Podatności

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft…

CVSS 5,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.…

CVSS 5,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first,…

CVSS 5,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to…

CVSS 5,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the…

CVSS 5,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with…

CVSS 5,9 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to…

CVSS 5,9 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication…

CVSS 5,9 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact…

CVSS 5,9 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…

CVSS 5,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects.…

CVSS 5,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud…

CVSS 5,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise…

CVSS 5,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-jwt). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.…

CVSS 5,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integrations-vault). Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the…

CVSS 5,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft…

CVSS 5,8 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious…

CVSS 5,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise…

CVSS 5,8 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses,…

CVSS 5,8 · rekomendacja wg zapisanej polityki

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java` logs the entire JSON request body at SEVERE level when…

CVSS 5,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through…

CVSS 5,7 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle…

CVSS 5,7 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field.…

CVSS 5,6 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from…

CVSS 5,6 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…

CVSS 5,6 · EPSS 0,25 % · rekomendacja wg zapisanej polityki