CVE Vulnerability Catalog

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution.

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability. Unauthenticated attackers can retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization filter.

An unauthenticated SSRF vulnerability was discovered in Verba RAG application version 2.1.3 via the /ws/import_files WebSocket endpoint, allowing attackers to make arbitrary HTTP GET requests to internal resources.

Verba RAG application version 2.1.3 contains a server-side request forgery (SSRF) vulnerability combined with a same-origin middleware bypass. An unauthenticated remote attacker can supply a crafted Origin header and attacker-controlled host and port values to force the server to issue arbitrary HTTP requests. The localhost origin check in the API middleware can be bypassed by sending any Origin value prefixed with 'localhost' regardless of port, then submitting arbitrary host and port parameters to the /api/connect endpoint, causing the server to issue outbound GET requests to attacker-controlled infrastructure.

Ollama (HEAD f0078ae) has an uncontrolled memory allocation vulnerability in the GGUF metadata parser. A remote attacker can upload a crafted sub-1KB GGUF file via the blob upload and model create/pull APIs, triggering an unrecoverable Go runtime out-of-memory fatal error or makeslice panic that bypasses recovery middleware and crashes the entire server.

Vulnerability in the Install component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. A low-privileged attacker with local access can take over the system.

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).

A vulnerability in Oracle HRMS (US) (part of Oracle E-Business Suite) in the US Payroll Year End component, versions 12.2.3-12.2.15, allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data and modify some data.

A vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. A low privileged attacker with local access can easily exploit this vulnerability to compromise Oracle HRMS (US). Successful attacks can result in takeover of Oracle HRMS (US) (CVSS 7.8).

Vulnerability in Oracle HRMS (Norway) product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all Oracle HRMS (Norway) data. Attacks may significantly impact additional products (scope change).

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK).

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).

Vulnerability in Oracle Workflow (Workflow Notification Mailer) in Oracle E-Business Suite versions 12.2.3-12.2.15. Difficult to exploit, allows unauthenticated attacker via SMTP to take over Oracle Workflow. CVSS 8.1 (high impact on confidentiality, integrity, availability).

Vulnerability in Oracle Applications Framework in Oracle E-Business Suite (Web Utilities component) versions 12.2.11-12.2.15. Low privileged attacker with network access via HTTP can compromise the framework, leading to takeover. CVSS 8.8.

Vulnerability in Oracle HRMS (France) product of Oracle E-Business Suite, component French HR. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite, component US Payroll - General. Affects versions 12.2.7-12.2.15. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.

Vulnerability in Oracle Production Scheduling (versions 12.2.3-12.2.15) allows a low-privileged attacker via HTTP to perform unauthorized creation, deletion, or modification of critical data, partial read access, and partial denial of service. CVSS 7.6.

Oracle Demantra Demand Management (part of Oracle Supply Chain) versions 12.2.3-12.2.15 have an easily exploitable vulnerability allowing a low-privileged attacker with network access via SQL to take over the product. CVSS 8.8.

Vulnerability in Oracle Advanced Planning Command Center (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. An authenticated attacker with high privileges can access critical data and modify some data via HTTP.

A vulnerability in Oracle Process Manufacturing Regulatory Management (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify it. CVSS 8.1.