CVE Vulnerability Catalog

Vulnerability in Oracle MySQL Server (component: Server: Optimizer). Affected versions are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows a high privileged attacker with network access via multiple protocols to compromise MySQL Server, resulting in unauthorized ability to cause a hang or frequently repeatable crash (complete DoS).

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vulnerability in Oracle Financial Services Analytical Applications Infrastructure (component: Platform). Affected versions are 8.0.7.9, 8.0.8.7, and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Attacks may significantly impact additional products (scope change). Successful attacks can result in unauthorized access to critical data or complete access to all accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).

Vulnerability in Oracle Financial Services Analytical Applications Infrastructure (component: Platform) affecting versions 8.0.7.9, 8.0.8.7 and 8.1.2.5. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all accessible data.

A vulnerability in Oracle Financial Services Analytical Applications Infrastructure (part of Oracle Financial Services Applications) in the Platform component. Affects versions 8.0.7.9, 8.0.8.7, and 8.1.2.5. An unauthenticated attacker can access via HTTP, requiring user interaction, and gain unauthorized read and modify access to some data.

Vulnerability in Oracle Financial Services Revenue Management and Billing (component: Security Management System) affecting versions 2.9.0.0.0–7.2.0.0.0. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or all data accessible in the application.

Vulnerability in Oracle Financial Services Revenue Management and Billing (component: Security Management System) in versions 2.9.0.0.0–7.2.0.0.0. Allows a high-privileged attacker with network access via HTTP to gain unauthorized access to critical data. CVSS 3.1 Base Score 4.9.

OpenText Flipper version 3.1.2 contains a path traversal vulnerability due to external control of file name or path. This could allow a user to access files hosted on the server.

Wtyczka Moodle GeniAI (local_geniai) w wersji 2.3.6 zawiera podatność typu cross-site scripting. Użytkownik z rolą Nauczyciela może przesłać plik PDF z osadzonym JavaScriptem, który następnie jest wyświetlany jako bezpośredni link HTML bez sanitizacji.

CloudEdge Cloud does not sanitize MQTT topic input, allowing an attacker to leverage MQTT wildcards to subscribe to topics and receive messages intended for other users. These messages may contain credentials and key information to connect to peer-to-peer cameras.

Zimbra Collaboration (ZCS) before version 10.1.12 is vulnerable to SSRF due to the chat proxy configuration.

WeGIA, an open source web manager for institutions, has a reflected XSS vulnerability in the editar_info_pessoal.php endpoint prior to version 3.5.1. Attackers can inject malicious scripts in the action parameter.

WeGIA, an open source Web Manager for Institutions, prior to version 3.5.1, contains a reflected cross-site scripting (XSS) vulnerability in the editar_info_pessoal.php endpoint. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1.

Koa, a framework for Node.js, in versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, has a bypass to CVE-2025-8129 affecting its back redirect functionality. An attacker can manipulate the Referer header to force a user's browser to navigate to an external, potentially malicious website.

Biblioteka astral-tokio-tar do odczytu/zapisu archiwów tar w asynchronicznym Rust zawiera podatność na analizę granic w wersjach przed 0.5.6. Umożliwia ona atakującym wprowadzenie dodatkowych wpisów archiwum poprzez wykorzystanie niespójnego przetwarzania nagłówków PAX/ustar.

W interfejsie zarządzania opartym na sieci web urządzenia NETLINK HG322G V1.0.00-231017 występuje niewłaściwa autoryzacja, która umożliwia zdalnemu, nieautoryzowanemu atakującemu eskalację uprawnień oraz zablokowanie dostępu do konta prawowitego administratora za pomocą odpowiednio skonstruowanych żądań HTTP.

The Moodle OpenAI Chat Block plugin version 3.0.1 (2025021700) suffers from an IDOR vulnerability due to insufficient validation of the blockId parameter in /blocks/openai_chat/api/completion.php. An authenticated student can impersonate another user's block (e.g., administrator) and send queries executed with that block's configuration.

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information.

GeographicLib w wersji 2.5 jest podatny na przepełnienie bufora w funkcji GeoConvert DMS::InternalDecode. Ta luka może prowadzić do nieautoryzowanego dostępu do pamięci.

A high severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. An attacker can cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. CVSS score is 8.3.