ByteOS

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.12% / 31.59%

||

7 Day CHG~0.00%

Published-09 Mar, 2002 | 05:00

Updated-03 Apr, 2025 | 01:03

mysqld in MySQL 3.21 creates log files with world-readable permissions, which allows local users to obtain passwords for users who are added to the user database.

Product-mysql n/a

CVE-2010-3534

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.29% / 52.16%

||

7 Day CHG~0.00%

Published-14 Oct, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 6.21.3.0 and 7.0.1.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Project Management Module.

Product-primavera_product_suite n/a

CVE-2022-21491

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.8||HIGH

EPSS-0.06% / 17.04%

||

7 Day CHG~0.00%

Published-19 Apr, 2022 | 20:38

Updated-24 Sep, 2024 | 20:06

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2009-2282

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.16% / 37.71%

||

7 Day CHG~0.00%

Published-01 Jul, 2009 | 12:26

Updated-16 Sep, 2024 | 23:16

The Virtual Network Terminal Server daemon (vntsd) for Logical Domains (aka LDoms) in Sun Solaris 10, and OpenSolaris snv_41 through snv_108, on SPARC platforms does not check authorization for guest console access, which allows local control-domain users to gain guest-domain privileges via unknown vectors.

Product-opensolaris solaris n/a

CWE ID-CWE-862

Missing Authorization

CVE-2017-3582

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.4||HIGH

EPSS-0.20% / 42.05%

||

7 Day CHG~0.00%

Published-24 Apr, 2017 | 19:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle SuperCluster Specific Software component of Oracle Sun Systems Products Suite (subcomponent: Backup/Restore Utility). Supported versions that are affected are 2.3.8 and 2.3.13. Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle SuperCluster Specific Software executes to compromise Oracle SuperCluster Specific Software. Successful attacks of this vulnerability can result in takeover of Oracle SuperCluster Specific Software. CVSS 3.0 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-supercluster_specific_software SuperCluster Specific Software

CVE-2016-0447

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.18% / 39.38%

||

7 Day CHG~0.00%

Published-21 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0444 and CVE-2016-0449.

Product-enterprise_manager_grid_control n/a

CVE-2016-0449

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.18% / 39.38%

||

7 Day CHG~0.00%

Published-21 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0444 and CVE-2016-0447.

Product-enterprise_manager_grid_control n/a

CVE-2017-10239

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.06% / 19.31%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).

CVE-2017-10241

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.06% / 19.31%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).

CVE-2017-10237

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.06% / 19.31%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).

CVE-2017-10321

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.8||HIGH

EPSS-0.08% / 23.26%

||

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows low privileged attacker having Create session privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Core RDBMS. Note: This score is for Windows platform version 11.2.0.4 of Database. For Windows platform version 12.1.0.2 and Linux, the score is 7.8 with scope Unchanged. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Product-database Oracle Database

CVE-2017-10242

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.06% / 19.31%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).

CVE-2017-10236

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.06% / 18.52%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).

CVE-2017-10240

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.06% / 18.52%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).

CVE-2017-10210

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.08% / 23.95%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).

CVE-2017-10062

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.06% / 19.71%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Oracle Java Web Console). The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Product-solaris Solaris Operating System

CVE-2020-2648

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.2||MEDIUM

EPSS-0.14% / 33.90%

||

7 Day CHG~0.00%

Published-15 Jan, 2020 | 16:34

Updated-30 Sep, 2024 | 14:51

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Internal Operations). The supported version that is affected is 16.0. Easily exploitable vulnerability allows physical access to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Management and Segmentation Foundation. CVSS 3.0 Base Score 6.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Product-retail_customer_management_and_segmentation_foundation Retail Customer Management and Segmentation Foundation

CVE-1999-0888

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.21% / 43.73%

||

7 Day CHG~0.00%

Published-18 Apr, 2000 | 04:00

Updated-03 Apr, 2025 | 01:03

dbsnmp in Oracle Intelligent Agent allows local users to gain privileges by setting the ORACLE_HOME environmental variable, which dbsnmp uses to find the nmiconf.tcl script.

Product-oracle8i database_server n/a

CVE-2016-5581

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.6||MEDIUM

EPSS-0.05% / 13.60%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle iRecruitment component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows local users to affect confidentiality, integrity, and availability via unknown vectors.

Product-irecruitment n/a

CWE ID-CWE-284

Improper Access Control

CVE-2016-5503

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.06% / 17.04%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Sun ZFS Storage Appliance Kit (AK) component in Oracle Sun Systems Products Suite AK 2013 allows local users to affect confidentiality, integrity, and availability via vectors related to Core Services.

Product-sun_zfs_storage_appliance_kit n/a

CVE-2016-5487

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.05% / 14.37%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors.

Product-solaris n/a

CVE-2016-6185

Matching Score-8

Assigner-Debian GNU/Linux

Matching Score-8

Assigner-Debian GNU/Linux

CVSS Score-7.8||HIGH

EPSS-0.45% / 62.77%

||

7 Day CHG~0.00%

Published-02 Aug, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.

Vendor-perl n/a Fedora Project Debian GNU/Linux Oracle Corporation Canonical Ltd.

Product-perl solaris fedora ubuntu_linux debian_linux n/a

CVE-2016-5610

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.8||MEDIUM

EPSS-0.07% / 20.73%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality, integrity, and availability via vectors related to Core.

Product-vm_virtualbox n/a

CWE ID-CWE-284

Improper Access Control

CVE-2016-5539

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-7.3||HIGH

EPSS-0.14% / 33.95%

||

7 Day CHG~0.00%

Published-25 Oct, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle Retail Xstore Payment component in Oracle Retail Applications 1.x allows local users to affect confidentiality, integrity, and availability via unknown vectors.

Product-micros_xstore_payment n/a

CVE-2016-5537

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.7||MEDIUM

EPSS-0.18% / 39.71%

||

7 Day CHG+0.03%

Published-25 Oct, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information is from the October 2016 CPU. Oracle has not commented on third-party claims that this issue is a directory traversal vulnerability which allows local users with certain permissions to write to arbitrary files and consequently gain privileges via a .. (dot dot) in a archive entry in a ZIP file imported as a project.

Product-netbeans n/a

CVE-2016-5126

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 38.61%

||

7 Day CHG~0.00%

Published-01 Jun, 2016 | 22:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2015-3316

Matching Score-8

Assigner-MITRE Corporation

Vendor-n/a CA Technologies (Broadcom Inc.)Linux Kernel Organization, Inc Broadcom Inc.IBM Corporation Oracle Corporation HP Inc.

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.07% / 21.35%

||

7 Day CHG~0.00%

Published-17 Jun, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, allows local users to gain privileges via an unspecified environment variable.

Product-universal_job_management_agent nsm_job_management_option solaris linux_kernel client_automation hp-ux network_and_systems_management virtual_assurance_for_infrastructure_managers workload_automation_ae aix n/a

CVE-2021-42739

Matching Score-8

Assigner-MITRE Corporation

Product-debian_linux linux_kernel starwind_virtual_san fedora communications_cloud_native_core_network_exposure_function communications_cloud_native_core_binding_support_function starwind_san_\&_nas communications_cloud_native_core_policy n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.7||MEDIUM

EPSS-0.03% / 6.85%

||

7 Day CHG~0.00%

Published-20 Oct, 2021 | 00:00

Updated-04 Aug, 2024 | 03:38

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking.

Vendor-starwindsoftware n/a Linux Kernel Organization, Inc Fedora Project Debian GNU/Linux Oracle Corporation

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-14628

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.18% / 39.79%

||

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:30

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14628 is applicable to Windows VM only. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Vendor-openSUSE Oracle Corporation

Product-vm_virtualbox leap VM VirtualBox

CVE-2015-4891

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.43% / 61.56%

||

7 Day CHG~0.00%

Published-21 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via vectors related to NSCD.

