Oracle · Oracle Supply Chain Products Suite · CVE-2016-3438
**Name of the Vulnerable Software and Affected Versions**
Oracle Supply Chain Products Suite versions 12.0.6 through 12.2
**Description**
The issue affects confidentiality and integrity, and it is related to JRAD Heartbeat. There are claims that this issue involves multiple cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web script or HTML via three unspecified parameters in an unknown JSP file.
**Recommendations**
For Oracle Supply Chain Products Suite versions 12.0.6 through 12.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.