CVE Vulnerability Catalog

A vulnerability has been identified in the Netskope Client for Windows systems that allows a malicious insider with administrative privileges to tamper with the client IOCTL by sending crafted requests to the driver. A successful exploit can lead to bypassing all anti-tampering protections for NSClient.

Metro Magazine by Rara Themes has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

AliNext has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 3.3.5.

CVE-2024-35690 describes a vulnerability where sensitive information can be inserted into sent data in MarketingFire Widget Options, allowing retrieval of embedded sensitive data.

CSRF vulnerability in Andy Moyle's Emergency Password Reset allows Cross-Site Request Forgery. This issue affects versions from n/a through 8.0.

CVE-2024-34810 describes a Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Skyline WP, allowing for CSRF attacks. This affects Skyline WP versions from n/a through 1.0.10.

A missing authorization vulnerability in Avirtum iPages Flipbook allows exploiting incorrectly configured access control security levels.

Startupzy has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Inisev Social Media & Share Icons has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing Authorization vulnerability in Shareaholic allows exploiting incorrectly configured access control security levels. This issue affects Shareaholic from n/a through 9.7.11.

Vulnerability in LangGraph Python SDK (versions up to 0.3.14) due to unsafe URL path construction from unsanitized caller-supplied identifiers. Identifiers with special URL characters can cause HTTP requests to target different resources, potentially leading to unauthorized access, modification, or deletion.

Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Integration and Interfaces). Affects version 9.2.38. Allows a high-privileged attacker with network access via HTTPS to perform unauthorized creation, deletion, or modification of critical data and access all accessible data.

Vulnerability in the Oracle VM VirtualBox product (component: VMSVGA device) in version 7.2.8 allows a high privileged attacker to gain access to the system, potentially compromising Oracle VM VirtualBox. Attacks may significantly impact additional products, increasing the scope of the threat.

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code) allows a low privileged attacker with network access to compromise MySQL Shell. Successful attacks can lead to unauthorized access to critical data or complete access to all MySQL Shell accessible data.

A vulnerability in the MySQL Shell product of Oracle MySQL allows an unauthenticated attacker with network access to compromise MySQL Shell. Human interaction is required, increasing the risk of unauthorized access to critical data.

A vulnerability in the Oracle VM VirtualBox product (component: VMSVGA device) allows an easily exploitable attack by a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox runs. Attacks may significantly impact additional products, leading to unauthorized access to critical data.

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware, affecting the Authentication Engine. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, requiring interaction from a person other than the attacker.

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: End User Self Service) allows an unauthenticated attacker with network access via IIOP to compromise Identity Manager. Successful attacks can lead to unauthorized access to data, including updates, inserts, or deletions.

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server) allows easy exploitation by an unauthenticated attacker with network access via HTTP. Successful attacks can lead to unauthorized access to a subset of Oracle WebCenter Content accessible data.

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a high privileged attacker with access to the infrastructure to compromise ADF, potentially leading to unauthorized access to critical data.