Product-solaris n/a

CVE-2015-4907

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.18% / 39.38%

||

7 Day CHG~0.00%

Published-21 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4820.

Product-solaris n/a

CVE-2015-4482

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.08% / 24.97%

||

7 Day CHG~0.00%

Published-16 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file.

Vendor-n/a Mozilla Corporation Oracle Corporation openSUSE

Product-firefox opensuse solaris n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2004-2134

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-3.82% / 87.66%

||

7 Day CHG~0.00%

Published-27 May, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords.

Product-application_server n/a

CVE-2015-3318

Matching Score-8

Assigner-MITRE Corporation

Vendor-n/a CA Technologies (Broadcom Inc.)Linux Kernel Organization, Inc IBM Corporation Oracle Corporation HP Inc.

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.06% / 18.37%

||

7 Day CHG~0.00%

Published-17 Jun, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, does not properly validate an unspecified variable, which allows local users to gain privileges via unknown vectors.

Product-universal_job_management_agent nsm_job_management_option solaris linux_kernel client_automation hp-ux network_and_systems_management virtual_assurance_for_infrastructure_managers workload_automation_ae aix n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2019-2619

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.06% / 17.45%

||

7 Day CHG~0.00%

Published-23 Apr, 2019 | 18:16

Updated-02 Oct, 2024 | 15:59

Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows high privileged attacker having Grid Infrastructure User privilege with logon to the infrastructure where Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Portable Clusterware. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Product-database Oracle Database

CVE-2019-2500

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.8||HIGH

EPSS-0.08% / 25.29%

||

7 Day CHG~0.00%

Published-16 Jan, 2019 | 19:00

Updated-02 Oct, 2024 | 16:06

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVE-2004-1365

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.40% / 59.81%

||

7 Day CHG~0.00%

Published-19 Jan, 2005 | 05:00

Updated-03 Apr, 2025 | 01:03

Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user.

Product-enterprise_manager_database_control oracle8i oracle10g enterprise_manager e-business_suite collaboration_suite application_server enterprise_manager_grid_control oracle9i n/a

CVE-2015-3317

Matching Score-8

Assigner-MITRE Corporation

Vendor-n/a CA Technologies (Broadcom Inc.)Linux Kernel Organization, Inc IBM Corporation Oracle Corporation HP Inc.

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.06% / 18.37%

||

7 Day CHG~0.00%

Published-17 Jun, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, does not properly perform bounds checking, which allows local users to gain privileges via unspecified vectors.

Product-universal_job_management_agent nsm_job_management_option solaris linux_kernel client_automation hp-ux network_and_systems_management virtual_assurance_for_infrastructure_managers workload_automation_ae aix n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2021-35599

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.06% / 17.45%

||

7 Day CHG~0.00%

Published-20 Oct, 2021 | 10:50

Updated-25 Sep, 2024 | 19:31

Vulnerability in the Zero Downtime DB Migration to Cloud component of Oracle Database Server. The supported version that is affected is 21c. Easily exploitable vulnerability allows high privileged attacker having Local Logon privilege with logon to the infrastructure where Zero Downtime DB Migration to Cloud executes to compromise Zero Downtime DB Migration to Cloud. While the vulnerability is in Zero Downtime DB Migration to Cloud, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Zero Downtime DB Migration to Cloud. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Product-zero_downtime_db_migration_to_cloud Database - Enterprise Edition

CVE-2015-2572

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.63% / 69.38%

||

7 Day CHG~0.00%

Published-16 Apr, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.

Vendor-n/a Oracle Corporation Microsoft Corporation

Product-windows hyperion_smart_view_for_office n/a

CVE-2007-3870

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.10% / 29.01%

||

7 Day CHG~0.00%

Published-18 Jul, 2007 | 19:00

Updated-07 Aug, 2024 | 14:37

Multiple unspecified vulnerabilities in the Human Capital Management component in Oracle PeopleSoft Enterprise 8.9 Bundle 11 allow local users to have unknown impact via unknown vectors, aka (1) PSE06 and (2) PSE07.

