CVE Vulnerability Catalog

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this input requires resource-intensive memory allocation that can exhaust available heap memory, causing the Kibana process to crash and become unavailable to all users.

An authorization bypass vulnerability in Kibana (CWE-639) allows attackers to use user-supplied identifiers to access scheduled query result data from Kibana Spaces they are not authorized to view.

An incorrect authorization vulnerability in Kibana's Machine Learning functionality allows low-privileged users to manipulate ML audit and notification records for arbitrary jobs across spaces using internally elevated credentials.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the required authorization through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

Kibana has an incomplete list of disallowed inputs vulnerability (CWE-184). An authenticated attacker with access to the Reporting feature can bypass outbound request restrictions configured by an administrator.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS.php. Manipulation of the day argument results in cross-site scripting. The attack can be initiated remotely, and the exploit has been made public.

In SourceCodester Class and Exam Timetabling System 1.0, an unknown functionality in /class.php is vulnerable to cross-site scripting (XSS) via the day argument. Remote exploitation is possible and the exploit is public.

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)

Autel Maxi Charger Single firmware up to version V1.03.51 allows unrestricted access to NXP i.MX6 recovery mode via exposed hardware pins. An attacker with physical access can boot arbitrary code in memory and modify or extract firmware and other sensitive data.

In Autel Maxi Charger Single firmware through V1.03.51, an accessible UART interface allows interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify boot configuration or file system to gain OS access.

XXL-Job version 2.4.2 has an insecure direct object reference vulnerability. Authenticated users can read execution logs from unauthorized job groups by supplying sequential log IDs to the logDetailCat endpoint.

Electric Postgres Sync versions below 1.6.10 contain an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses.

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5-12.2.15 have a vulnerability in the Internal Operations component. A low-privileged authenticated attacker with network access via HTTP can exploit it, requiring human interaction, leading to unauthorized read and write access to some data and affecting other products.

Vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 6.5 (Confidentiality).

A vulnerability in Oracle HRMS (US) of Oracle E-Business Suite allows a high-privileged attacker to access critical data. The vulnerability has a scope change, affecting other products.

Vulnerability in Oracle HRMS (US) of Oracle E-Business Suite, Internal Operations component. A low-privileged attacker via HTTP can gain unauthorized access to critical data or all Oracle HRMS (US) data.

A vulnerability in Oracle Advanced Benefits (Oracle E-Business Suite) versions 12.2.3-12.2.15 allows a low-privileged attacker with network access via HTTP to gain unauthorized read, update, insert, or delete access to some data and cause a partial denial of service.

Vulnerability in Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks can result in unauthorized update, insert or delete access to some data, unauthorized read access, and partial denial of service. CVSS 6.3.