclusion depends on construing careful thinking as excluding jumping immediately to conclusions, suspending judgment no matter how strong the evidence, reasoning from an unquestioned ideological or religious perspective, and routinely using an algorithm to answer a question.
If the core of critical thinking is careful goal-directed thinking, conceptions of it can vary according to its presumed scope, its presumed goal, one’s criteria and threshold for being careful, and the thinking component on which one focuses As to its scope, some conceptions (e.g., Dewey 1910, 1933) restrict it to constructive thinking on the basis of one’s own observations and experiments, others (e.g., Ennis 1962; Fisher & Scriven 1997; Johnson 1992) to appraisal of the products of such thinking. Ennis (1991) and Bailin et al. (1999b) take it to cover both construction and appraisal. As to its goal, some conceptions restrict it to forming a judgment (Dewey 1910, 1933; Lipman 1987; Facione 1990a). Others allow for actions as well as beliefs as the end point of a process of critical thinking (Ennis 1991; Bailin et al. 1999b). As to the criteria and threshold for being careful, definitions vary in the term used to indicate that critical thinking satisfies certain norms: “intellectually disciplined” (Scriven & Paul 1987), “reasonable” (Ennis 1991), “skillful” (Lipman 1987), “skilled” (Fisher & Scriven 1997), “careful” (Bailin & Battersby 2009). Some definitions specify these norms, referring variously to “consideration of any belief or supposed form of knowledge in the light of the grounds that support it and the further conclusions to which it tends” (Dewey 1910, 1933); “the methods of logical inquiry and reasoning” (Glaser 1941); “conceptualizing, applying, analyzing, synthesizing, and/or evaluating information gathered from, or generated by, observation, experience, reflection, reasoning, or communication” (Scriven & Paul 1987); the requirement that “it is sensitive to context, relies on criteria, and is self-correcting” (Lipman 1987); “evidential, conceptual, methodological, criteriological, or contextual considerations” (Facione 1990a); and “plus-minus considerations of the product in terms of appropriate standards (or criteria)” (Johnson 1992). Stanovich and Stanovich (2010) propose to ground the concept of critical thinking in the concept of rationality, which they understand as combining epistemic rationality (fitting one’s beliefs to the world) and instrumental rationality (optimizing goal fulfillment); a critical thinker, in their view, is someone with “a propensity to override suboptimal responses from the autonomous mind” (2010: 227). These variant specifications of norms for critical thinking are not necessarily incompatible with one another, and in any case presuppose the core notion of thinking carefully. As to the thinking component singled out, some definitions focus on suspension of judgment during the thinking (Dewey 1910; McPeck 1981), others on inquiry while judgment is suspended (Bailin & Battersby 2009), others on the resulting judgment (Facione 1990a), and still others on the subsequent emotive response (Siegel 1988).
In educational contexts, a definition of critical thinking is a “programmatic definition” (Scheffler 1960: 19). It expresses a practical program for achieving an educational goal. For this purpose, a one-sentence formulaic definition is much less useful than articulation of a critical thinking process, with criteria and standards for the kinds of thinking that the process may involve. The real educational goal is recognition, adoption and implementation by students of those criteria and standards. That adoption and implementation in turn consists in acquiring the knowledge, abilities and dispositions of a critical thinker.
Conceptions of critical thinking generally do not include moral integrity as part of the concept. Dewey, for example, took critical thinking to be the ultimate intellectual goal of education, but distinguished it from the development of social cooperation among school children, which he took to be the central moral goal. Ennis (1996, 2011) added to his previous list of critical thinking dispositions a group of dispositions to care about the dignity and worth of every person, which he described as a “correlative” (1996) disposition without which critical thinking would be less valuable and perhaps harmful. An educational program that aimed at developing critical thinking but not the correlative disposition to care about the dignity and worth of every person, he asserted, “would be deficient and perhaps dangerous” (Ennis 1996: 172).
Dewey thought that education for reflective thinking would be of value to both the individual and society; recognition in educational practice of the kinship to the scientific attitude of children’s native curiosity, fertile imagination and love of experimental inquiry “would make for individual happiness and the reduction of social waste” (Dewey 1910: iii). Schools participating in the Eight-Year Study took development of the habit of reflective thinking and skill in solving problems as a means to leading young people to understand, appreciate and live the democratic way of life characteristic of the United States (Aikin 1942: 17–18, 81). Harvey Siegel (1988: 55–61) has offered four considerations in support of adopting critical thinking as an educational ideal. (1) Respect for persons requires that schools and teachers honour students’ demands for reasons and explanations, deal with students honestly, and recognize the need to confront students’ independent judgment; these requirements concern the manner in which teachers treat students. (2) Education has the task of preparing children to be successful adults, a task that requires development of their self-sufficiency. (3) Education should initiate children into the rational traditions in such fields as history, science and mathematics. (4) Education should prepare children to become democratic citizens, which requires reasoned procedures and critical talents and attitudes. To supplement these considerations, Siegel (1988: 62–90) responds to two objections: the ideology objection that adoption of any educational ideal requires a prior ideological commitment and the indoctrination objection that cultivation of critical thinking cannot escape being a form of indoctrination.
Despite the diversity of our 11 examples, one can recognize a common pattern. Dewey analyzed it as consisting of five phases:
The process of reflective thinking consisting of these phases would be preceded by a perplexed, troubled or confused situation and followed by a cleared-up, unified, resolved situation (Dewey 1933: 106). The term ‘phases’ replaced the term ‘steps’ (Dewey 1910: 72), thus removing the earlier suggestion of an invariant sequence. Variants of the above analysis appeared in (Dewey 1916: 177) and (Dewey 1938: 101–119).
The variant formulations indicate the difficulty of giving a single logical analysis of such a varied process. The process of critical thinking may have a spiral pattern, with the problem being redefined in the light of obstacles to solving it as originally formulated. For example, the person in Transit might have concluded that getting to the appointment at the scheduled time was impossible and have reformulated the problem as that of rescheduling the appointment for a mutually convenient time. Further, defining a problem does not always follow after or lead immediately to an idea of a suggested solution. Nor should it do so, as Dewey himself recognized in describing the physician in Typhoid as avoiding any strong preference for this or that conclusion before getting further information (Dewey 1910: 85; 1933: 170). People with a hypothesis in mind, even one to which they have a very weak commitment, have a so-called “confirmation bias” (Nickerson 1998): they are likely to pay attention to evidence that confirms the hypothesis and to ignore evidence that counts against it or for some competing hypothesis. Detectives, intelligence agencies, and investigators of airplane accidents are well advised to gather relevant evidence systematically and to postpone even tentative adoption of an explanatory hypothesis until the collected evidence rules out with the appropriate degree of certainty all but one explanation. Dewey’s analysis of the critical thinking process can be faulted as well for requiring acceptance or rejection of a possible solution to a defined problem, with no allowance for deciding in the light of the available evidence to suspend judgment. Further, given the great variety of kinds of problems for which reflection is appropriate, there is likely to be variation in its component events. Perhaps the best way to conceptualize the critical thinking process is as a checklist whose component events can occur in a variety of orders, selectively, and more than once. These component events might include (1) noticing a difficulty, (2) defining the problem, (3) dividing the problem into manageable sub-problems, (4) formulating a variety of possible solutions to the problem or sub-problem, (5) determining what evidence is relevant to deciding among possible solutions to the problem or sub-problem, (6) devising a plan of systematic observation or experiment that will uncover the relevant evidence, (7) carrying out the plan of systematic observation or experimentation, (8) noting the results of the systematic observation or experiment, (9) gathering relevant testimony and information from others, (10) judging the credibility of testimony and information gathered from others, (11) drawing conclusions from gathered evidence and accepted testimony, and (12) accepting a solution that the evidence adequately supports (cf. Hitchcock 2017: 485).
Checklist conceptions of the process of critical thinking are open to the objection that they are too mechanical and procedural to fit the multi-dimensional and emotionally charged issues for which critical thinking is urgently needed (Paul 1984). For such issues, a more dialectical process is advocated, in which competing relevant world views are identified, their implications explored, and some sort of creative synthesis attempted.
If one considers the critical thinking process illustrated by the 11 examples, one can identify distinct kinds of mental acts and mental states that form part of it. To distinguish, label and briefly characterize these components is a useful preliminary to identifying abilities, skills, dispositions, attitudes, habits and the like that contribute causally to thinking critically. Identifying such abilities and habits is in turn a useful preliminary to setting educational goals. Setting the goals is in its turn a useful preliminary to designing strategies for helping learners to achieve the goals and to designing ways of measuring the extent to which learners have done so. Such measures provide both feedback to learners on their achievement and a basis for experimental research on the effectiveness of various strategies for educating people to think critically. Let us begin, then, by distinguishing the kinds of mental acts and mental events that can occur in a critical thinking process.
By definition, a person who does something voluntarily is both willing and able to do that thing at that time. Both the willingness and the ability contribute causally to the person’s action, in the sense that the voluntary action would not occur if either (or both) of these were lacking. For example, suppose that one is standing with one’s arms at one’s sides and one voluntarily lifts one’s right arm to an extended horizontal position. One would not do so if one were unable to lift one’s arm, if for example one’s right side was paralyzed as the result of a stroke. Nor would one do so if one were unwilling to lift one’s arm, if for example one were participating in a street demonstration at which a white supremacist was urging the crowd to lift their right arm in a Nazi salute and one were unwilling to express support in this way for the racist Nazi ideology. The same analysis applies to a voluntary mental process of thinking critically. It requires both willingness and ability to think critically, including willingness and ability to perform each of the mental acts that compose the process and to coordinate those acts in a sequence that is directed at resolving the initiating perplexity.
Consider willingness first. We can identify causal contributors to willingness to think critically by considering factors that would cause a person who was able to think critically about an issue nevertheless not to do so (Hamby 2014). For each factor, the opposite condition thus contributes causally to willingness to think critically on a particular occasion. For example, people who habitually jump to conclusions without considering alternatives will not think critically about issues that arise, even if they have the required abilities. The contrary condition of willingness to suspend judgment is thus a causal contributor to thinking critically.
Now consider ability. In contrast to the ability to move one’s arm, which can be completely absent because a stroke has left the arm paralyzed, the ability to think critically is a developed ability, whose absence is not a complete absence of ability to think but absence of ability to think well. We can identify the ability to think well directly, in terms of the norms and standards for good thinking. In general, to be able do well the thinking activities that can be components of a critical thinking process, one needs to know the concepts and principles that characterize their good performance, to recognize in particular cases that the concepts and principles apply, and to apply them. The knowledge, recognition and application may be procedural rather than declarative. It may be domain-specific rather than widely applicable, and in either case may need subject-matter knowledge, sometimes of a deep kind.
Reflections of the sort illustrated by the previous two paragraphs have led scholars to identify the knowledge, abilities and dispositions of a “critical thinker”, i.e., someone who thinks critically whenever it is appropriate to do so. We turn now to these three types of causal contributors to thinking critically. We start with dispositions, since arguably these are the most powerful contributors to being a critical thinker, can be fostered at an early stage of a child’s development, and are susceptible to general improvement (Glaser 1941: 175)
Educational researchers use the term ‘dispositions’ broadly for the habits of mind and attitudes that contribute causally to being a critical thinker. Some writers (e.g., Paul & Elder 2006; Hamby 2014; Bailin & Battersby 2016) propose to use the term ‘virtues’ for this dimension of a critical thinker. The virtues in question, although they are virtues of character, concern the person’s ways of thinking rather than the person’s ways of behaving towards others. They are not moral virtues but intellectual virtues, of the sort articulated by Zagzebski (1996) and discussed by Turri, Alfano, and Greco (2017).
On a realistic conception, thinking dispositions or intellectual virtues are real properties of thinkers. They are general tendencies, propensities, or inclinations to think in particular ways in particular circumstances, and can be genuinely explanatory (Siegel 1999). Sceptics argue that there is no evidence for a specific mental basis for the habits of mind that contribute to thinking critically, and that it is pedagogically misleading to posit such a basis (Bailin et al. 1999a). Whatever their status, critical thinking dispositions need motivation for their initial formation in a child—motivation that may be external or internal. As children develop, the force of habit will gradually become important in sustaining the disposition (Nieto & Valenzuela 2012). Mere force of habit, however, is unlikely to sustain critical thinking dispositions. Critical thinkers must value and enjoy using their knowledge and abilities to think things through for themselves. They must be committed to, and lovers of, inquiry.
A person may have a critical thinking disposition with respect to only some kinds of issues. For example, one could be open-minded about scientific issues but not about religious issues. Similarly, one could be confident in one’s ability to reason about the theological implications of the existence of evil in the world but not in one’s ability to reason about the best design for a guided ballistic missile.
Critical thinking dispositions can usefully be divided into initiating dispositions (those that contribute causally to starting to think critically about an issue) and internal dispositions (those that contribute causally to doing a good job of thinking critically once one has started) (Facione 1990a: 25). The two categories are not mutually exclusive. For example, open-mindedness, in the sense of willingness to consider alternative points of view to one’s own, is both an initiating and an internal disposition.
Using the strategy of considering factors that would block people with the ability to think critically from doing so, we can identify as initiating dispositions for thinking critically attentiveness, a habit of inquiry, self-confidence, courage, open-mindedness, willingness to suspend judgment, trust in reason, wanting evidence for one’s beliefs, and seeking the truth. We consider briefly what each of these dispositions amounts to, in each case citing sources that acknowledge them.
Some of the initiating dispositions, such as open-mindedness and willingness to suspend judgment, are also internal critical thinking dispositions, in the sense of mental habits or attitudes that contribute causally to doing a good job of critical thinking once one starts the process. But there are many other internal critical thinking dispositions. Some of them are parasitic on one’s conception of good thinking. For example, it is constitutive of good thinking about an issue to formulate the issue clearly and to maintain focus on it. For this purpose, one needs not only the corresponding ability but also the corresponding disposition. Ennis (1991: 8) describes it as the disposition “to determine and maintain focus on the conclusion or question”, Facione (1990a: 25) as “clarity in stating the question or concern”. Other internal dispositions are motivators to continue or adjust the critical thinking process, such as willingness to persist in a complex task and willingness to abandon nonproductive strategies in an attempt to self-correct (Halpern 1998: 452). For a list of identified internal critical thinking dispositions, see the Supplement on Internal Critical Thinking Dispositions .
Some theorists postulate skills, i.e., acquired abilities, as operative in critical thinking. It is not obvious, however, that a good mental act is the exercise of a generic acquired skill. Inferring an expected time of arrival, as in Transit , has some generic components but also uses non-generic subject-matter knowledge. Bailin et al. (1999a) argue against viewing critical thinking skills as generic and discrete, on the ground that skilled performance at a critical thinking task cannot be separated from knowledge of concepts and from domain-specific principles of good thinking. Talk of skills, they concede, is unproblematic if it means merely that a person with critical thinking skills is capable of intelligent performance.
Despite such scepticism, theorists of critical thinking have listed as general contributors to critical thinking what they variously call abilities (Glaser 1941; Ennis 1962, 1991), skills (Facione 1990a; Halpern 1998) or competencies (Fisher & Scriven 1997). Amalgamating these lists would produce a confusing and chaotic cornucopia of more than 50 possible educational objectives, with only partial overlap among them. It makes sense instead to try to understand the reasons for the multiplicity and diversity, and to make a selection according to one’s own reasons for singling out abilities to be developed in a critical thinking curriculum. Two reasons for diversity among lists of critical thinking abilities are the underlying conception of critical thinking and the envisaged educational level. Appraisal-only conceptions, for example, involve a different suite of abilities than constructive-only conceptions. Some lists, such as those in (Glaser 1941), are put forward as educational objectives for secondary school students, whereas others are proposed as objectives for college students (e.g., Facione 1990a).
The abilities described in the remaining paragraphs of this section emerge from reflection on the general abilities needed to do well the thinking activities identified in section 6 as components of the critical thinking process described in section 5 . The derivation of each collection of abilities is accompanied by citation of sources that list such abilities and of standardized tests that claim to test them.
Observational abilities : Careful and accurate observation sometimes requires specialist expertise and practice, as in the case of observing birds and observing accident scenes. However, there are general abilities of noticing what one’s senses are picking up from one’s environment and of being able to articulate clearly and accurately to oneself and others what one has observed. It helps in exercising them to be able to recognize and take into account factors that make one’s observation less trustworthy, such as prior framing of the situation, inadequate time, deficient senses, poor observation conditions, and the like. It helps as well to be skilled at taking steps to make one’s observation more trustworthy, such as moving closer to get a better look, measuring something three times and taking the average, and checking what one thinks one is observing with someone else who is in a good position to observe it. It also helps to be skilled at recognizing respects in which one’s report of one’s observation involves inference rather than direct observation, so that one can then consider whether the inference is justified. These abilities come into play as well when one thinks about whether and with what degree of confidence to accept an observation report, for example in the study of history or in a criminal investigation or in assessing news reports. Observational abilities show up in some lists of critical thinking abilities (Ennis 1962: 90; Facione 1990a: 16; Ennis 1991: 9). There are items testing a person’s ability to judge the credibility of observation reports in the Cornell Critical Thinking Tests, Levels X and Z (Ennis & Millman 1971; Ennis, Millman, & Tomko 1985, 2005). Norris and King (1983, 1985, 1990a, 1990b) is a test of ability to appraise observation reports.
