CVE Vulnerability Catalog

Vulnerability in Oracle Secure Backup (Backup and Restore component) affecting versions 19.1.0.0.0 and 19.1.0.1.0. An unauthenticated attacker with network access via TCP can easily compromise the system. CVSS 9.8.

Vulnerability in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) affecting versions 17.0-26.9. A low-privileged attacker with network access via HTTP can easily compromise the system, potentially impacting other products. CVSS 9.9.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (SQR component) affecting versions 8.61-8.63. A low-privileged attacker with network access via HTTP can easily gain unauthorized creation, deletion or modification access to critical data, potentially impacting other products. CVSS 9.6.

A stack-based buffer overflow in the boa formTR069Config functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

An arbitrary file write vulnerability in the boa formUploadFile functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

A stack-based buffer overflow in the boa formUploadFile functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

An OS command injection vulnerability in the boa formWizard newPass functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

Multiple exploitable stack-based buffer overflows in the boa formFilter functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327), involving the vpnPassword parameter. A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

Multiple exploitable stack-based buffer overflows in the boa formFilter functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327), involving the vpnUser parameter. A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

When processing an HTTP redirect to a URL containing userinfo (a username:password component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of --location-trusted.

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via curl_easy_duphandle() copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read; alternatively, reusing the original or cloned handle while changing only CURLOPT_WRITEDATA results in type confusion.

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate, tricked by a manipulated validity length field, extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password or a Negotiate/Kerberos ticket) to the proxy itself by answering the CONNECT tunnel request with 401 WWW-Authenticate instead of the expected 407 Proxy-Authenticate.

A stack-based buffer overflow exists in the boa formIpv6Setup dhcp_dns functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the dhcp_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup dhcp_dns functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the dhcp_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_gw parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_ipv6 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.