Vulnerabilities

adm-zip, a widely used Node.js ZIP-handling library, fails to apply zlib decompression output limits when a ZIP entry declares an uncompressed size of zero. An attacker can exploit this by supplying a crafted archive containing highly compressible entries (a classic zip bomb) that expand without bound in memory when decompressed, exhausting RAM and crashing or hanging the process. The impact is availability only — CVSS 4.0 scores it 8.7 with no confidentiality or integrity impact — and it is remotely triggerable with no privileges or user interaction where the application processes untrusted archives. Affected deployments are any services or tooling built on adm-zip 0.5.14 through 0.6.0 that decompress user-supplied ZIP files, such as file-upload handlers, document-import pipelines, and build tooling. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

Do: Upgrade adm-zip to a release outside the affected 0.5.14–0.6.0 range — check npm for the latest version and update the direct dependency or the transitive dependency in your lockfile. Until patched, reject or quarantine ZIP entries that declare a zero uncompressed size and enforce hard caps on total decompressed bytes, decompression rate, and concurrent archive processing, with memory limits on the Node.js process. Audit whether any internet-facing feature accepts and decompresses user-uploaded ZIP archives, since those face unauthenticated remote denial of service.

Cotonti 1.0.0's Comments plugin feeds the unauthenticated 'ci' GET parameter directly into PHP's unserialize() without the allowed_classes restriction, allowing arbitrary PHP objects with attacker-controlled properties to be instantiated. By sending a crafted serialized payload in the URL, an unauthenticated attacker can trigger gadget chains available in the application, resulting in database manipulation or remote code execution. The flaw is rated critical (CVSS 4.0: 9.3) and is classified as CWE-502 (deserialization of untrusted data). Sites running Cotonti 1.0.0 with the Comments plugin enabled are affected. No public proof of concept is known, the issue is not in CISA's KEV catalog, and there is no evidence of exploitation in the wild, but exploitation requires only a simple HTTP request once a viable gadget chain is identified.

Do: Upgrade Cotonti to the latest release as soon as a fixed version is available, or disable the Comments plugin if it is not needed. In the meantime, use a WAF or reverse proxy rule to block requests to the Comments plugin containing suspicious serialized data in the 'ci' parameter (e.g., strings starting with 'O:' or 'a:'). Audit web server logs for historical requests with a 'ci' parameter carrying serialized payload markers, and verify database integrity and web roots for signs of code injection.

`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_unit/{id}/exchange/metadata`). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass authorization checks, allowing for the enumeration and extraction of sensitive Personally Identifiable Information (PII) from upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. This issue was fixed in version 2.1.0.

Docker Sandboxes contains a time-of-check/time-of-use race condition (CWE-367) in the guest-to-host Unix-domain socket relay: a socket path is validated to sit inside the authorized workspace, but the host later reconnects by re-resolving that same pathname. A malicious guest can swap an intermediate directory in the path for a symlink during the window between validation and connection, tricking the host into connecting to an arbitrary AF_UNIX socket outside the shared workspace. Successful exploitation lets the guest read data from, or invoke capabilities exposed by, the targeted host-side socket, with high confidentiality and integrity impact on both the vulnerable component and subsequent systems per the CVSS 4.0 vector (8.7, local attack vector, no privileges or user interaction required). Any developer or environment using Docker Sandboxes to run semi-trusted or untrusted code is affected, since the attacker must already control code inside a sandbox. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is known.

Do: Apply the vendor fix as soon as Docker publishes patched builds, and check Docker's security advisory (assigned by [email protected]) for the exact fixed version of Docker Sandboxes/Docker Desktop. Until patched, treat Sandboxes as isolation-best-effort only: do not run untrusted code, and audit which host AF_UNIX sockets are reachable through the relay, since those become the blast radius of a successful race. Monitor guest workspaces for processes rapidly creating or renaming directories along shared socket paths, which is characteristic of exploitation attempts.

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests.

Digital Watchdog VMAX DVR and NVR recorders ship with hard-coded credentials (CWE-798) that can be used to authenticate to the device's ftpd service, which then runs as root. An attacker who can reach the FTP service can log in with these embedded credentials and gain full remote root-level file access to the recorder, including the ability to read, modify, or delete stored video and system files. The CVSS 4.0 vector (AV:A) indicates exploitation requires adjacency — typically an attacker on the same network segment — although any unit with FTP reachable from the internet would be directly exposed. The affected population is the Digital Watchdog VMAX lineup of DVRs and NVRs; the advisory data does not enumerate specific firmware versions. Exploitation status is none known: there is no public PoC and the CVE is not in CISA's KEV catalog.

Do: Disable or block the FTP service (TCP/21) on all VMAX DVRs and NVRs and restrict management/FTP access to a dedicated, isolated surveillance VLAN with an allow-list. Contact Digital Watchdog for fixed firmware and apply it as soon as an update is released, since no corrected version is identified in the advisory. Review device logs and filesystems for unexpected FTP sessions or modified/deleted video files that could indicate prior abuse of the root account.

CVE-2026-68491 is a critical (CVSS 4.0: 9.4) improper link resolution flaw (CWE-59) in which the software performs a file write without adequately validating that the target path is not a symbolic link, permitting an attacker to overwrite arbitrary files. Exploitation is network-reachable and requires only low privileges (PR:L, likely an authenticated account) with no user interaction: the attacker plants or controls a symlink on a path the application writes to, redirecting the write to a file of their choosing. Successful abuse yields high impact to confidentiality, integrity, and availability on both the vulnerable system and downstream systems, with typical outcomes including tampering with configuration, credential, or executable files to escalate privileges or achieve code execution. The flaw was coordinated through HackerOne as CNA, but the advisory data provided does not identify the vendor, product, or affected versions, so the at-risk population cannot be determined from this record. Exploitation status: not in the CISA KEV catalog, no public PoC known, and exploit maturity is unspecified (E:X).

Do: Track the vendor advisory coordinated via HackerOne and upgrade to the fixed version as soon as the affected product is publicly identified. In the interim, verify that file-write operations use symlink-safe practices (e.g., open with O_NOFOLLOW, lstat validation, secure temporary files) and remove unexpected symlinks from application-writable directories. Audit affected hosts for unexplained file overwrites of configs, credentials, or binaries that could indicate attempted exploitation.

CVE-2026-68070 is a missing-authentication flaw (CWE-306) in Digital Watchdog's VMAX DVR and NVR video recorder lineups, in which a critical, network-reachable function passes attacker-supplied bytes directly to a system command executed with root privileges. An unauthenticated attacker on an adjacent network (per the CVSS 4.0 attack vector AV:A) can trigger the flaw by sending crafted requests to the vulnerable service on the recorder, without needing credentials or user interaction. Successful exploitation yields full root command execution on the device, allowing the attacker to take complete control of the recorder, its stored video, and any cameras or credentials it manages, and to use the device as a foothold on the surveillance network. The affected products are the Digital Watchdog VMAX DVR and NVR product lineups; the CVE data does not enumerate specific firmware versions, so defenders should consult the ICS-CERT advisory for the exact affected version ranges. Exploitation status is none known: the flaw is not in the CISA KEV catalog and no public proof-of-concept has been published.

Do: Apply Digital Watchdog firmware updates for VMAX DVRs and NVRs as specified in the ICS-CERT advisory, since affected version ranges are enumerated there. Until patched, isolate surveillance gear on a restricted VLAN and block all untrusted or guest network access to the recorders' management services via firewall rules, as the flaw requires adjacent-network access. Check recorders for signs of compromise, such as unknown accounts, unexpected outbound connections, or modified configuration, and rotate any credentials stored on the devices.

Digital Watchdog VMAX DVR and NVR recorders ship with hard-coded credentials baked into the firmware, in violation of secure development practice (CWE-798). When the device's FTP service is reachable, a remote attacker can authenticate using these embedded credentials and access files with root privileges, potentially reading or modifying arbitrary files on the recorder, including stored video footage and configuration data. The CVSS 4.0 base score is 9.4 (critical), though the adjacent-network attack vector means the attacker generally needs access to the same network segment as the recorder. The affected population is the Digital Watchdog VMAX lineup of DVRs and NVRs, which are commonly deployed in commercial video surveillance environments such as retail, banking, and education. There is no known public proof-of-concept and no evidence of in-the-wild exploitation to date.

Do: Apply vendor firmware updates to affected VMAX DVRs/NVRs as soon as Digital Watchdog releases them, and check the ICS-CERT advisory for the exact model and firmware list. Immediately disable the FTP service if it is not required, and restrict management protocols on recorders to a dedicated VLAN or firewall allowlist so only trusted clients can reach them. Audit FTP access logs for unauthorized logins and rotate any local credentials as a precaution.