Emotional abilities : The emotions that drive a critical thinking process are perplexity or puzzlement, a wish to resolve it, and satisfaction at achieving the desired resolution. Children experience these emotions at an early age, without being trained to do so. Education that takes critical thinking as a goal needs only to channel these emotions and to make sure not to stifle them. Collaborative critical thinking benefits from ability to recognize one’s own and others’ emotional commitments and reactions.
Questioning abilities : A critical thinking process needs transformation of an inchoate sense of perplexity into a clear question. Formulating a question well requires not building in questionable assumptions, not prejudging the issue, and using language that in context is unambiguous and precise enough (Ennis 1962: 97; 1991: 9).
Imaginative abilities : Thinking directed at finding the correct causal explanation of a general phenomenon or particular event requires an ability to imagine possible explanations. Thinking about what policy or plan of action to adopt requires generation of options and consideration of possible consequences of each option. Domain knowledge is required for such creative activity, but a general ability to imagine alternatives is helpful and can be nurtured so as to become easier, quicker, more extensive, and deeper (Dewey 1910: 34–39; 1933: 40–47). Facione (1990a) and Halpern (1998) include the ability to imagine alternatives as a critical thinking ability.
Inferential abilities : The ability to draw conclusions from given information, and to recognize with what degree of certainty one’s own or others’ conclusions follow, is universally recognized as a general critical thinking ability. All 11 examples in section 2 of this article include inferences, some from hypotheses or options (as in Transit , Ferryboat and Disorder ), others from something observed (as in Weather and Rash ). None of these inferences is formally valid. Rather, they are licensed by general, sometimes qualified substantive rules of inference (Toulmin 1958) that rest on domain knowledge—that a bus trip takes about the same time in each direction, that the terminal of a wireless telegraph would be located on the highest possible place, that sudden cooling is often followed by rain, that an allergic reaction to a sulfa drug generally shows up soon after one starts taking it. It is a matter of controversy to what extent the specialized ability to deduce conclusions from premisses using formal rules of inference is needed for critical thinking. Dewey (1933) locates logical forms in setting out the products of reflection rather than in the process of reflection. Ennis (1981a), on the other hand, maintains that a liberally-educated person should have the following abilities: to translate natural-language statements into statements using the standard logical operators, to use appropriately the language of necessary and sufficient conditions, to deal with argument forms and arguments containing symbols, to determine whether in virtue of an argument’s form its conclusion follows necessarily from its premisses, to reason with logically complex propositions, and to apply the rules and procedures of deductive logic. Inferential abilities are recognized as critical thinking abilities by Glaser (1941: 6), Facione (1990a: 9), Ennis (1991: 9), Fisher & Scriven (1997: 99, 111), and Halpern (1998: 452). Items testing inferential abilities constitute two of the five subtests of the Watson Glaser Critical Thinking Appraisal (Watson & Glaser 1980a, 1980b, 1994), two of the four sections in the Cornell Critical Thinking Test Level X (Ennis & Millman 1971; Ennis, Millman, & Tomko 1985, 2005), three of the seven sections in the Cornell Critical Thinking Test Level Z (Ennis & Millman 1971; Ennis, Millman, & Tomko 1985, 2005), 11 of the 34 items on Forms A and B of the California Critical Thinking Skills Test (Facione 1990b, 1992), and a high but variable proportion of the 25 selected-response questions in the Collegiate Learning Assessment (Council for Aid to Education 2017).
Experimenting abilities : Knowing how to design and execute an experiment is important not just in scientific research but also in everyday life, as in Rash . Dewey devoted a whole chapter of his How We Think (1910: 145–156; 1933: 190–202) to the superiority of experimentation over observation in advancing knowledge. Experimenting abilities come into play at one remove in appraising reports of scientific studies. Skill in designing and executing experiments includes the acknowledged abilities to appraise evidence (Glaser 1941: 6), to carry out experiments and to apply appropriate statistical inference techniques (Facione 1990a: 9), to judge inductions to an explanatory hypothesis (Ennis 1991: 9), and to recognize the need for an adequately large sample size (Halpern 1998). The Cornell Critical Thinking Test Level Z (Ennis & Millman 1971; Ennis, Millman, & Tomko 1985, 2005) includes four items (out of 52) on experimental design. The Collegiate Learning Assessment (Council for Aid to Education 2017) makes room for appraisal of study design in both its performance task and its selected-response questions.
Consulting abilities : Skill at consulting sources of information comes into play when one seeks information to help resolve a problem, as in Candidate . Ability to find and appraise information includes ability to gather and marshal pertinent information (Glaser 1941: 6), to judge whether a statement made by an alleged authority is acceptable (Ennis 1962: 84), to plan a search for desired information (Facione 1990a: 9), and to judge the credibility of a source (Ennis 1991: 9). Ability to judge the credibility of statements is tested by 24 items (out of 76) in the Cornell Critical Thinking Test Level X (Ennis & Millman 1971; Ennis, Millman, & Tomko 1985, 2005) and by four items (out of 52) in the Cornell Critical Thinking Test Level Z (Ennis & Millman 1971; Ennis, Millman, & Tomko 1985, 2005). The College Learning Assessment’s performance task requires evaluation of whether information in documents is credible or unreliable (Council for Aid to Education 2017).
