CVE Vulnerability Catalog

Vulnerability in MySQL Connectors (component: Connector/Net) versions 9.7.0-9.7.1. It is difficult to exploit, requires low privileges and network access. Attack may affect additional products (scope change) and lead to takeover of MySQL Connectors.

Vulnerability in MySQL Connectors product of Oracle MySQL (component: Connector/Net). Affected versions are 9.7.0 and 9.7.1. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors, potentially leading to a takeover.

Vulnerability in MySQL Connectors (Connector/C++ component) allows an unauthenticated attacker to remotely cause a hang or frequent crash (complete DOS) via multiple protocols. The attack is easily exploitable.

Vulnerability in MySQL Connectors (component: Connector/C++) versions 9.7.0-9.7.1. An unauthenticated attacker with network access via multiple protocols can gain full access to critical data and modify it.

Vulnerability in Oracle Payments (part of Oracle E-Business Suite) allows a low-privileged attacker via HTTP to access critical data and cause partial denial of service.

Vulnerability in the RDBMS component of Oracle Database Server allows a low-privileged attacker (Authenticated User) with network access via Oracle Net to compromise the database. No user interaction is required.

Vulnerability in Oracle Hospitality Simphony (POS component) allows an unauthenticated attacker via HTTP to access all system data. Exploitation is easy.

Vulnerability in Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Affected versions are 19.8-19.8.5, 19.9-19.9.3 and 19.10. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony, potentially leading to a takeover.

Vulnerability in Oracle Hospitality Simphony (POS component) allows an unauthenticated attacker to access critical data via HTTP. The attack does not affect other products.

Vulnerability in MySQL Server and MySQL Cluster (component: Server: Group Replication Plugin) allows an unauthenticated attacker with local access to take over the system. Affects multiple versions of MySQL Server and MySQL Cluster.

Vulnerability in Oracle VM VirtualBox (component: Core). A high-privileged attacker with local access can take over VirtualBox, and the attack may affect other products. CVSS 7.5.

Vulnerability in Oracle GoldenGate (component: Service Manager) allows a low-privileged attacker with network access via HTTP to compromise the system. No user interaction is required.

Vulnerability in Oracle VM VirtualBox (component: Core). A high-privileged attacker with local access can take over VirtualBox, and the attack may affect other products. CVSS 7.5.

A vulnerability in Oracle WebLogic Server (Oracle Fusion Middleware, component: Console) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An easily exploitable flaw allows a high-privileged attacker with network access via HTTPS to take over Oracle WebLogic Server. CVSS 7.2.

Vulnerability in Oracle VM VirtualBox 7.2.12 allows a low-privileged local attacker to take over the virtual machine. The attack is easy to exploit and only requires logon to the system where VirtualBox runs.

Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to modify, read, and partially block data.

In Netty prior to 4.2.16.Final, Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types without limits, trusting the payLoadLength field, allowing an attacker to open multiple QUIC streams and send frames with large payloads, causing memory exhaustion and denial of service.

In Netty up to versions 4.1.135 and 4.2.15, a vulnerability exists in the SpdyHttpDecoder handler. Improper release of a pooled ByteBuf leads to native memory exhaustion.

Netty, a network application framework, contains a vulnerability in the codec-haproxy module in the HAProxyMessageDecoder class. When reading the 13th byte as a signed byte and widening it to int without masking, the value 0xFF is interpreted as -1, causing a collision with the need-more-data sentinel. This leads to unbounded accumulation of data in the cumulation buffer until direct memory is exhausted.

Two bugs in libheif prior to version 1.22.0 chain to leak process heap memory as visible pixel values in decoded grid images. An attacker uploading a crafted AVIF/HEIC file to a server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data, including library function pointers sufficient to defeat ASLR, from publicly downloadable transcoded JPEG/PNG/WebP output.