CVE Vulnerability Catalog

Joomla extension Page Builder CK versions 1.0.0-3.1.2, 3.4.0-3.4.11, and 3.5.0-3.6.2 have improper access control, allowing an authenticated arbitrary file upload leading to RCE.

Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final have a vulnerability in XmlDecoder where delivering XML with a DOCTYPE declaration to an AsyncXMLInputFactory without security configuration can activate DTD and entity handling, creating XML External Entity (XXE) risk.

Use-after-free vulnerability in the GPU component of Google Chrome on Android prior to 150.0.7871.182. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.

Out-of-bounds read and write vulnerability in ANGLE in Google Chrome on Android prior to 150.0.7871.182. A remote attacker could potentially escape the sandbox via a crafted HTML page.

In Google Chrome prior to 150.0.7871.182, an integer overflow in Chromecast allows a local attacker to potentially perform a sandbox escape via malicious network traffic.

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

Autel Maxi Charger Single firmware up to version V1.03.51 is vulnerable to OS command injection via the /test endpoint on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary system commands.

Autel Maxi Charger Single firmware up to version V1.03.51 has an unauthenticated remote code execution vulnerability via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.

Vulnerability in Oracle Applications Framework (Web Utilities component) versions 12.2.8-12.2.15. Easily exploitable, allows a high-privileged attacker via HTTP to take over the system, with impact on other products (scope change).

Vulnerability in Oracle PeopleSoft Enterprise FIN Manufacturing Brazil (component: Integration). Affects version 9.1. Easily exploitable by an unauthenticated attacker with network access via HTTPS. Successful attack can lead to full system takeover.

Vulnerability in PeopleSoft Enterprise FIN Manufacturing Argentina (Oracle PeopleSoft) in the Manufacturing component. Affects version 9.1. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to unauthorized creation, deletion, or modification of critical data and unauthorized access to all data. CVSS 9.1.

Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (Oracle PeopleSoft) in the Staffing component. Affects version 9.1. Easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to takeover of the component and impacting additional products (scope change). CVSS 9.9.

Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (component: eProcurement) version 9.1. An unauthenticated attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data, unauthorized read access to a subset of data, and partial denial of service. Scope change impacts additional products.

Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (Oracle PeopleSoft) in the eProcurement component. Affects version 9.1. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to unauthorized creation, deletion, or modification of critical data and unauthorized access to all data. CVSS 9.1.

Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (component: Integration) version 9.1. An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability, leading to unauthorized access to critical data, data modification, and partial denial of service. Attacks may impact additional products (scope change).

PeopleSoft Enterprise HCM Global Payroll Switzerland (version 9.2) contains a vulnerability that allows a high-privileged authenticated attacker to compromise the system via HTTP. The attack may impact other products (scope change).

Vulnerability in Oracle PeopleSoft Enterprise FIN Common Objects Brazil (component: Integration). Affected version is 9.1. Easily exploitable by unauthenticated attacker with network access via HTTP, potentially leading to takeover of PeopleSoft Enterprise FIN Common Objects Brazil. CVSS 9.8.

Vulnerability in Oracle Communications Converged Application Server allows an unauthenticated attacker via TCP/IP to take over the server. Exploitation is difficult but may affect other products.

Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.