Argument analysis abilities : The ability to identify and analyze arguments contributes to the process of surveying arguments on an issue in order to form one’s own reasoned judgment, as in Candidate . The ability to detect and analyze arguments is recognized as a critical thinking skill by Facione (1990a: 7–8), Ennis (1991: 9) and Halpern (1998). Five items (out of 34) on the California Critical Thinking Skills Test (Facione 1990b, 1992) test skill at argument analysis. The College Learning Assessment (Council for Aid to Education 2017) incorporates argument analysis in its selected-response tests of critical reading and evaluation and of critiquing an argument.
Judging skills and deciding skills : Skill at judging and deciding is skill at recognizing what judgment or decision the available evidence and argument supports, and with what degree of confidence. It is thus a component of the inferential skills already discussed.
Lists and tests of critical thinking abilities often include two more abilities: identifying assumptions and constructing and evaluating definitions.
In addition to dispositions and abilities, critical thinking needs knowledge: of critical thinking concepts, of critical thinking principles, and of the subject-matter of the thinking.
We can derive a short list of concepts whose understanding contributes to critical thinking from the critical thinking abilities described in the preceding section. Observational abilities require an understanding of the difference between observation and inference. Questioning abilities require an understanding of the concepts of ambiguity and vagueness. Inferential abilities require an understanding of the difference between conclusive and defeasible inference (traditionally, between deduction and induction), as well as of the difference between necessary and sufficient conditions. Experimenting abilities require an understanding of the concepts of hypothesis, null hypothesis, assumption and prediction, as well as of the concept of statistical significance and of its difference from importance. They also require an understanding of the difference between an experiment and an observational study, and in particular of the difference between a randomized controlled trial, a prospective correlational study and a retrospective (case-control) study. Argument analysis abilities require an understanding of the concepts of argument, premiss, assumption, conclusion and counter-consideration. Additional critical thinking concepts are proposed by Bailin et al. (1999b: 293), Fisher & Scriven (1997: 105–106), and Black (2012).
According to Glaser (1941: 25), ability to think critically requires knowledge of the methods of logical inquiry and reasoning. If we review the list of abilities in the preceding section, however, we can see that some of them can be acquired and exercised merely through practice, possibly guided in an educational setting, followed by feedback. Searching intelligently for a causal explanation of some phenomenon or event requires that one consider a full range of possible causal contributors, but it seems more important that one implements this principle in one’s practice than that one is able to articulate it. What is important is “operational knowledge” of the standards and principles of good thinking (Bailin et al. 1999b: 291–293). But the development of such critical thinking abilities as designing an experiment or constructing an operational definition can benefit from learning their underlying theory. Further, explicit knowledge of quirks of human thinking seems useful as a cautionary guide. Human memory is not just fallible about details, as people learn from their own experiences of misremembering, but is so malleable that a detailed, clear and vivid recollection of an event can be a total fabrication (Loftus 2017). People seek or interpret evidence in ways that are partial to their existing beliefs and expectations, often unconscious of their “confirmation bias” (Nickerson 1998). Not only are people subject to this and other cognitive biases (Kahneman 2011), of which they are typically unaware, but it may be counter-productive for one to make oneself aware of them and try consciously to counteract them or to counteract social biases such as racial or sexual stereotypes (Kenyon & Beaulac 2014). It is helpful to be aware of these facts and of the superior effectiveness of blocking the operation of biases—for example, by making an immediate record of one’s observations, refraining from forming a preliminary explanatory hypothesis, blind refereeing, double-blind randomized trials, and blind grading of students’ work.
Critical thinking about an issue requires substantive knowledge of the domain to which the issue belongs. Critical thinking abilities are not a magic elixir that can be applied to any issue whatever by somebody who has no knowledge of the facts relevant to exploring that issue. For example, the student in Bubbles needed to know that gases do not penetrate solid objects like a glass, that air expands when heated, that the volume of an enclosed gas varies directly with its temperature and inversely with its pressure, and that hot objects will spontaneously cool down to the ambient temperature of their surroundings unless kept hot by insulation or a source of heat. Critical thinkers thus need a rich fund of subject-matter knowledge relevant to the variety of situations they encounter. This fact is recognized in the inclusion among critical thinking dispositions of a concern to become and remain generally well informed.
Experimental educational interventions, with control groups, have shown that education can improve critical thinking skills and dispositions, as measured by standardized tests. For information about these tests, see the Supplement on Assessment .
What educational methods are most effective at developing the dispositions, abilities and knowledge of a critical thinker? Abrami et al. (2015) found that in the experimental and quasi-experimental studies that they analyzed dialogue, anchored instruction, and mentoring each increased the effectiveness of the educational intervention, and that they were most effective when combined. They also found that in these studies a combination of separate instruction in critical thinking with subject-matter instruction in which students are encouraged to think critically was more effective than either by itself. However, the difference was not statistically significant; that is, it might have arisen by chance.
Most of these studies lack the longitudinal follow-up required to determine whether the observed differential improvements in critical thinking abilities or dispositions continue over time, for example until high school or college graduation. For details on studies of methods of developing critical thinking skills and dispositions, see the Supplement on Educational Methods .
Scholars have denied the generalizability of critical thinking abilities across subject domains, have alleged bias in critical thinking theory and pedagogy, and have investigated the relationship of critical thinking to other kinds of thinking.
