CVE Vulnerability Catalog

Vulnerability in PeopleSoft Enterprise PeopleTools (Business Interlink component). Difficult to exploit, but an unauthenticated attacker with network access via HTTP can compromise the system. High impact on confidentiality, integrity, and availability.

Vulnerability in Oracle WebCenter Portal (Portlet Services component). Difficult to exploit, but an unauthenticated attacker with network access via HTTP can compromise the portal. High impact on confidentiality, integrity, and availability.

Vulnerability in Oracle WebCenter Portal (Portlet Services component). A low privileged attacker with network access via HTTP can compromise the portal. Easy to exploit, full impact on confidentiality, integrity, and availability.

Vulnerability in Oracle Identity Manager (OIM Legacy UI component). A high privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify some data. May impact additional products (scope change).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a high privileged attacker with network access via HTTP to compromise Oracle Access Manager.

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a low privileged attacker with network access via T3, IIOP to compromise Oracle Identity Manager.

Vulnerability in Http4s (a Scala interface for HTTP services) prior to 0.23.35 and 1.0.0-M47. When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound, allowing a remote peer to exhaust heap memory.

Vulnerability in Http4s prior to 0.23.35 and 1.0.0-M47. Ember's HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message, enabling CL.CL request smuggling.

Vulnerability in Http4s prior to 0.23.35 and 1.0.0-M47. WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths, allowing a remote client to send a frame that causes an infinite decode loop and resource exhaustion.

Vulnerability in Http4s prior to 0.23.35 and 1.0.0-M47. Ember's HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset, leading to disagreement with RFC-compliant intermediaries and enabling TE.CL or TE.0 request smuggling.

In Http4s, an Ember server with HTTP/2 enabled does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. A single unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in ember-client via server-initiated PUSH_PROMISE frames because enablePush is not enforced. Fixed in versions 0.23.35 and 1.0.0-M47.

In Http4s, Ember's HTTP/2 flow-control window is replenished based on bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. Fixed in versions 0.23.35 and 1.0.0-M47.

In libp2p-rust, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, the code called libp2p_tls::certificate::parse a second time and used expect on the result; the repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. Fixed in 0.13.1.

The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml. The vulnerability may allow an attacker to access files outside the intended directory.

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery in remote file import due to cross-port reuse of a host's validated DNS pin. A low-privileged authenticated user could supply a DNS-rebinding host that resolved to a public address during validation and to a private or loopback address during download, allowing the server to fetch internal-only resources and save them to the file manager.

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure Direct Object Reference (IDOR) in the Express saved search preset delete and edit dialogs. An authenticated user with only view permission on a single Express entity could permanently delete or rename saved search presets owned by entities they had no permission for, and a renamed preset name was displayed back to users, enabling defacement or social engineering.