CVE Vulnerability Catalog

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft, component Search Framework. Affects versions 8.61 and 8.62. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment to compromise the system.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft, component Meta Data. Affects versions 8.61-8.63. An easily exploitable flaw allows a high-privileged attacker with network access via HTTP to compromise the system.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Process Scheduler, affecting versions 8.61 and 8.62. A difficult-to-exploit flaw allows a low-privileged attacker with HTTP network access to compromise the system, requiring user interaction and potentially impacting additional products (scope change). Successful attacks can result in unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Search Framework, affecting version 8.62. A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access to compromise the system, requiring user interaction. Successful attacks can result in unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Portal, affecting versions 8.61 and 8.62. A difficult-to-exploit flaw allows a low-privileged attacker with HTTP network access to compromise the system. Successful attacks can result in unauthorized read access to a subset of data and partial denial of service.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Application Data Sets, affecting versions 8.61-8.63. A difficult-to-exploit flaw allows a low-privileged attacker with HTTP network access to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification of critical data and complete denial of service.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Query, affecting versions 8.61 and 8.62. A difficult-to-exploit flaw allows a high-privileged attacker with HTTP network access to compromise the system. Successful attacks can result in unauthorized hang or frequently repeatable crash (complete DOS) and unauthorized update, insert, or delete access to some data and read access to a subset of data.

Vulnerability in the Application Server - JRE component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. A difficult to exploit flaw allows an unauthenticated attacker with network access via SSH to perform unauthorized update, insert, or delete access to some data.

Vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. A difficult to exploit flaw allows a high privileged attacker with logon to the infrastructure to perform unauthorized data modification, read a subset of data, and cause partial denial of service.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Weblogic, affecting versions 8.61-8.63. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running PeopleTools to compromise the system. Successful attacks can result in unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data.

Vulnerability in Oracle Order Management within Oracle E-Business Suite, component Product Diagnostic Tools, affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with HTTP network access to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data and unauthorized update, insert, or delete access to some data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Application Server - JRE, affecting versions 8.61-8.63. An easily exploitable flaw allows a high-privileged attacker with logon to the infrastructure where PeopleTools executes to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Weblogic, affecting versions 8.61-8.63. A difficult-to-exploit flaw allows an unauthenticated attacker with TLS network access to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data and unauthorized update, insert, or delete access to some data.

Vulnerability in the Oracle Solaris product (component: Services) affecting version 11.4. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to compromise Oracle Solaris.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component Web Server, affecting versions 8.61-8.63. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, potentially impacting additional products (scope change). Successful attacks can result in unauthorized read access to a subset of data.

Vulnerability in Oracle Solaris (X Window System component) affecting version 11.4. An easily exploitable flaw allows a logged-in low-privileged attacker to perform unauthorized updates, inserts or deletes, read a subset of data, and cause a partial denial of service.

Vulnerability in Oracle Solaris (component Image Packaging System) affecting versions 11.3 and 11.4. An unauthenticated attacker with network access via HTTP can easily compromise the product and take it over. CVSS 3.1 Base Score is 9.8 with confidentiality, integrity and availability impacts.

Vulnerability in the Oracle Solaris product (component: Utility) affecting versions 11.3 and 11.4. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Solaris.

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes emSign ECC Root CA - G3, providing a trust path for intermediates whose private keys are publicly available.

In virtualenv from 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the activation template, allowing trigger names such as __VIRTUAL_NAME__ inside an already substituted path to be replaced again. This can lead to command execution when activating the environment via bash, fish, xonsh, or activate_this.py if an attacker influences the destination path or --prompt.