McPeck (1981) attacked the thinking skills movement of the 1970s, including the critical thinking movement. He argued that there are no general thinking skills, since thinking is always thinking about some subject-matter. It is futile, he claimed, for schools and colleges to teach thinking as if it were a separate subject. Rather, teachers should lead their pupils to become autonomous thinkers by teaching school subjects in a way that brings out their cognitive structure and that encourages and rewards discussion and argument. As some of his critics (e.g., Paul 1985; Siegel 1985) pointed out, McPeck’s central argument needs elaboration, since it has obvious counter-examples in writing and speaking, for which (up to a certain level of complexity) there are teachable general abilities even though they are always about some subject-matter. To make his argument convincing, McPeck needs to explain how thinking differs from writing and speaking in a way that does not permit useful abstraction of its components from the subject-matters with which it deals. He has not done so. Nevertheless, his position that the dispositions and abilities of a critical thinker are best developed in the context of subject-matter instruction is shared by many theorists of critical thinking, including Dewey (1910, 1933), Glaser (1941), Passmore (1980), Weinstein (1990), and Bailin et al. (1999b).
McPeck’s challenge prompted reflection on the extent to which critical thinking is subject-specific. McPeck argued for a strong subject-specificity thesis, according to which it is a conceptual truth that all critical thinking abilities are specific to a subject. (He did not however extend his subject-specificity thesis to critical thinking dispositions. In particular, he took the disposition to suspend judgment in situations of cognitive dissonance to be a general disposition.) Conceptual subject-specificity is subject to obvious counter-examples, such as the general ability to recognize confusion of necessary and sufficient conditions. A more modest thesis, also endorsed by McPeck, is epistemological subject-specificity, according to which the norms of good thinking vary from one field to another. Epistemological subject-specificity clearly holds to a certain extent; for example, the principles in accordance with which one solves a differential equation are quite different from the principles in accordance with which one determines whether a painting is a genuine Picasso. But the thesis suffers, as Ennis (1989) points out, from vagueness of the concept of a field or subject and from the obvious existence of inter-field principles, however broadly the concept of a field is construed. For example, the principles of hypothetico-deductive reasoning hold for all the varied fields in which such reasoning occurs. A third kind of subject-specificity is empirical subject-specificity, according to which as a matter of empirically observable fact a person with the abilities and dispositions of a critical thinker in one area of investigation will not necessarily have them in another area of investigation.
The thesis of empirical subject-specificity raises the general problem of transfer. If critical thinking abilities and dispositions have to be developed independently in each school subject, how are they of any use in dealing with the problems of everyday life and the political and social issues of contemporary society, most of which do not fit into the framework of a traditional school subject? Proponents of empirical subject-specificity tend to argue that transfer is more likely to occur if there is critical thinking instruction in a variety of domains, with explicit attention to dispositions and abilities that cut across domains. But evidence for this claim is scanty. There is a need for well-designed empirical studies that investigate the conditions that make transfer more likely.
It is common ground in debates about the generality or subject-specificity of critical thinking dispositions and abilities that critical thinking about any topic requires background knowledge about the topic. For example, the most sophisticated understanding of the principles of hypothetico-deductive reasoning is of no help unless accompanied by some knowledge of what might be plausible explanations of some phenomenon under investigation.
Critics have objected to bias in the theory, pedagogy and practice of critical thinking. Commentators (e.g., Alston 1995; Ennis 1998) have noted that anyone who takes a position has a bias in the neutral sense of being inclined in one direction rather than others. The critics, however, are objecting to bias in the pejorative sense of an unjustified favoring of certain ways of knowing over others, frequently alleging that the unjustly favoured ways are those of a dominant sex or culture (Bailin 1995). These ways favour:
A common thread in this smorgasbord of accusations is dissatisfaction with focusing on the logical analysis and evaluation of reasoning and arguments. While these authors acknowledge that such analysis and evaluation is part of critical thinking and should be part of its conceptualization and pedagogy, they insist that it is only a part. Paul (1981), for example, bemoans the tendency of atomistic teaching of methods of analyzing and evaluating arguments to turn students into more able sophists, adept at finding fault with positions and arguments with which they disagree but even more entrenched in the egocentric and sociocentric biases with which they began. Martin (1992) and Thayer-Bacon (1992) cite with approval the self-reported intimacy with their subject-matter of leading researchers in biology and medicine, an intimacy that conflicts with the distancing allegedly recommended in standard conceptions and pedagogy of critical thinking. Thayer-Bacon (2000) contrasts the embodied and socially embedded learning of her elementary school students in a Montessori school, who used their imagination, intuition and emotions as well as their reason, with conceptions of critical thinking as
thinking that is used to critique arguments, offer justifications, and make judgments about what are the good reasons, or the right answers. (Thayer-Bacon 2000: 127–128)
Alston (2001) reports that her students in a women’s studies class were able to see the flaws in the Cinderella myth that pervades much romantic fiction but in their own romantic relationships still acted as if all failures were the woman’s fault and still accepted the notions of love at first sight and living happily ever after. Students, she writes, should
be able to connect their intellectual critique to a more affective, somatic, and ethical account of making risky choices that have sexist, racist, classist, familial, sexual, or other consequences for themselves and those both near and far… critical thinking that reads arguments, texts, or practices merely on the surface without connections to feeling/desiring/doing or action lacks an ethical depth that should infuse the difference between mere cognitive activity and something we want to call critical thinking. (Alston 2001: 34)
Some critics portray such biases as unfair to women. Thayer-Bacon (1992), for example, has charged modern critical thinking theory with being sexist, on the ground that it separates the self from the object and causes one to lose touch with one’s inner voice, and thus stigmatizes women, who (she asserts) link self to object and listen to their inner voice. Her charge does not imply that women as a group are on average less able than men to analyze and evaluate arguments. Facione (1990c) found no difference by sex in performance on his California Critical Thinking Skills Test. Kuhn (1991: 280–281) found no difference by sex in either the disposition or the competence to engage in argumentative thinking.
The critics propose a variety of remedies for the biases that they allege. In general, they do not propose to eliminate or downplay critical thinking as an educational goal. Rather, they propose to conceptualize critical thinking differently and to change its pedagogy accordingly. Their pedagogical proposals arise logically from their objections. They can be summarized as follows:
A common thread in these proposals is treatment of critical thinking as a social, interactive, personally engaged activity like that of a quilting bee or a barn-raising (Thayer-Bacon 2000) rather than as an individual, solitary, distanced activity symbolized by Rodin’s The Thinker . One can get a vivid description of education with the former type of goal from the writings of bell hooks (1994, 2010). Critical thinking for her is open-minded dialectical exchange across opposing standpoints and from multiple perspectives, a conception similar to Paul’s “strong sense” critical thinking (Paul 1981). She abandons the structure of domination in the traditional classroom. In an introductory course on black women writers, for example, she assigns students to write an autobiographical paragraph about an early racial memory, then to read it aloud as the others listen, thus affirming the uniqueness and value of each voice and creating a communal awareness of the diversity of the group’s experiences (hooks 1994: 84). Her “engaged pedagogy” is thus similar to the “freedom under guidance” implemented in John Dewey’s Laboratory School of Chicago in the late 1890s and early 1900s. It incorporates the dialogue, anchored instruction, and mentoring that Abrami (2015) found to be most effective in improving critical thinking skills and dispositions.
What is the relationship of critical thinking to problem solving, decision-making, higher-order thinking, creative thinking, and other recognized types of thinking? One’s answer to this question obviously depends on how one defines the terms used in the question. If critical thinking is conceived broadly to cover any careful thinking about any topic for any purpose, then problem solving and decision making will be kinds of critical thinking, if they are done carefully. Historically, ‘critical thinking’ and ‘problem solving’ were two names for the same thing. If critical thinking is conceived more narrowly as consisting solely of appraisal of intellectual products, then it will be disjoint with problem solving and decision making, which are constructive.
Bloom’s taxonomy of educational objectives used the phrase “intellectual abilities and skills” for what had been labeled “critical thinking” by some, “reflective thinking” by Dewey and others, and “problem solving” by still others (Bloom et al. 1956: 38). Thus, the so-called “higher-order thinking skills” at the taxonomy’s top levels of analysis, synthesis and evaluation are just critical thinking skills, although they do not come with general criteria for their assessment (Ennis 1981b). The revised version of Bloom’s taxonomy (Anderson et al. 2001) likewise treats critical thinking as cutting across those types of cognitive process that involve more than remembering (Anderson et al. 2001: 269–270). For details, see the Supplement on History .
As to creative thinking, it overlaps with critical thinking (Bailin 1987, 1988). Thinking about the explanation of some phenomenon or event, as in Ferryboat , requires creative imagination in constructing plausible explanatory hypotheses. Likewise, thinking about a policy question, as in Candidate , requires creativity in coming up with options. Conversely, creativity in any field needs to be balanced by critical appraisal of the draft painting or novel or mathematical theory.
How to cite this entry . Preview the PDF version of this entry at the Friends of the SEP Society . Look up this entry topic at the Internet Philosophy Ontology Project (InPhO). Enhanced bibliography for this entry at PhilPapers , with links to its database.
abilities | bias, implicit | children, philosophy for | civic education | decision-making capacity | Dewey, John | dispositions | education, philosophy of | epistemology: virtue | logic: informal
Copyright © 2018 by David Hitchcock < hitchckd @ mcmaster . ca >
Mirror sites.
View this site from another server:
The Stanford Encyclopedia of Philosophy is copyright © 2016 by The Metaphysics Research Lab , Center for the Study of Language and Information (CSLI), Stanford University
Library of Congress Catalog Data: ISSN 1095-5054
IMAGES
VIDEO
COMMENTS
EXPLANATION • Stating results • Justifying procedures • Presenting arguments INFERENCE • Finding alternatives • Drawing conclusions • Making recommendations •State your position •Defend your position •Support points with information and evidence •Support points with valid assumptions •Re-state your position •Recognizing that problems have a range of solutions and that
Critical Thinking. Critical thinking is a widely accepted educational goal. Its definition is contested, but the competing definitions can be understood as differing conceptions of the same basic concept: careful thinking directed to a goal. Conceptions differ with respect to the scope of such thinking, the type of goal, the criteria and norms ...
Critical Thinking is the process of using and assessing reasons to evaluate statements, assumptions, and arguments in ordinary situations. The goal of this process is to help us have good beliefs, where "good" means that our beliefs meet certain goals of thought, such as truth, usefulness, or rationality. Critical thinking is widely ...
Critical thinking is, in short, self-directed, self-disciplined, self-monitored, and self-corrective thinking. It presupposes assent to rigorous standards of excellence and mindful command of their use. It entails effective communication and problem solving abilities and a commitment to overcome our native egocentrism and sociocentrism.
Key Takeaways. Researchers propose six levels of critical thinkers: Unreflective thinkers, Challenged thinkers, Beginning thinkers, Practicing thinkers, Advanced thinkers, and Master thinkers. The ...
Critical thinking is the discipline of rigorously and skillfully using information, experience, observation, and reasoning to guide your decisions, actions, and beliefs. You'll need to actively question every step of your thinking process to do it well. Collecting, analyzing and evaluating information is an important skill in life, and a highly ...
Critical thinking is the ability to effectively analyze information and form a judgment. To think critically, you must be aware of your own biases and assumptions when encountering information, and apply consistent standards when evaluating sources. Critical thinking skills help you to: Identify credible sources. Evaluate and respond to arguments.
Critical thinking (CT) is a metacognitive process, consisting of a number of skills and dispositions, that when used through self-regulatory reflective judgment, increases the chances of producing ...
Critical thinking refers to the intellectual process of analyzing, evaluating, and interpreting information and arguments in a systematic and objective manner. It involves the careful examination of facts, evidence, and reasoning to form rational and well-informed judgments. Components: Critical thinking includes several essential components:
Critical thinking is a kind of thinking in which you question, analyse, interpret , evaluate and make a judgement about what you read, hear, say, or write. The term critical comes from the Greek word kritikos meaning "able to judge or discern". Good critical thinking is about making reliable judgements based on reliable information.
Critical thinking is the analysis of available facts, evidence, observations, and arguments in order to form a judgement by the application of rational, skeptical, and unbiased analyses and evaluation. The application of critical thinking includes self-directed, self-disciplined, self-monitored, and self-corrective habits of the mind; thus, a critical thinker is a person who practices the ...
Theorists have noted that such skills are only valuable insofar as a person is inclined to use them. Consequently, they emphasize that certain habits of mind are necessary components of critical thinking. This disposition may include curiosity, open-mindedness, self-awareness, empathy, and persistence. Although there is a generally accepted set of qualities that are associated with critical ...
Critical thinking is crucial for self-reflection. In order to live a meaningful life and to structure our lives accordingly, we need to justify and reflect on our values and decisions. Critical thinking provides the tools for this process of self-evaluation. Good critical thinking is the foundation of science and democracy.
Components Of Critical Thinking. ... If you are taking time to think about the best solution, keep your workforce and leaders apprised of your process and timeline. 7. Communicate your findings ...
Critical thinking refers to the process of actively analyzing, assessing, synthesizing, evaluating and reflecting on information gathered from observation, experience, or communication. It is thinking in a clear, logical, reasoned, and reflective manner to solve problems or make decisions. Basically, critical thinking is taking a hard look at ...
Components of the critical thinking process: Critical thinking is an interconnected p rocess . that includes five interr elated components, as . indicated by (Al-Sayed, 1995), namely: 1.
Critical thinking is the process of independently analyzing, synthesizing, and evaluating information as a guide to behavior and beliefs. The American Philosophical Association has defined critical thinking as "the process of purposeful, self-regulatory judgment. The process gives reasoned consideration to evidence, contexts, conceptualizations ...
Critical thinking is self-directed, self-disciplined, self-monitored, and self-corrective thinking. It presupposes assent to rigorous standards of excellence and mindful command of their use. It entails effective communication and problem-solving abilities, as well as a commitment to overcome our native egocentrism and sociocentrism. To Analyze ...
Critical thinking is the process of making clear reasoned judgements. Elements of critical thinking. There are three elements that aid in critical thinking, and another three that obstruct critical thinking. Logical reasoning: You would not expect an accountant to draw up a balance sheet without the knowledge of the debit/credit system. However ...
6 Components of Critical Thinking. Critical thinking includes specific components such as analysis, interpretation, inference, explanation, and self-regulation. 1. Analysis. This involves examining information in detail in order to understand it better and to draw conclusions. It could be data, a concept, or a process.
Critical thinking skills examples. There are six main skills you can develop to successfully analyze facts and situations and come up with logical conclusions: 1. Analytical thinking. Being able to properly analyze information is the most important aspect of critical thinking. This implies gathering information and interpreting it, but also ...
Critical thinking, as described by Oxford Languages, is the objective analysis and evaluation of an issue in order to form a judgement. Active and skillful approach, evaluation, assessment, synthesis, and/or evaluation of information obtained from, or made by, observation, knowledge, reflection, acumen or conversation, as a guide to belief and action, requires the critical thinking process ...
Visual Thinking Strategies (VTS) is an experiential exercise readily adapted to the management classroom. Through this exercise, instructors use a structured process to help students develop and apply critical thinking skills, with a focus on clearly articulating a concept, explaining their reasoning and use of evidence to inform their claim, interrogating assumptions, and exploring a range of ...
The definition of critical thinking is a disciplined thinking that is clear, rational, open-minded, and informed by evidence. Critical thinking frees us from nonsense. Novelist Ernest Hemingway once said that anyone who wants to be a great writer must have a built-in "crap" detector. That inelegant comment points to a basic truth: As ...
The EU has set targets to mine 10% of its annual needs for critical materials, to recycle 25% and process 40% domestically by the end of the decade.
The group confirmed that regular production should start in early 2025 in La Rochelle, the only facility in Europe able to process light and heavy rare earth materials at an industrial level. Permanent magnets are essential components to power electric vehicles, wind turbines and electronics.
Risk Matrix Content. Risk matrices list only security vulnerabilities that are newly addressed by the patches associated with this advisory. Risk matrices for previous security patches can be found in previous Critical Patch Update advisories and Alerts.An English text version of the risk matrices provided in this document is here. Several vulnerabilities addressed in this Critical Patch ...
Critical thinking is a widely accepted educational goal. Its definition is contested, but the competing definitions can be understood as differing conceptions of the same basic concept: careful thinking directed to a goal. Conceptions differ with respect to the scope of such thinking, the type of goal, the criteria and norms for thinking ...
1. Introduction. Standard-Essential Patents (SEPs) have emerged as critical components in the contemporary technological and industrial landscape (Brachtendorf et al., Citation 2023; Henkel, Citation 2022; Kang & Bekkers, Citation 2015; Kang & Motohashi, Citation 2014).The quintessence of these patents lies in their essentiality to the realisation of specific technological standards (P.-C. Lee ...