Product-peoplesoft_enterprise n/a

CVE-2017-10204

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.8||HIGH

EPSS-0.35% / 56.53%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVE-2021-27365

Matching Score-8

Assigner-MITRE Corporation

Product-debian_linux linux_kernel tekelec_platform_distribution solidfire_baseboard_management_controller_firmware solidfire_baseboard_management_controller n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.43% / 61.42%

||

7 Day CHG~0.00%

Published-07 Mar, 2021 | 04:22

Updated-03 Aug, 2024 | 20:48

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.

Vendor-n/a Linux Kernel Organization, Inc NetApp, Inc.Debian GNU/Linux Oracle Corporation

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-2409

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.08% / 25.11%

||

7 Day CHG~0.00%

Published-20 Jul, 2021 | 22:44

Updated-26 Sep, 2024 | 13:58

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVE-2006-2081

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.6||MEDIUM

EPSS-58.40% / 98.12%

||

7 Day CHG~0.00%

Published-27 Apr, 2006 | 23:00

Updated-03 Apr, 2025 | 01:03

Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT_EXTENSION package. NOTE: this issue was originally linked to DB05 (CVE-2006-1870), but a reliable third party has claimed that it is not the same issue. Based on details of the problem, the primary issue appears to be insecure privileges that facilitate the introduction of SQL in a way that is not related to special characters, so this is not "SQL injection" per se.

Product-database_server n/a

CVE-2006-0903

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.24% / 46.37%

||

7 Day CHG~0.00%

Published-27 Feb, 2006 | 23:00

Updated-03 Apr, 2025 | 01:03

MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.

Vendor-mysql n/a Oracle Corporation

Product-mysql n/a

CVE-2021-22118

Matching Score-8

Assigner-VMware by Broadcom

Product-healthcare_data_repository communications_network_integrity communications_session_route_manager retail_assortment_planning communications_session_report_manager retail_merchandising_system communications_cloud_native_core_policy communications_brm_-_elastic_charging_engine communications_cloud_native_core_unified_data_repository retail_order_broker financial_services_analytical_applications_infrastructure communications_cloud_native_core_binding_support_function communications_interactive_session_recorder communications_unified_inventory_management documaker retail_customer_management_and_segmentation_foundation retail_predictive_application_server communications_cloud_native_core_service_communication_proxy insurance_rules_palette utilities_testing_accelerator communications_cloud_native_core_security_edge_protection_proxy retail_financial_integration hci retail_integration_bus enterprise_data_quality management_services_for_element_software spring_framework communications_diameter_intelligence_hub mysql_enterprise_monitor insurance_policy_administration communications_element_manager commerce_guided_search Spring Framework

Matching Score-8

Assigner-VMware by Broadcom

CVSS Score-7.8||HIGH

EPSS-0.26% / 49.05%

||

7 Day CHG+0.01%

Published-27 May, 2021 | 14:48

Updated-03 Aug, 2024 | 18:30

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

Vendor-n/a VMware (Broadcom Inc.)NetApp, Inc.Oracle Corporation

CWE ID-CWE-269

Improper Privilege Management

CWE ID-CWE-668

Exposure of Resource to Wrong Sphere

CVE-2021-2250

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.08% / 23.52%

||

7 Day CHG~0.00%

Published-22 Apr, 2021 | 21:53

Updated-26 Sep, 2024 | 15:02

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVE-2014-6548

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.09% / 26.89%

||

7 Day CHG~0.00%

Published-21 Jan, 2015 | 15:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in the Oracle SOA Suite component in Oracle Fusion Middleware 11.1.1.7 allows local users to affect confidentiality, integrity, and availability via vectors related to B2B Engine.

Product-fusion_middleware n/a

CVE-2014-0442

Matching Score-8

Assigner-Oracle