ByteOS

Product

MySQL NDB Cluster

CPEs

cpe:2.3:a:oracle:mysql_ndb_cluster:7.5.33_and_prior:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_ndb_cluster:7.6.29_and_prior:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_ndb_cluster:8.0.36_and_prior:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_ndb_cluster:8.3.0_and_prior:*:*:*:*:*:*:*

Versions

Affected

From * through 7.5.33 (custom)
From * through 7.6.29 (custom)
From * through 8.0.36 (custom)
From * through 8.3.0 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data.

Type: N/A

CWE ID: N/A

Description: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data.

Metrics

Version	Base score	Base severity	Vector
3.1	2.2	LOW	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 2.2

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuapr2024.html	vendor-advisory
https://security.netapp.com/advisory/ntap-20240426-0015/	N/A

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2024.html

Resource:

vendor-advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20240426-0015/

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuapr2024.html	vendor-advisory x_transferred
https://security.netapp.com/advisory/ntap-20240426-0015/	x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2024.html

Resource:

vendor-advisory

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20240426-0015/

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-269	CWE-269 Improper Privilege Management

Type: CWE

CWE ID: CWE-269

Description: CWE-269 Improper Privilege Management

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:16 Apr, 2024 | 22:15

Updated At:10 Feb, 2025 | 23:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	2.2	LOW	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 2.2

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

CPE Matches

>>mysql>>Versions from 7.5.0(inclusive) to 7.5.33(inclusive)

>>mysql>>Versions from 7.6.0(inclusive) to 7.6.29(inclusive)

>>mysql>>Versions from 8.0.0(inclusive) to 8.0.36(inclusive)

>>mysql>>Versions from 8.1.0(inclusive) to 8.3.0(inclusive)

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

>>active_iq_unified_manager>>-

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

>>active_iq_unified_manager>>-

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

>>oncommand_insight>>-

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

>>oncommand_workflow_automation>>-

cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

>>snapcenter>>-

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-269	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-269

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://security.netapp.com/advisory/ntap-20240426-0015/	secalert_us@oracle.com	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2024.html	secalert_us@oracle.com	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240426-0015/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2024.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20240426-0015/

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2024.html

Source: secalert_us@oracle.com

Resource:

Vendor Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20240426-0015/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

74Records found

CVE-2024-21244

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-2.2||LOW

EPSS-0.26% / 49.71%

7 Day CHG~0.00%

Published-15 Oct, 2024 | 19:52

Updated-03 Nov, 2025 | 22:16

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).

Product-mysql MySQL Server

CVE-2024-21243

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-2.2||LOW

EPSS-0.25% / 48.59%

7 Day CHG~0.00%

Published-15 Oct, 2024 | 19:52

Updated-03 Nov, 2025 | 22:16

Product-mysql MySQL Server

CVE-2023-22010

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-2.2||LOW

EPSS-0.27% / 50.52%

7 Day CHG~0.00%

Published-18 Jul, 2023 | 20:18

Updated-13 Sep, 2024 | 18:04

Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4.3.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).

Product-essbase Hyperion Essbase

CVE-2023-22099

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.09% / 25.94%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 21:03

Updated-13 Sep, 2024 | 16:35

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Product-vm_virtualbox VM VirtualBox

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-53026

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6||MEDIUM

EPSS-0.10% / 28.16%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-16 Jul, 2025 | 19:58

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-53030

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6||MEDIUM

EPSS-0.10% / 28.16%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-26 Feb, 2026 | 17:50

CWE ID-CWE-269

Improper Privilege Management

CVE-2026-46817

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-0.11% / 29.87%

7 Day CHG~0.00%

Published-28 May, 2026 | 20:17

Updated-04 Jun, 2026 | 13:45

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Oracle Payments

CWE ID-CWE-269

Improper Privilege Management

CWE ID-CWE-287

Improper Authentication

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2017-12422

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.45% / 64.22%

7 Day CHG~0.00%

Published-29 Aug, 2017 | 15:00

Updated-13 May, 2026 | 00:24

NetApp StorageGRID Webscale 10.2.x before 10.2.2.3, 10.3.x before 10.3.0.4, and 10.4.x before 10.4.0.2 allow remote authenticated users to delete arbitrary objects via unspecified vectors.

Vendor-n/a NetApp, Inc.

Product-storagegrid_webscale n/a

CWE ID-CWE-269

Improper Privilege Management

CVE-2023-22023

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.8||HIGH

EPSS-0.12% / 30.39%

7 Day CHG~0.00%

Published-18 Jul, 2023 | 20:18

Updated-13 Sep, 2024 | 17:35

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Device Driver Interface). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: CVE-2023-22023 is equivalent to CVE-2023-31284. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Product-solaris Solaris Operating System

CWE ID-CWE-269

Improper Privilege Management

CVE-2017-10292

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-2.3||LOW

EPSS-0.07% / 20.89%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-13 May, 2026 | 00:24

Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create User privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS Security accessible data. CVSS 3.0 Base Score 2.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

Product-database Oracle Database

CWE ID-CWE-269

Improper Privilege Management

CVE-2017-10094

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 40.02%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-13 May, 2026 | 00:24

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Product-agile_product_lifecycle_management Agile PLM Framework

CWE ID-CWE-269

Improper Privilege Management

CVE-2017-0310

Matching Score-6

Assigner-NVIDIA Corporation

Vendor-FreeBSD Foundation Oracle Corporation Linux Kernel Organization, Inc NVIDIA Corporation Microsoft Corporation

Matching Score-6

Assigner-NVIDIA Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 12.11%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 23:00

Updated-13 May, 2026 | 00:24

All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to cause a denial of service.

Product-freebsd solaris windows gpu_driver linux_kernel GPU Display Driver

CWE ID-CWE-269

Improper Privilege Management

CVE-2017-10000

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.7||HIGH

EPSS-0.37% / 59.15%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-13 May, 2026 | 00:24

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. While the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).

Product-hospitality_reporting_and_analytics Hospitality Reporting and Analytics

CWE ID-CWE-269

Improper Privilege Management

CVE-2024-21985

Matching Score-6

Assigner-NetApp, Inc.

Matching Score-6

Assigner-NetApp, Inc.

CVSS Score-7.6||HIGH

EPSS-0.17% / 37.92%

7 Day CHG~0.00%

Published-26 Jan, 2024 | 16:01

Updated-29 May, 2025 | 15:12

Privilege Escalation Vulnerability in ONTAP 9

ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).

Vendor-NetApp, Inc.

Product-clustered_data_ontap ONTAP 9

CWE ID-CWE-269

Improper Privilege Management

CVE-2024-21059

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.8||HIGH

EPSS-0.14% / 33.30%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-13 Mar, 2025 | 13:15

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

Product-solaris Solaris Operating System

CWE ID-CWE-269

Improper Privilege Management

CVE-2024-21121

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.16% / 36.36%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-27 Mar, 2025 | 15:15

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Product-vm_virtualbox VM VirtualBox vm_virtualbox

CWE ID-CWE-269

Improper Privilege Management

CVE-2024-21141

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.26% / 49.84%

7 Day CHG~0.00%

Published-16 Jul, 2024 | 22:39

Updated-10 Apr, 2025 | 18:14

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Product-vm_virtualbox VM VirtualBox vm_virtualbox

CWE ID-CWE-269

Improper Privilege Management

CVE-2024-21111

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.8||HIGH

EPSS-11.12% / 93.66%

7 Day CHG~0.00%

Published-16 Apr, 2024 | 21:26

Updated-09 May, 2025 | 18:16

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows hosts only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Vendor-Microsoft Corporation Oracle Corporation

Product-vm_virtualbox windows VM VirtualBox

CWE ID-CWE-269

Improper Privilege Management

CVE-2026-46837

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-8.8||HIGH

EPSS-0.09% / 25.96%

7 Day CHG~0.00%

Published-28 May, 2026 | 20:17

Updated-04 Jun, 2026 | 13:46

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Oracle Flow Manufacturing

CWE ID-CWE-269

Improper Privilege Management

CVE-2026-46824

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-9.9||CRITICAL

EPSS-0.09% / 25.96%

7 Day CHG~0.00%

Published-28 May, 2026 | 20:17

Updated-29 May, 2026 | 20:42

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. While the vulnerability is in Oracle Universal Work Queue, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Product-universal_work_queue Oracle Universal Work Queue

CWE ID-CWE-269

Improper Privilege Management

CWE ID-CWE-284

Improper Access Control

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2026-46827

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-8.8||HIGH

EPSS-0.09% / 25.96%

7 Day CHG~0.00%

Published-28 May, 2026 | 20:17

Updated-03 Jun, 2026 | 17:43

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Product-e-business_suite Oracle Payroll

CWE ID-CWE-269

Improper Privilege Management

CWE ID-CWE-284

Improper Access Control

CWE ID-CWE-287

Improper Authentication

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2025-26513

Matching Score-6

Assigner-NetApp, Inc.

Matching Score-6

Assigner-NetApp, Inc.

CVSS Score-7||HIGH

EPSS-0.09% / 25.90%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 20:29

Updated-26 Feb, 2026 | 17:49

The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local user to escalate their privileges.

Vendor-NetApp, Inc.

Product-san_host_utilities SAN Host Utilities for Windows

CWE ID-CWE-269

Improper Privilege Management

CVE-2019-3843

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.5||MEDIUM

EPSS-0.12% / 30.88%

7 Day CHG~0.00%

Published-26 Apr, 2019 | 20:27

Updated-09 Jun, 2025 | 15:49

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

Vendor-systemd_project NetApp, Inc.Fedora Project Canonical Ltd.freedesktop.org

Product-ubuntu_linux cn1610 hci_management_node fedora systemd cn1610_firmware snapprotect solidfire systemd

CWE ID-CWE-266

Incorrect Privilege Assignment

CWE ID-CWE-269

Improper Privilege Management

CVE-2019-16777

Matching Score-6

Assigner-GitHub, Inc.

Matching Score-6

Assigner-GitHub, Inc.

CVSS Score-7.7||HIGH

EPSS-0.59% / 69.81%

7 Day CHG~0.00%

Published-13 Dec, 2019 | 01:00

Updated-05 Aug, 2024 | 01:24

Arbitrary File Overwrite in npm CLI

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Vendor-npmjs npm openSUSE Red Hat, Inc.Fedora Project Oracle Corporation

Product-graalvm enterprise_linux fedora enterprise_linux_eus npm leap cli

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE ID-CWE-269

Improper Privilege Management

CVE-2019-14590

Matching Score-6

Assigner-Intel Corporation

Product-graphics_driver cloud_backup steelstore_cloud_integrated_storage solidfire_baseboard_management_controller_firmware solidfire_baseboard_management_controller data_availability_services 2019.2 IPU – Intel(R) Graphics Driver for Windows* and Linux

Matching Score-6

Assigner-Intel Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.19% / 41.38%

7 Day CHG~0.00%

Published-14 Nov, 2019 | 19:05

Updated-05 Aug, 2024 | 00:19

Improper access control in the API for the Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable information disclosure via local access.

Vendor-n/a Intel Corporation NetApp, Inc.

CWE ID-CWE-269

Improper Privilege Management

CVE-2018-16888

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.4||MEDIUM

EPSS-0.16% / 36.66%

7 Day CHG~0.00%

Published-14 Jan, 2019 | 22:00

Updated-05 Aug, 2024 | 10:39

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.

Vendor-systemd_project The systemd Project Red Hat, Inc.NetApp, Inc.Canonical Ltd.

Product-ubuntu_linux enterprise_linux systemd active_iq_performance_analytics_services element_software systemd

CWE ID-CWE-250

Execution with Unnecessary Privileges

CWE ID-CWE-269

Improper Privilege Management

CVE-2015-0239

Matching Score-6

Assigner-Red Hat, Inc.

Vendor-n/a Canonical Ltd.Oracle Corporation Linux Kernel Organization, Inc Red Hat, Inc.Debian GNU/Linux

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.4||MEDIUM

EPSS-0.10% / 27.57%

7 Day CHG~0.00%

Published-02 Mar, 2015 | 11:00

Updated-06 May, 2026 | 22:30

The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.

