CVE Vulnerability Catalog

PeopleSoft Enterprise FIN IT Asset Management version 9.2 contains a vulnerability in the IT Asset Management component. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all accessible data. CVSS 6.5 (Confidentiality impact).

Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). Affected supported versions are Oracle GraalVM for JDK 17.0.16 and 21.0.8. A difficult to exploit vulnerability allows an unauthenticated attacker with network access to obtain unauthorized read access to a subset of Oracle GraalVM for JDK accessible data (CVSS 3.1: 3.7).

Oracle BI Publisher versions 7.6.0.0.0 and 8.2.0.0.0 contain a vulnerability in the Web Service API component. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all accessible data. CVSS 6.5 (Confidentiality impact).

Vulnerability in Oracle Scripting (Oracle E-Business Suite, Miscellaneous component) versions 12.2.3-12.2.14. Easily exploitable, allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Requires user interaction, and attacks may impact additional products (scope change). Successful attacks can result in unauthorized update, insert or delete of some Oracle Scripting data and unauthorized read access to a subset of data. CVSS 6.1 (Confidentiality and Integrity).

Vulnerability in Oracle WebLogic Server (component: Core). Affected versions are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts).

Vulnerability in Oracle Financial Services Analytical Applications Infrastructure (component: Platform) affecting versions 8.0.7.9, 8.0.8.7 and 8.1.2.5. An authenticated low-privileged attacker with network access via HTTP can create, delete or modify critical data and gain unauthorized access to data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Query) affecting versions 8.61 and 8.62. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, resulting in unauthorized read access to a subset of accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).

Vulnerability in the Unified Audit component of Oracle Database Server (versions 23.4-23.9). An attacker with DBA privilege and network access via Oracle Net can compromise Unified Audit, potentially leading to unauthorized update, insert, or delete access to some data. CVSS 3.1 Base Score 2.7.

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).

Vulnerability in Oracle Applications Framework (Upload Attachments component) in versions 12.2.3-12.2.14. A low-privileged attacker with network access via HTTP can compromise the product, resulting in unauthorized update, insert, or delete access to some data. CVSS 4.3 (Integrity impact).

Vulnerability in Oracle Solaris 11, Filesystem component. It requires high privileges and user interaction but can lead to a hang or frequently repeatable crash (complete DoS).

A vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Affected versions are 8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0. Easily exploitable vulnerability allows a high privileged attacker with network access via multiple protocols to compromise MySQL Server.

Vulnerability in Oracle Solaris 11, Kernel component. A low-privileged attacker with local access can cause a hang or frequently repeatable crash (complete DoS).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Affects versions 9.0.0-9.4.0. Easily exploitable by a high privileged attacker with network access via multiple protocols, can cause a hang or frequently repeatable crash (complete DoS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: JAXP) allows unauthenticated attackers with network access to compromise these products. Attackers can gain unauthorized access to critical data or complete access to all data accessible in these systems.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: PIA Core Technology) affecting versions 8.60, 8.61, and 8.62. An unauthenticated attacker with network access via HTTP can exploit it, but user interaction is required. Impact includes unauthorized update, insert, delete, and read access to some data.

A vulnerability in Oracle Applications Framework (part of Oracle E-Business Suite) in the Personalization component. Affects versions 12.2.3-12.2.14. A low-privileged attacker can access via HTTP and compromise the framework, leading to unauthorized update, insert, or delete access to some data.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: PIA Core Technology) in versions 8.60, 8.61, and 8.62. A low-privileged attacker via HTTP, with user interaction, can gain unauthorized access to data (read and modify).

Vulnerability in Oracle MySQL Server (component: InnoDB). Affected versions are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows a high privileged attacker with network access via multiple protocols to compromise MySQL Server, resulting in unauthorized ability to cause a hang or frequently repeatable crash (complete DoS).