CVE Vulnerability Catalog

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. Difficult to exploit, requires network access via HTTP and low privileges. Allows attacker unauthorized read access to a subset of data.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. Difficult to exploit, requires physical access to communication segment. Allows unauthenticated attacker unauthorized read access to a subset of data.

Vulnerability in Oracle Hyperion Infrastructure Technology (component: Installation and Configuration) version 11.2.25.0.000. Difficult to exploit, requires logon to infrastructure and high privileges. Allows unauthorized update, insert, delete access and partial denial of service.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. Difficult to exploit, requires physical access to communication segment and low privileges. Allows unauthorized update, insert, delete access to data.

Vulnerability in Oracle Hyperion Infrastructure Technology (component: Installation and Configuration) version 11.2.25.0.000. Easily exploitable, requires logon to infrastructure and low privileges. Allows unauthorized update, insert, delete access to data.

Vulnerability in Oracle Hyperion Infrastructure Technology (component: Installation and Configuration) version 11.2.25.0.000. Difficult to exploit, requires logon to infrastructure and high privileges. Allows unauthorized update, insert, delete access and partial denial of service.

Vulnerability in Oracle Hyperion Infrastructure Technology (component: Installation and Configuration) version 11.2.25.0.000. Easily exploitable, requires logon to infrastructure and high privileges. Allows unauthorized update, insert, delete access and partial denial of service.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized read access to a subset of accessible data.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. An easily exploitable flaw allows a high-privileged attacker with network access via SQL to compromise the system. Successful attacks can result in unauthorized update, insert, delete, and read access to some data.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system, but requires user interaction. Successful attacks can result in unauthorized update, insert, or delete access to some data.

Vulnerability in Oracle Hyperion Infrastructure Technology (component: Common Security) version 11.2.25.0.000. A difficult-to-exploit flaw allows a high-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized update, insert, delete access and partial denial of service.

Vulnerability in Oracle Hyperion Infrastructure Technology (component: Installation and Configuration) version 11.2.25.0.000. A difficult-to-exploit flaw allows a high-privileged attacker with local access to the infrastructure to compromise the system. Successful attacks can result in unauthorized update, insert, delete, and read access to some data.

Vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to compromise the system, but requires user interaction. Successful attacks can result in unauthorized read access to a subset of data.

Vulnerability in Oracle Fusion Middleware's Helidon product (component: Imperative Web Server) in versions 3.0.0-3.2.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon, resulting in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security). Affects multiple versions, including Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; GraalVM for JDK 17.0.20 and 21.0.12; GraalVM Enterprise Edition 21.3.19. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the system. Successful attacks can result in unauthorized read access to a subset of data.

Vulnerability in linuxfabrik-lib before version 4.2.0. The db_sqlite.py module created SQLite databases at predictable paths in /tmp and followed attacker-created symbolic links. An attacker with a local monitoring account can create a symlink and trigger a sudo-authorized plugin, leading to arbitrary path overwrite, denial of service, or manipulation of an existing database. Fixed in version 4.2.0.

Vulnerability in MobSF before version 4.5.1. The get_browsable_activities function in manifest_analysis.py validates only the android:host value, not android:port, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With DNS rebinding, the request can reach an internal service. Fixed in version 4.5.1.

MagicMirror² before version 2.37.0 applies ipWhitelist only as Express middleware, while the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. An unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces and dispatch arbitrary events and payloads to socketNotificationReceived. Default helpers can make server-side requests to attacker-selected URLs, and conditionally execute commands.

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index and then subtracts one before indexing the pat_loops array, allowing a read of one byte before the array when the index is zero.

File Browser prior to 2.63.17 directly serializes the Link storage struct in sharePostHandler, shareListHandler, and shareGetsHandler, exposing password_hash and the bypass token in API responses. An administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares.