CVE Vulnerability Catalog

Vulnerability in Oracle Utilities Network Management System (component: Mobile) in multiple versions. Easily exploitable, allows an unauthenticated attacker via HTTP to unauthorized update, insert, delete, or read part of the data. May affect other products (scope change).

Vulnerability in Oracle Human Resources (component: Data Removal Tool) versions 12.2.3-12.2.15. Allows a high-privileged attacker with network access via HTTP to take over the system.

Vulnerability in Oracle Retail EFTLink product (Core/Plugin component), versions 21.0.0-25.0.0. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTPS to compromise data confidentiality and integrity, including critical data.

Vulnerability in Oracle Cost Management product (Cost Maintenance component), versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to take over the system.

Difficult to exploit vulnerability in Oracle Public Sector Financials (International) (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A high-privileged attacker via HTTP can take over the system, also affecting other products.

FUXA version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization by script ID, but when test: true is set, it compiles and executes attacker-supplied code instead of the stored script. An unauthenticated attacker who knows a valid script ID and name can execute arbitrary code.

FUXA version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allowing unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.

In FUXA (web-based Process Visualization SCADA/HMI/Dashboard software) versions 1.2.11 through 1.3.1, an unauthenticated remote attacker can achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even in the most secure configuration (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

Vulnerability in Oracle Application Testing Suite version 13.3.0.1. An easily exploitable flaw allows an unauthenticated attacker with network access via TCP to gain full access to all application data.

SourceCodester Class and Exam Timetabling System 1.0 is vulnerable to SQL Injection in the file /edit_subjecta.php via manipulation of the ID argument. The attack can be performed remotely.

A vulnerability in the Bluetooth BR/EDR (Classic) stack of Zephyr RTOS affects L2CAP configuration handlers (l2cap_br_conf_req and l2cap_br_conf_rsp). The minimum command size validation used buf->len (bytes remaining in the whole PDU) instead of len (per-command data length from the L2CAP header). An attacker can send a CONF_REQ command with a header smaller than the configuration-request structure (e.g., 0) followed by another command, causing buf->len to still pass the check. This leads to an underflow of opt_len to near 0xFFFF, resulting in an out-of-bounds read and potential out-of-bounds write when option bytes encode MTU or flush-timeout.

A vulnerability in Zephyr (MCTP-over-I2C+GPIO) allows an attacker to write an arbitrary byte via an uninitialized pointer and a one-byte heap overflow. Lack of validation of write order and receive buffer enables remote memory corruption or system crash.

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.

SSRF vulnerability in mcp-webresearch 0.1.7 allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool. The attack can expose sensitive data, including credentials.

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

SSRF vulnerability in LMDeploy up to version 0.14.0 (fixed in commit 03c3130) in the _load_http_url function in connection.py. The private-IP guard only validates the original URL without re-validating hosts after HTTP redirects.

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes them directly to PHP's 'chmod()' function via 'octdec()' conversion without validation. An authenticated user with 'chmod' permission can escalate privileges to root.

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana allows unauthorized information disclosure and compromise of case attachment integrity. A low-privileged authenticated user can read, modify, and delete case attachments they are not authorized to access, including those related to Security Solution.

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file.

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.