CVE Vulnerability Catalog

The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting. These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem. On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM "user" hashes.

Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components. Only deployments that meet all of the following criteria are impacted: use of the RuleBasedAuthorizationPlugin, a config with multiple roles, a permission list using one or more of the predefined permission rules (config-read, config-edit, schema-read, metrics-read, security-read), no "all" permission defined, and a networking setup that allows unfiltered requests to Solr.

Instalator Agentów ServerView dla systemu Windows dostarczany przez Fsas Technologies Inc. może niebezpiecznie ładować biblioteki Dynamic Link. W momencie uruchomienia instalatora może zostać wykonany dowolny kod z uprawnieniami administratora.

W jądrze systemu Linux zidentyfikowano podatność, która prowadzi do dereferencji wskaźnika NULL podczas dezaktywacji nieaktywnych agregatów w funkcji qfq_reset. Problem występuje, gdy dwa obiekty qfq_class wskazują na ten sam leaf_qdisc, co może prowadzić do błędów w zarządzaniu kolejkami.

EVerest to oprogramowanie do ładowania pojazdów elektrycznych. W wersjach 2025.9.0 i wcześniejszych, atakujący może wyczerpać pamięć systemu operacyjnego, inicjując nieograniczoną liczbę połączeń TCP, co prowadzi do zakończenia działania modułu.

Wtyczka Academy LMS dla WordPressa jest podatna na eskalację uprawnień poprzez przejęcie konta we wszystkich wersjach do 3.5.0 włącznie. Problem wynika z niewłaściwej walidacji tożsamości użytkownika przed aktualizacją hasła oraz polegania wyłącznie na publicznie dostępnym nonce do autoryzacji.

A command injection vulnerability (CWE-78) has been found in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler. The vulnerability is generally hard to exploit, but primarily affects CI/CD environments where the parameter is populated from external, potentially untrusted sources.

A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in takeover of VirtualBox, and may significantly impact additional products (scope change). CVSS 3.1 Base Score is 8.2.

A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in unauthorized creation, deletion or modification of data, unauthorized access to data, and partial denial of service. CVSS 3.1 Base Score is 8.1.

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with local access can cause a hang or frequently repeatable crash (complete DoS) of VirtualBox. This vulnerability applies to Windows VMs only.

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with access to the physical communication segment attached to the hardware where VirtualBox executes can take over VirtualBox. Exploitation is difficult.

Vulnerability in Oracle Business Intelligence Enterprise Edition (Oracle Analytics Cloud component) affects versions 7.6.0.0.0 and 8.2.0.0.0. A low-privileged attacker with local access to the infrastructure can exploit this flaw to unauthorizedly create, delete, or modify data, as well as gain complete access to data.

Podatność w produkcie Oracle FLEXCUBE Investor Servicing, dotycząca systemu zarządzania bezpieczeństwem. Dotknięte wersje to 14.5.0.15.0, 14.7.0.8.0 oraz 14.8.0.1.0. Atakujący z niskimi uprawnieniami, mający dostęp do sieci przez HTTP, może łatwo wykorzystać tę podatność.

Vulnerability in Oracle Agile Product Lifecycle Management for Process (component: Supplier Portal) version 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks can result in takeover of Oracle Agile PLM for Process. CVSS 3.1 Base Score 9.8.

Vulnerability in Oracle Hospitality OPERA 5 (Opera Servlet component) allows an unauthenticated attacker with network access via HTTP to easily compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all OPERA 5 data, as well as unauthorized update, insert, or delete access to some data and partial denial of service.