CVE Vulnerability Catalog

Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component E1 Dev Platform Tech - UNIX). Affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows a high-privileged attacker with local logon to cause unauthorized data modification and partial denial of service.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (component Networking). Affects multiple listed versions, including Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27. A difficult-to-exploit flaw allows an unauthenticated network attacker to cause unauthorized data modification.

Vulnerability in Oracle Java SE (component Compiler). Affects versions 25.0.4.1 and 27. A difficult-to-exploit flaw allows an unauthenticated network attacker to gain unauthorized read access to a subset of Java SE accessible data.

Vulnerability in Oracle Applications Manager within Oracle E-Business Suite (component Diagnostics). Affects versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged network attacker via HTTP to gain unauthorized read access to a subset of data.

Vulnerability in Oracle Applications Manager within Oracle E-Business Suite (component Diagnostics). Affects versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a high-privileged network attacker via HTTP to gain unauthorized read access to a subset of data.

Vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. A difficult to exploit flaw allows an unauthenticated attacker with network access via TLS to perform unauthorized update, insert, or delete access to some accessible data.

Vulnerability in the Portal component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. A difficult to exploit flaw allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, requiring user interaction and potentially impacting additional products.

Vulnerability in the RDBMS component of Oracle Database Server versions 19.3-19.32 and 21.3-21.23. An easily exploitable flaw allows a high privileged attacker with Query Optimizer privilege and network access via Oracle Net to gain unauthorized read access to a subset of data.

Vulnerability in the Open Query component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. A difficult to exploit flaw allows a high privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of data.

Vulnerability in the Data Mover component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. A difficult to exploit flaw allows a high privileged attacker with logon to the infrastructure to perform unauthorized data modification, read a subset of data, and cause partial denial of service, requiring user interaction.

Vulnerability in the Application Server - JRE component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. A difficult to exploit flaw allows an unauthenticated attacker with network access via SSH to perform unauthorized update, insert, or delete access to some data.

Vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. A difficult to exploit flaw allows a high privileged attacker with logon to the infrastructure to perform unauthorized data modification, read a subset of data, and cause partial denial of service.

The find_handlers_for_template MCP tool in python/djust/mcp/server.py from 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8 accepts an existing absolute template_path and reads it without restricting the resolved path to project directories. A local MCP client can use the tool as a file existence and readability oracle and obtain substrings matching the tool's attribute pattern from files readable by the djust process.

DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.

Vulnerability in the Internal Operations component of Oracle Purchasing in Oracle E-Business Suite versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete access to some data, requiring user interaction.

Vulnerability in the Internal Operations component of Oracle Purchasing in Oracle E-Business Suite versions 12.2.3-12.2.15. A difficult to exploit flaw allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete access to some data.

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests) affecting versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle Concurrent Processing accessible data.

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics) affecting versions 12.2.3-12.2.15. A difficult to exploit vulnerability allows a high privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data and cause a partial denial of service of Oracle Applications Manager.

Vulnerability in the MySQL Connectors product (component: Connector/ODBC) affecting version 26.7.1. A difficult to exploit vulnerability requires logon to the infrastructure where MySQL Connectors executes and human interaction; it can result in a partial denial of service of MySQL Connectors.

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product (component: Security) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An easily exploitable vulnerability allows a low privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of Elastic Charging Engine accessible data.