CVE Vulnerability Catalog

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Query, affecting versions 8.61 and 8.62. A difficult-to-exploit flaw allows a high-privileged attacker with HTTP network access to compromise the system. Successful attacks can result in unauthorized hang or frequently repeatable crash (complete DOS) and unauthorized update, insert, or delete access to some data and read access to a subset of data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Weblogic, affecting versions 8.61-8.63. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running PeopleTools to compromise the system. Successful attacks can result in unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data.

Vulnerability in Oracle Order Management within Oracle E-Business Suite, component Product Diagnostic Tools, affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with HTTP network access to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data and unauthorized update, insert, or delete access to some data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Application Server - JRE, affecting versions 8.61-8.63. An easily exploitable flaw allows a high-privileged attacker with logon to the infrastructure where PeopleTools executes to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Weblogic, affecting versions 8.61-8.63. A difficult-to-exploit flaw allows an unauthenticated attacker with TLS network access to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data and unauthorized update, insert, or delete access to some data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Web Server, affecting versions 8.61-8.63. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, potentially impacting additional products (scope change). Successful attacks can result in unauthorized read access to a subset of data.

Vulnerability in Oracle Solaris (X Window System component) affecting version 11.4. An easily exploitable flaw allows a logged-in low-privileged attacker to perform unauthorized updates, inserts or deletes, read a subset of data, and cause a partial denial of service.

OGNL is an object graph navigation library for Java. Prior to 3.4.13, the optional stricter-invocation mode does not block java.lang.reflect.Method, Constructor or Field, allowing an attacker-controlled expression to bypass the check and execute operations on blocked classes via JDK reflection.

Use-after-free vulnerability in Skia in Google Chrome on Android prior to 156.0.8078.47. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

Uninitialized resource in ANGLE in Google Chrome on Windows prior to 156.0.8078.47. A remote attacker could read memory outside the sandbox via a crafted HTML page.

Race condition in Extensions in Google Chrome prior to 156.0.8078.47. A remote attacker leveraging social engineering could bypass system access restrictions via a crafted Chrome extension.

Race condition in Installer in Google Chrome on Mac prior to 156.0.8078.47. A local attacker could execute arbitrary code outside the sandbox via a local program.

Improper input validation in Core in Google Chrome on Windows prior to 156.0.8078.47. A remote attacker who had compromised the renderer process and leveraged social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Missing authorization in SignIn in Google Chrome on iOS prior to 156.0.8078.47. A remote attacker could bypass system access restrictions via a crafted HTML page.

Uninitialized resource in Dawn in Google Chrome prior to 156.0.8078.47. A remote attacker could read memory outside the sandbox via a crafted HTML page.

Use-after-free in Bluetooth in Google Chrome prior to 156.0.8078.47. An adjacent attacker leveraging social engineering could execute arbitrary code outside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the Media component of Google Chrome prior to version 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Uninitialized resource in GPU in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

UI misrepresentation in the Ozone component of Google Chrome prior to version 156.0.8078.47. A remote attacker could spoof UI elements via a crafted HTML page.

Missing authorization in the Actor component of Google Chrome prior to version 156.0.8078.47. A remote attacker who had compromised the renderer process could bypass system access restrictions via a crafted HTML page.