CVE Vulnerability Catalog

In Netty up to versions 4.1.135 and 4.2.15, a vulnerability exists in the SpdyHttpDecoder handler. Improper release of a pooled ByteBuf leads to native memory exhaustion.

Netty, a network application framework, contains a vulnerability in the codec-haproxy module in the HAProxyMessageDecoder class. When reading the 13th byte as a signed byte and widening it to int without masking, the value 0xFF is interpreted as -1, causing a collision with the need-more-data sentinel. This leads to unbounded accumulation of data in the cumulation buffer until direct memory is exhausted.

Two bugs in libheif prior to version 1.22.0 chain to leak process heap memory as visible pixel values in decoded grid images. An attacker uploading a crafted AVIF/HEIC file to a server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data, including library function pointers sufficient to defeat ASLR, from publicly downloadable transcoded JPEG/PNG/WebP output.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Libraries). An unauthenticated attacker via network can compromise data integrity, gaining unauthorized access to create, delete, or modify critical data.

Vulnerability in Oracle Java SE (component: Scripting). Affected versions are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized access to critical data and modify it.

Vulnerability in the Scripting component of Oracle Java SE allows an unauthenticated attacker to remotely cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. The attack is easily exploitable over network via multiple protocols.

Vulnerability in Oracle VM VirtualBox version 7.2.12, component Core. A low-privileged attacker with local access can easily take over VirtualBox. Affects Windows hosts only.

Vulnerability in Oracle VM VirtualBox version 7.2.8. A high-privileged attacker with local access, requiring user interaction, can modify critical data and cause a complete denial of service (DOS) via hangs or frequent crashes. The attack may impact other products.

Vulnerability in Oracle VM VirtualBox version 7.2.12, component Core. A low-privileged attacker with local access can easily take over VirtualBox.

Vulnerability in the RDBMS component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can cause a complete denial of service (DoS) and unauthorized modification, insertion, or deletion of some data.

Vulnerability in Oracle Fusion Middleware's Oracle Access Manager product (component: Authentication Engine). Affected version is 14.1.2.1.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Access Manager.

Vulnerability in Oracle Contracts Integration (Oracle E-Business Suite product, component: Internal Operations) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can take over the contracts integration, also impacting other products.

Vulnerability in Oracle Bills of Material (component: Bill Issues) allows a low-privileged attacker with network access via HTTP to compromise the system. No user interaction is required.

Vulnerability in Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Affected versions 12.2.3-12.2.15. A low privileged attacker with network access via HTTP can compromise all data confidentiality and integrity.

Vulnerability in PeopleSoft Enterprise PeopleTools (component: OpenSearch Dashboards). An unauthenticated attacker via HTTP, with user interaction, can gain unauthorized access to critical data, affecting other products.

Vulnerability in Oracle Product Hub (Item Catalog component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to all data and the ability to create, delete, or modify it.

Vulnerability in Siebel CRM Cloud Applications (Siebel Cloud Manager component) allows an unauthenticated attacker to remotely cause a hang or frequent crash (complete DOS) via HTTPS. The attack is easily exploitable.

Vulnerability in PeopleSoft Enterprise PeopleTools (Process Scheduler component) allows a low-privileged authenticated attacker to modify and read critical data in other products (scope change). User interaction is required.

Vulnerability in PeopleSoft Enterprise PeopleTools (component: PIA Core Technology) version 8.62. An unauthenticated attacker with network access via HTTP can easily exploit this flaw, but user interaction is required. The attack may impact additional products (scope change) and lead to unauthorized update, insert, or delete access, unauthorized read access, and partial denial of service.

Vulnerability in Oracle Product Workbench of Oracle E-Business Suite (component: Security). Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the application, leading to unauthorized creation, deletion, or modification of critical data and access to all application data.