Podatności

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network…

CVSS 8,7 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

CVSS 8,7 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

CVSS 8,7 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

CVSS 8,7 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search. Successful attacks require…

CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the…

CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,…

CVSS 8,7 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks…

CVSS 8,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle…

CVSS 8,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document…

CVSS 8,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise…

CVSS 8,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with…

CVSS 8,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows…

CVSS 8,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…

CVSS 8,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows…

CVSS 8,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the…

CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that…

CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a…

CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.

CVSS 8,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to…

CVSS 8,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…

CVSS 8,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

CVSS 8,6 · EPSS 0,74 % · rekomendacja wg zapisanej polityki

Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute…

CVSS 8,5 · EPSS 1,22 % · rekomendacja wg zapisanej polityki

A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.

CVSS 8,6 · EPSS 0,71 % · rekomendacja wg zapisanej polityki

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was…

CVSS 8,7 · EPSS 0,21 % · rekomendacja wg zapisanej polityki