CVE Vulnerability Catalog

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: JSSE) allows an unauthenticated attacker with network access via TLS to cause a partial denial of service (partial DOS). The attack is easy to exploit.

Vulnerability in Oracle Commerce Service Center (component: Commerce Service Center) version 11.4.0. Easily exploitable, requires user interaction, allows an unauthenticated attacker via HTTP to unauthorized read and modify data.

Vulnerability in Oracle Retail Xstore Point of Service (Oracle Retail Applications) version 21.0.3. A low-privileged attacker via HTTP can gain unauthorized read access.

In Zephyr OS (versions v1.12.0 through v4.4.1), the CONFIG_USERSPACE syscall verifier in z_vrfy_k_poll() does not free memory on validation failure. An attacker can repeatedly trigger a memory leak, exhausting the kernel pool and causing denial of service.

In Zephyr Bluetooth Mesh PB-ADV provisioning bearer, the protocol watchdog timer is unconditionally reset before FCS and ADV_LINK_INVALID checks. A remote unauthenticated attacker can send FCS-valid PB-ADV PDUs on the same link ID, continuously resetting the timer and preventing the dead link from being torn down. This results in a persistent denial of provisioning/re-provisioning service, with no impact on confidentiality, integrity, or memory safety.

In Zephyr OS (since v2.5.0), the NXP LPUART driver disables peripheral clocks before validating configuration. Unsupported parameters cause an error without re-enabling the clock, leading to a hard fault and system crash.

Vulnerability in Trezor Safe 3, Safe 5, and Safe 7 firmware in the Ethereum sign_tx / sign_tx_eip1559 flow. The device confirms only the initial calldata chunk while the signature commits to the full stream. An attacker can replace the tail data, changing the signed transaction.

Vulnerability in Taiga 6.10.1 due to missing authorization in filters_data API endpoints. An unauthenticated attacker can disclose the full member roster and workflow configuration of private projects by supplying a project ID.

Vulnerability in djangoSIGE up to version 1.10 (commit a6fe7e8) allowing user enumeration via the password reset endpoint. An unauthenticated attacker can distinguish existing accounts from non-existing ones based on different error messages.

CSRF vulnerability in djangoSIGE up to version 1.10 allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users. The attack uses GET methods in cancellation views, bypassing CSRF protection.

Vulnerability in Elasticsearch (CWE-617) leading to denial of service via input data manipulation. A low-privileged authenticated user can send a crafted search request causing an assertion and node process termination.

Vulnerability in Kibana (CWE-400) leading to denial of service via excessive allocation. An authenticated low-privileged user can send a crafted request to the Canvas functionality, causing the Kibana process to terminate.

Vulnerability in Elasticsearch (CWE-400) leading to denial of service via excessive memory allocation. A user with search privileges can send a crafted search request causing data node heap exhaustion.

Vulnerability in kirby-modules up to version 5.5.7 (fixed in commit 315417e). Allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint.

SQL Injection vulnerability in Aptabase (up to commit 5a89368) in the ClickHouse backend. Authenticated attackers can inject unsanitized filter parameters into Liquid SQL templates, bypassing tenant isolation and reading event data across all tenants.

Cross Site Scripting (XSS) vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file.

In libheif versions up to 1.21.2, an integer overflow occurs during inline mask processing in HEIF files. The product of width and height can exceed the maximum 32-bit unsigned value, leading to undersized buffer allocation and out-of-bounds memory access. The issue is fixed in version 1.22.0.

FOG prior to versions 1.5.10.1832 and 1.6.0-beta.2313 contains an HTML/JavaScript injection vulnerability. An unauthenticated attacker knowing a host's MAC address can POST malicious inventory values to /service/inventory.php, which are stored in the database. When an admin opens the Group Inventory tab, the payload executes in the admin's browser.

Vulnerability in Capstone before versions 6.0.0-Alpha8 and 5.0.8. In builds with `-DCAPSTONE_X86_REDUCE`, disassembling 3DNow! opcodes (`0F 0F`) causes a null pointer dereference in `modRMRequired()` and `decode()`, allowing a remote attacker to crash the application.

Server-Side Request Forgery (SSRF) vulnerability in FlaskBB, a forum software written in Python using Flask. Prior to version 2.2.1, the get_image_info() function allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities.