CVE Vulnerability Catalog

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is difficult to exploit, requires high-privileged local access, but can lead to full takeover of VirtualBox. Attacks may impact additional products (scope change).

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An attacker with high privileges and local access to the infrastructure can easily exploit this flaw, potentially leading to takeover of Oracle VM VirtualBox. The vulnerability has a scope change, meaning attacks may also impact additional products.

Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can compromise VirtualBox, potentially impacting additional products (scope change).

A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security) allows an unauthenticated attacker with network access to cause a complete denial of service (DOS) via a hang or frequently repeatable crash. Affected versions include Java SE 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1 and corresponding GraalVM versions.

Vulnerability in Oracle Agile PLM (component: User and User Group) in version 9.3.6. An unauthenticated attacker with network access via HTTP can easily compromise the system. Successful attack leads to unauthorized access to critical data or complete access to all Oracle Agile PLM data.

Vulnerability in the SQLcl component of Oracle Database Server affects versions 23.4.0-23.26.0. It is difficult to exploit but allows an unauthenticated attacker with local access to the infrastructure where SQLcl runs to compromise SQLcl. Successful attacks require human interaction from a person other than the attacker.

Vulnerability in the AWT and JavaFX component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can exploit this flaw via multiple protocols, requiring user interaction. Successful attacks can result in unauthorized creation, deletion, or modification of critical data.

Vulnerability in Oracle Siebel CRM Deployment product (component: Server Infrastructure) affects versions 17.0-25.2. An unauthenticated attacker with network access via TLS can easily compromise the system, causing a hang or frequently repeatable crash (complete DoS).

Podatność CVE-2025-58744 dotyczy użycia domyślnych oraz wbudowanych poświadczeń w pliku C2SGlobalSettings.dll w aplikacji Milner ImageDirector Capture na systemie Windows. Umożliwia to odszyfrowanie plików archiwum dokumentów przy użyciu poświadczeń odszyfrowanych za pomocą wbudowanego klucza szyfrowania aplikacji.

Podatność CVE-2025-58743 dotyczy użycia słabego algorytmu kryptograficznego (DES) w klasie Password w bibliotece C2SConnections.dll w Milner ImageDirector Capture na systemie Windows. Umożliwia to przeprowadzenie ataku brute force w celu uzyskania danych uwierzytelniających do bazy danych.

Podatność CVE-2025-58741 dotyczy niewystarczająco chronionych poświadczeń w polu poświadczeń Milner ImageDirector Capture, co umożliwia dostęp do materiałów poświadczeniowych oraz bazy danych. Problem ten dotyczy wersji ImageDirector Capture od 7.0.9 do 7.6.3.25808.

The imaplib module in Python allows injection of additional commands via newline characters in a user-supplied command. Mitigation rejects commands containing control characters.

A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. The issue affects users on version v25.

An input validation issue in Pithikos websocket-server v0.6.4 allows a remote attacker to obtain sensitive information or cause unexpected server behavior via the WebSocketServer._message_received component.

A buffer over-read vulnerability in the PublicKey::verify() method of Binance Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service (DoS) via crafted input.

W funkcji dacp_reply_playqueueedit_move w owntone-server występuje dereferencja wskaźnika NULL, co pozwala atakującym na spowodowanie awarii usługi (DoS) poprzez wysłanie odpowiednio skonstruowanego żądania DACP do serwera.

W funkcji parse_meta (src/httpd_daap.c) w serwerze owntone-server występuje dereferencja wskaźnika NULL, co pozwala atakującym na spowodowanie awarii usługi (DoS) poprzez wysłanie spreparowanego żądania DAAP do serwera.

A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.