CVE Vulnerability Catalog

Vulnerability in Oracle Hospitality Simphony (component: POS). Affected versions are 19.8-19.8.5, 19.9-19.9.3 and 19.10-19.10.1. Easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks can result in unauthorized access to critical data or complete access to all data.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security). Affects multiple versions, including Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; GraalVM for JDK 17.0.20 and 21.0.12; GraalVM Enterprise Edition 21.3.19. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the system. Successful attacks can result in unauthorized read access to a subset of data.

Vulnerability in Oracle WebLogic Server (component: Core). Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks can result in takeover of the server.

Vulnerability in Oracle Outside In Technology (component: Outside In Core). Affected version is 8.5.8. Easily exploitable vulnerability allows an unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise it. Successful attacks require human interaction from a person other than the attacker and can result in takeover.

Vulnerability in Oracle Outside In Technology (component: Outside In Core). Affected version is 8.5.8. Easily exploitable vulnerability allows an unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise it. Successful attacks require human interaction from a person other than the attacker and can result in takeover.

Vulnerability in Oracle Outside In Technology (component: Outside In Core). Affected version is 8.5.8. Easily exploitable vulnerability allows an unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise it. Successful attacks require human interaction from a person other than the attacker and can result in takeover.

Vulnerability in Oracle Hyperion Infrastructure Technology (component: Lifecycle Management). Affected version is 11.2.25.0.000. Easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise it. Successful attacks can result in unauthorized access to critical data or complete access to all data.

Vulnerability in Oracle Outside In Technology (component: Outside In PDF Export SDK). Affected version is 8.5.8. Easily exploitable vulnerability allows an unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise it. Successful attacks require human interaction from a person other than the attacker and can result in takeover.

Vulnerability in Oracle Hyperion Financial Reporting (component: Server). Affected version is 11.2.25.0.000. Easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise it. Successful attacks can result in unauthorized access to critical data or complete access to all data.

Rejected CVE: reserved but not needed.

Rejected CVE: reserved but not needed.

Rejected CVE: reserved but not needed.

Rejected CVE: reserved but not needed.

This CVE ID has been rejected. Reason for rejection: reserved but not needed.

This CVE ID has been rejected. Reason for rejection: reserved but not needed.

This CVE ID has been rejected. Reason for rejection: reserved but not needed.

This CVE ID has been rejected. Reason for rejection: reserved but not needed.

Vulnerability in Froxlor before version 2.3.8. The lib/ajax.php entry point bypasses centralized request validation, and the editapikey action does not validate a CSRF token. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions.

Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.

Froxlor before version 2.3.8 has a vulnerability in the DomainZones.add API command that does not reject line delimiters, tab characters, semicolons, or unsupported DNS record types before serializing values into a BIND zone file. An authenticated customer with DNS-zone permissions can inject additional resource-record lines, bypassing field-level validation. BIND accepts the injected records, allowing modification of DNS data and potential DNS availability impact.