CVE Vulnerability Catalog

Vulnerability in Siebel Apps - Marketing (Marketing component) of Oracle Siebel CRM, affected versions 17.0-26.9. A difficult-to-exploit flaw allows a high-privileged attacker with HTTP network access to read a subset of application data.

Vulnerability in Oracle REST Data Services (Database Actions component), affected versions 24.2.0-26.1.0. An easily exploitable flaw allows a high-privileged attacker with HTTP network access to cause a partial denial of service.

Vulnerability in Oracle REST Data Services (Core component), affected versions 24.2.0-26.1.0. An easily exploitable flaw allows a high-privileged attacker with HTTP network access, requiring user interaction, to update, insert or delete some data.

Vulnerability in Oracle REST Data Services (Core component), affected versions 24.2.0-26.1.0. A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access to read a subset of service data.

Vulnerability in Oracle REST Data Services (Core component), affected versions 24.2.0-26.1.0. A difficult-to-exploit flaw allows a high-privileged attacker with HTTP network access, requiring user interaction, to update, insert or delete some data and read a subset of data.

Vulnerability in Oracle REST Data Services (Core component), affected versions 24.2.0-26.1.0. A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access, requiring user interaction, to read a subset of service data.

In virtualenv prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When default-index PyPI digest comparison is enabled, an index candidate matching the bundled package and version can be selected without comparison to PyPI SHA-256 metadata.

In virtualenv prior to 21.14.9, the stdlib venv creator reads the generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, altering the configuration structure.

In virtualenv prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

In sanitize-html from 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link. The default sanitizer configuration is not unconditionally affected.

In uploadfs prior to 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted paths.

In ApostropheCMS import-export module prior to 3.7.1, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export lacks authentication and authorization checks. Any client — including unauthenticated anonymous users who obtained the standard CSRF cookie from visiting the site — can directly invoke this route and trigger the underlying self.cleanExport(req) method.

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.

In Vite prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module.

In filelock from 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user.

In filelock from 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result.