CVE Vulnerability Catalog

A vulnerability in the Oracle Identity Manager Connector component of Oracle Fusion Middleware (subcomponent: Microsoft Active Directory) allows easy exploitation by an unauthenticated attacker with access to the infrastructure where Oracle Identity Manager Connector operates. Attacks can lead to unauthorized access to critical data and may cause system crashes.

Vulnerability in Oracle Integrated Lights Out Manager (ILOM) in Oracle Sun Systems Products Suite, affecting versions prior to 3.2.6. It allows an unauthenticated attacker with network access via HTTP to compromise ILOM, potentially leading to unauthorized access to data and partial denial of service.

Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: UIF Open UI) allows an unauthenticated attacker with network access via HTTP to compromise the Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker, and while the vulnerability is in the Siebel UI Framework, attacks may significantly impact additional products.

Vulnerability in Oracle Integrated Lights Out Manager (ILOM) in Oracle Sun Systems Products Suite affecting versions prior to 3.2.6. It allows an unauthenticated attacker with network access via HTTP to compromise ILOM, potentially leading to hangs or frequent crashes (complete DOS).

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin) allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks can lead to unauthorized access to critical data.

Vulnerability in the Java VM component of Oracle Database Server affecting versions 11.2.0.4, 12.1.0.2, and 12.2.0.1. Easily exploitable by a high privileged attacker, potentially leading to takeover of the Java VM.

Vulnerability in the MySQL Server component of Oracle MySQL allows an unauthenticated attacker with network access to compromise the MySQL Server. Successful attacks can result in the ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DoS).

Vulnerability in the Oracle Retail Point-of-Service component allows a low privileged attacker with network access via HTTP to compromise the system. Attacks may significantly impact additional products, leading to unauthorized access to critical data.

A vulnerability in the Oracle Business Intelligence Enterprise Edition component allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.

A vulnerability in the Oracle Hospitality Suite8 component allows an unauthenticated attacker with network access via HTTP to compromise the system. The attack requires interaction from a third party, potentially leading to unauthorized access to critical data.

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks can lead to unauthorized access to critical data.

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction and can lead to unauthorized access to critical data.

Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction and can lead to unauthorized access to critical data.

The HashiCorp Vagrant VMware Fusion plugin version 4.0.24 and earlier contains an insecure suid wrapper binary that allows a non-root user to obtain a root shell.

A vulnerability in the authentication, authorization, and accounting (AAA) implementation of Cisco Firepower Extensible Operating System (FXOS) and NX-OS System Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability occurs because AAA processes prevent the NX-OS System Manager from receiving keepalive messages when an affected device receives a high rate of login attempts.

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets.

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient limitations on the number of connections that can be made to the affected software.

A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection.

A vulnerability in the implementation of SIP functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The issue is due to improper handling of SIP request messages by the device.