CVE Vulnerability Catalog

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, Report Distribution component, affecting versions 8.61-8.63. Easily exploitable by an unauthenticated attacker with HTTP network access, allowing unauthorized access to critical data or complete access to all PeopleTools data.

Vulnerability in Oracle Capacity (Oracle E-Business Suite), Internal Operations component, affecting versions 12.2.3-12.2.15. Easily exploitable by a low-privileged attacker with HTTP network access, allowing unauthorized access to critical data, modification of some data, and partial denial of service (partial DOS).

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, Business Interlink component, affecting versions 8.61-8.63. Difficult to exploit, an unauthenticated attacker with HTTP network access can take over PeopleTools.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, Portal component, affecting versions 8.61-8.63. Easily exploitable by a low-privileged attacker with HTTP network access, allowing unauthorized access to critical data and partial denial of service (partial DOS).

Vulnerability in Oracle Capacity (Oracle E-Business Suite), Internal Operations component, affecting versions 12.2.3-12.2.15. Easily exploitable by a low-privileged attacker with HTTP network access, allowing unauthorized access to critical data, modification of some data, and partial denial of service (partial DOS).

libcurl could accidentally return a URL for curl_easy_getinfo()'s CURLINFO_EFFECTIVE_URL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curl_mime_free leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.

When invoked with --remote-header-name (-J), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the Content-Disposition header despite the -J non-overwrite constraint.

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent CURLOPT_READDATA pointer, including data remaining from unrelated prior operations such as an HTTP POST request executed on a reused handle.

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

When libcurl uses libssh2 with a hashed known_hosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback.

Enabling CURLOPT_CRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache, and the save error is silently ignored.

Importing an includeSubDomains parent HSTS entry before a longer-lived child entry silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer.

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.

markdown-it versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 are O(n²) with default options when parsing a link reference definition whose label or title is never closed, leading to excessive resource consumption.

When CURLOPT_INTERFACE (or --interface) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key. A later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out-of-bounds read when gnutls_record_send() returns a number of bytes sent greater than the number of bytes it was given to send, which GnuTLS does after a blocked send.