CVE Vulnerability Catalog

Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to critical data, modify it and cause a partial denial of service.

Vulnerability in MySQL Connectors (Connector/Python component) affecting version 26.7.0. An easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized access to critical data or full access to all data accessible through MySQL Connectors.

Vulnerability in Oracle Identity Manager (OIM Legacy UI component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over Oracle Identity Manager.

Vulnerability in Oracle Identity Manager (OIM Legacy UI component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable flaw allows a low-privileged attacker with HTTPS network access to take over Oracle Identity Manager.

Vulnerability in Oracle Data Integrator (Data Transforms component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to critical data, modify it and gain full access to Oracle Data Integrator data.

Vulnerability in Oracle Product Hub (Internal Operations component) affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with HTTP network access to take over Oracle Product Hub, with impact potentially extending beyond this product.

Vulnerability in Oracle Weblogic Server Proxy Plug-in (WebLogic Server Proxy Plug-In for Third-Party Web Servers component) affecting versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access to create, delete or modify critical data and gain full access to it, with impact potentially extending beyond this product.

Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows a low privileged attacker with network access via HTTP to compromise Sourcing.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows an unauthenticated attacker with network access via Oracle Net to modify or delete critical data and gain unauthorized access to it.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to modify or delete critical data and gain unauthorized access to it.

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to compromise the product.

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to modify or delete critical data and gain unauthorized access to it.

A vulnerability in IBM Guardium Data Protection 12.1 and 12.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.

IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.

Vulnerability in the Oracle Solaris product (component: Services) affecting version 11.4. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to compromise Oracle Solaris.

Vulnerability in the Oracle Solaris product (component: Utility) affecting versions 11.3 and 11.4. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Solaris.

In virtualenv from 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the activation template, allowing trigger names such as __VIRTUAL_NAME__ inside an already substituted path to be replaced again. This can lead to command execution when activating the environment via bash, fish, xonsh, or activate_this.py if an attacker influences the destination path or --prompt.

In virtualenv prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can terminate the fish literal and execute command substitution when the user sources activate.fish.

In Moov signedxml prior to 1.4.1, ExclusiveCanonicalization copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML with deeply nested elements and many unused namespace declarations causes quadratic memory allocation growth, allowing a small document to consume gigabytes of memory and terminate the process.

In Bulwark Webmail prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then performs a separate lookup for the connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address, causing the server to return up to 10 MB of an internal HTTP or HTTPS response.