KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks…
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle…
Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document…
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise…
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with…
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows…
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows…
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the…
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that…
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a…
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to…
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute…
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was…
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint,…
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part…
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.
Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. While the vulnerability is…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). | Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks… |
Obserwuj | 8,7 | 0,32 % | ||
| Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle… |
Obserwuj | 8,7 | 0,32 % | ||
| Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). | Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document… |
Obserwuj | 8,7 | 0,32 % | ||
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise… |
Obserwuj | 8,7 | 0,32 % | ||
| Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle… | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with… |
Obserwuj | 8,7 | 0,32 % | ||
| Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In… | Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows… |
Obserwuj | 8,7 | 0,32 % | ||
| Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise… |
Obserwuj | 8,7 | 0,32 % | ||
| Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In… | Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows… |
Obserwuj | 8,7 | 0,32 % | ||
| A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an… | A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the… |
Obserwuj | 8,7 | 0,3 % | ||
| The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that… | The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that… |
Obserwuj | 8,7 | 0,3 % | ||
| Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially… | Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a… |
Obserwuj | 8,7 | 0,29 % | ||
| A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service. | A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service. |
Obserwuj | 8,7 | 0,27 % | ||
| Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with… | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to… |
Obserwuj | 8,7 | 0,27 % | ||
| Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise… |
Obserwuj | 8,7 | 0,26 % | ||
| A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. | A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. |
Obserwuj | 8,6 | 0,74 % | ||
| Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in… | Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute… |
Obserwuj | 8,5 | 1,22 % | ||
| A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve… | A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes. |
Obserwuj | 8,6 | 0,71 % | ||
| A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated… | A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was… |
Obserwuj | 8,7 | 0,21 % | ||
| A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service. | A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service. |
Obserwuj | 8,6 | 0,7 % | ||
| Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators… | Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint,… |
Obserwuj | 8,6 | 0,66 % | ||
| Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or… | Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility |
Obserwuj | 8,7 | 0,12 % | ||
| Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or… | Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility |
Obserwuj | 8,7 | 0,12 % | ||
| Cross-site scripting in the embedded co-browsing feature in Unblu inc. | Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part… |
Obserwuj | 8,6 | 0,56 % | ||
| Improper validation of array index vulnerability in Velneo vServer. | Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2. |
Obserwuj | 8,7 | Nieustalone | ||
| Vulnerability in Oracle Secure Backup (component: Backup and Restore). | Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. While the vulnerability is… |
Obserwuj | 8,6 | 0,46 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.