Digital Watchdog VMAX DVRs and NVRs are missing authorization checks on state-changing CGI endpoints and perform no session validation, so requests that modify device state can be accepted without a valid authenticated session (CWE-862). An attacker who can reach the recorder on the same network segment (CVSS attack vector is adjacent-network, with no privileges or user interaction required) can invoke these CGIs directly and change device configuration or behavior, with critical-rated impacts on the confidentiality, integrity, and availability of the recorder and dependent systems such as recorded video and surveillance operations. Organizations running VMAX DVR/NVR appliances — typically commercial and physical-security video deployments — are affected. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild, though exposed recorder web interfaces are routine targets once network access is obtained.

Do: Apply the vendor firmware update for the VMAX DVR/NVR lineups as described in the ICS-CERT advisory and confirm the patched build is running. Because exploitation requires adjacent-network access, place recorders on a dedicated VLAN or behind firewall rules so only trusted clients can reach their CGI/web endpoints. Rotate any default credentials and review device logs for unexpected configuration changes or CGI requests.

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.

The @zereight/mcp-gitlab MCP server (version 2.1.18, npm) registers its Streamable HTTP transport at /mcp without any Host or Origin allowlist and without the MCP SDK's DNS-rebinding protections (enableDnsRebindingProtection, allowedHosts, allowedOrigins are never set; express.() is installed globally before any origin check). Because the server binds to 127.0.0.1 by default, a malicious web page can use DNS rebinding to make a victim's browser send cross-origin requests to the local MCP listener with attacker-controlled Host and Origin headers, which the server accepts and processes through the MCP initialize path instead of rejecting at the HTTP boundary. In default local mode this lets the attacker's page drive the MCP session and invoke GitLab tools from the victim's machine; in REMOTE_AUTHORIZATION=true mode, unauthenticated tools/list and GitLab API calls are blocked by token checks, but the browser-boundary flaw remains and a captured/planted Private-Token flow still allows tool listing and calls such as list_project_variables against the victim's GitLab. Affected users are anyone running this package with the Streamable HTTP transport (documented for remote deployments), while stdio users are not directly exposed. The issue is rated CVSS 3.1 9.6 (critical); no public PoC or in-the-wild exploitation is known.

Do: Upgrade @zereight/mcp-gitlab to a release later than 2.1.18 once a fix ships (verify that StreamableHTTPServerTransport sets enableDnsRebindingProtection with allowedHosts/allowedOrigins, or that a Host/Origin-checking middleware runs before express.() and /mcp). Until then, prefer stdio over Streamable HTTP, do not expose the HTTP listener beyond loopback without a reverse proxy that strictly validates Host and Origin, and set REMOTE_AUTHORIZATION=true so tool calls require a GitLab token. Review server logs and metrics (totalSessions/activeSessions) for unexpected initialize requests or sessions originating from browsers.

The @zereight/mcp-gitlab MCP server (repository zereight/gitlab-mcp) is vulnerable to server-side request forgery (CWE-918) when the environment variable ENABLE_DYNAMIC_API_URL=true is set: the server honors an attacker-supplied X-GitLab-API-URL request header as the base URL for all outbound GitLab API calls, validating only URL syntax with no allowlist or hostname restriction. Because the server attaches the victim's GitLab Private-Token to every outbound fetch using that redirected URL, any caller who can reach the HTTP/SSE transport can point the server at an attacker-controlled host and capture the victim's token, giving full access to whatever GitLab projects and permissions that token grants. All versions through commit 74a8c83 are affected, and no patched version was available at the time of the report. The flaw is rated critical (CVSS 3.1 9.6; the advisory text also cites 8.5) and the report includes a working proof-of-concept, though no exploitation in the wild is known and it is not on the CISA KEV list.

Do: Do not set ENABLE_DYNAMIC_API_URL=true; leave the dynamic API URL feature disabled (its default state) until a patched release is published. If the flag was ever enabled on a network-reachable instance, rotate the configured GitLab private tokens immediately and review logs for outbound requests to unexpected hosts carrying private-token headers. Restrict access to the MCP HTTP/SSE endpoints (bind to localhost, firewall the port, require strong authentication) and monitor the upstream repository for a fix.

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login_required decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare server to issue an arbitrary HTTP POST to any URL the attacker supplies, including internal network addresses and cloud metadata services. No credentials, session cookies, or prior access are required. Version 1.6.16 contains a patch.