Product-debian_linux ubuntu_linux enterprise_linux_workstation enterprise_linux_server enterprise_linux_desktop linux linux_kernel n/a

CWE ID-CWE-269

Improper Privilege Management

CVE-2014-9644

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-2.1||LOW

EPSS-0.06% / 17.94%

7 Day CHG~0.00%

Published-02 Mar, 2015 | 11:00

Updated-06 May, 2026 | 22:30

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

Vendor-n/a Canonical Ltd.Oracle Corporation Linux Kernel Organization, Inc Debian GNU/Linux

Product-debian_linux ubuntu_linux linux linux_kernel n/a

CWE ID-CWE-269

Improper Privilege Management

CVE-2013-7421

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-2.1||LOW

EPSS-0.04% / 13.95%

7 Day CHG~0.00%

Published-02 Mar, 2015 | 11:00

Updated-06 May, 2026 | 22:30

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644.

Vendor-n/a Canonical Ltd.Oracle Corporation Linux Kernel Organization, Inc Debian GNU/Linux

Product-debian_linux ubuntu_linux linux linux_kernel n/a

CWE ID-CWE-269

Improper Privilege Management

CVE-2026-21957

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.04% / 11.48%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 21:56

Updated-26 Feb, 2026 | 14:44

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

CWE ID-CWE-269

Improper Privilege Management

CVE-2026-21983

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-0.04% / 11.48%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 21:56

Updated-26 Feb, 2026 | 14:44

CWE ID-CWE-269

Improper Privilege Management

CVE-2026-21981

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.6||MEDIUM

EPSS-0.02% / 7.12%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 21:56

Updated-29 Jan, 2026 | 14:40

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L).

CWE ID-CWE-269

Improper Privilege Management

CVE-2026-21963

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6||MEDIUM

EPSS-0.03% / 7.44%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 21:56

Updated-29 Jan, 2026 | 16:01

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

CWE ID-CWE-269

Improper Privilege Management

CVE-2021-22118

Matching Score-6

Assigner-VMware by Broadcom

Product-healthcare_data_repository communications_network_integrity communications_session_route_manager retail_assortment_planning communications_session_report_manager retail_merchandising_system communications_cloud_native_core_policy communications_brm_-_elastic_charging_engine communications_cloud_native_core_unified_data_repository retail_order_broker financial_services_analytical_applications_infrastructure communications_cloud_native_core_binding_support_function communications_interactive_session_recorder communications_unified_inventory_management documaker retail_customer_management_and_segmentation_foundation retail_predictive_application_server communications_cloud_native_core_service_communication_proxy insurance_rules_palette utilities_testing_accelerator communications_cloud_native_core_security_edge_protection_proxy retail_financial_integration hci retail_integration_bus enterprise_data_quality management_services_for_element_software spring_framework communications_diameter_intelligence_hub mysql_enterprise_monitor insurance_policy_administration communications_element_manager commerce_guided_search Spring Framework

Matching Score-6

Assigner-VMware by Broadcom

CVSS Score-7.8||HIGH

EPSS-0.25% / 48.99%

7 Day CHG~0.00%

Published-27 May, 2021 | 14:48

Updated-03 Aug, 2024 | 18:30

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

Vendor-n/a VMware (Broadcom Inc.)NetApp, Inc.Oracle Corporation

CWE ID-CWE-269

Improper Privilege Management

CWE ID-CWE-668

Exposure of Resource to Wrong Sphere

CVE-2025-62592

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6||MEDIUM

EPSS-0.02% / 6.02%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-23 Oct, 2025 | 16:00

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-61759

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.02% / 6.58%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 20:03

Updated-23 Oct, 2025 | 16:03

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

CWE ID-CWE-269

Improper Privilege Management

CVE-2023-29256

Matching Score-6

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.06% / 19.98%

7 Day CHG~0.00%

Published-09 Jul, 2023 | 23:27

Updated-13 Feb, 2025 | 16:49

IBM Db2 information disclosure

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege management when certain federation features are used. IBM X-Force ID: 252046.

Product-solaris linux_kernel db2 hp-ux windows aix Db2 for Linux, UNIX and Windows

CWE ID-CWE-269

Improper Privilege Management

CVE-2004-1349

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-2.1||LOW

EPSS-0.07% / 21.63%

7 Day CHG~0.00%

Published-19 Jan, 2005 | 05:00

Updated-16 Apr, 2026 | 00:27

gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.

Vendor-n/a Oracle Corporation GNU

Product-solaris gzip n/a

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-53025

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6||MEDIUM

EPSS-0.10% / 28.16%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-26 Feb, 2026 | 17:50

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-53024

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.13% / 32.68%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-26 Feb, 2026 | 17:50

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-53027

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-8.2||HIGH

EPSS-0.13% / 32.68%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-26 Feb, 2026 | 17:50

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-50066

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-2.7||LOW

EPSS-0.24% / 47.87%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-16 Jul, 2025 | 16:15

Vulnerability in the Oracle Database Materialized View component of Oracle Database Server. Supported versions that are affected are 19.3-19.27, 21.3-21.18 and 23.4-23.8. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_REDEFINITION privilege with network access via Oracle Net to compromise Oracle Database Materialized View. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database Materialized View accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

Product-Oracle Database Server

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-50069

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-7.7||HIGH

EPSS-0.30% / 53.77%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-26 Feb, 2026 | 17:50

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.27 and 21.3-21.18. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM. While the vulnerability is in Java VM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java VM accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Product-java_virtual_machine Oracle Database Server

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-50064

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-4.8||MEDIUM

EPSS-0.18% / 39.32%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-16 Jul, 2025 | 16:15

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).

Product-Oracle WebLogic Server

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-50062

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-8.1||HIGH

EPSS-0.40% / 61.03%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-26 Feb, 2026 | 17:50

Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). Supported versions that are affected are 9.2.51 and 9.2.52. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Global Payroll Core. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Global Payroll Core accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Global Payroll Core accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Product-peoplesoft_enterprise_hcm_global_payroll_core PeopleSoft Enterprise HCM Global Payroll Core

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-50061

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 35.50%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-16 Jul, 2025 | 16:15

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 20.12.0-20.12.21, 21.12.0-21.12.21, 22.12.0-22.12.19, 23.12.0-23.12.13 and 24.12.0-24.12.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Product-Primavera P6 Enterprise Project Portfolio Management

CWE ID-CWE-269

Improper Privilege Management

CVE-2025-50065

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-3.7||LOW

EPSS-0.29% / 52.77%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-04 Aug, 2025 | 21:17

Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Native Image). The supported version that is affected is Oracle GraalVM for JDK: 24.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Product-graalvm_for_jdk Oracle GraalVM for JDK

CWE ID-CWE-269

Improper Privilege Management

CVE-2017-3257

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.21% / 43.29%

7 Day CHG~0.00%

Published-27 Jan, 2017 | 22:01

Updated-13 May, 2026 | 00:24

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.34 and earlier5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).

Vendor-Debian GNU/Linux MariaDB Foundation Oracle Corporation

Product-mariadb mysql debian_linux MySQL Server

CWE ID-CWE-269

Improper Privilege Management

CVE-2023-27316

Matching Score-6

Assigner-NetApp, Inc.

Matching Score-6

Assigner-NetApp, Inc.

CVSS Score-8.8||HIGH

EPSS-0.10% / 26.94%

7 Day CHG~0.00%

Published-12 Oct, 2023 | 21:04

Updated-13 Feb, 2025 | 17:16

Privilege Escalation Vulnerability in SnapCenter

SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.

Vendor-NetApp, Inc.

Product-snapcenter SnapCenter

CWE ID-CWE-269

Improper Privilege Management

CVE-2023-21848

Matching Score-6

Assigner-Oracle

Matching Score-6

Assigner-Oracle

CVSS Score-8.8||HIGH

EPSS-1.34% / 80.48%

7 Day CHG~0.00%

Published-17 Jan, 2023 | 23:35

Updated-17 Sep, 2024 | 14:35

Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration). The supported version that is affected is 3.0.3.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).