Fireshare, a self-hosted media and link sharing application, contains an argument injection flaw (CWE-88) in its video upload function in all versions prior to 1.6.14. An unauthenticated remote attacker can inject additional arguments into the upload processing path by sending a crafted request to the affected endpoint, allowing them to write or overwrite arbitrary files on the host system. Because the endpoint requires no authentication and the flaw carries a CVSS 3.1 score of 9.8 (network vector, low complexity, no privileges, no user interaction), any internet-reachable instance can be fully compromised through file overwrite leading to code execution or data destruction. Operators running Fireshare below 1.6.14 are affected; the issue is fixed in version 1.6.14. There is no known public proof of concept and the CVE is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

Do: Upgrade Fireshare to version 1.6.14 or later immediately. Until patched, remove the instance from public internet exposure (e.g., restrict access via VPN, firewall rules, or a reverse proxy with authentication) and disable the video upload endpoint. Review the server for unexpectedly created or modified files outside the media directories and rotate any credentials or secrets stored on the host in case of prior compromise.

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing VLAN(s) where the relay is configured can send a specially crafted packet that causes the DHCP Relay service to restart.

Tencent's Mass Service Engine in Cluster (MSEC) contains an unauthenticated path traversal flaw (CWE-22) that lets a remote attacker send a crafted POST request containing '../' sequences to write files outside the intended directory, such as a webshell. Once a webshell is uploaded, the attacker can execute arbitrary code with root privileges on the target device, giving full compromise of confidentiality, integrity, and availability. The attack requires no credentials and no user interaction, and is rated critical at CVSS 4.0 9.3. Any organization running an internet-reachable MSEC deployment is affected; no affected or fixed version numbers have been published. There is no known public proof of concept, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

Do: Immediately inventory for any Tencent MSEC deployments and remove or isolate management/API endpoints from the public internet (allow-list via VPN or firewall). Review web server and MSEC logs for POST requests containing '../' sequences and hunt for unexpected recently-added script/webshell files and unexplained root processes. Contact Tencent or monitor their advisories for a patched release, since no fixed version has been specified in the available data.

http4s Ember's HTTP/2 implementation buffers a frame's entire declared payload — up to 16 MiB, bounded only by the protocol's 24-bit length field — into contiguous memory before checking it against the advertised SETTINGS_MAX_FRAME_SIZE (16 KiB), because the validation in processFrame cannot run until the frame is fully assembled. An unauthenticated attacker triggers it simply by opening an HTTP/2 connection and declaring an oversized frame; no request, stream association, or credentials are required, and dribbling the payload without finishing evades rejection entirely since incomplete frames never reach validation. The result is uncontrolled resource consumption and remote denial of service by memory exhaustion — roughly 16 GiB of heap within reach at the default 1024 maxConnections — and the client side is symmetric because ember-client's readLoop shares the same code path. Only deployments explicitly built with .withHttp2 on ember-server or ember-client are affected; HTTP/2 is off by default on both builders. No public PoC exists, the CVE is not in CISA's KEV, and no exploitation in the wild is known.

Do: Upgrade to a patched http4s release as soon as one is published (track http4s security advisories for CVE-2026-88975), since the flaw sits in ember-core's H2Frame/H2Connection read loop and cannot be fixed in application code. Until then, disable HTTP/2 on Ember (it is off by default) or terminate HTTP/2 at a reverse proxy that enforces frame-size limits and speak HTTP/1.1 to the backend. Note that lowering SETTINGS_MAX_FRAME_SIZE or setting withIdleTimeout provides no mitigation — the check runs only after buffering and dribbled frames make steady read progress — so also monitor heap usage on any HTTP/2 listeners you cannot yet disable.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVE-2026-87288 is a difficult-to-exploit vulnerability in the Compiler component of Oracle GraalVM (Oracle Java SE), affecting only version 25.0.4.1. An unauthenticated remote attacker with network access via HTTP can trigger the flaw to compromise the GraalVM installation, and successful attacks can result in a complete takeover with high impacts on confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1 (high), but the high attack-complexity rating (AC:H) means reliable exploitation is challenging and likely requires timing, luck, or target-specific conditions. Organizations running GraalVM-based services, native-image builds, or polyglot runtimes on the affected version that are reachable over HTTP are exposed. No public proof-of-concept is known, there is no evidence of in-the-wild exploitation, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Upgrade Oracle GraalVM 25.0.4.1 to the version fixed in the corresponding Oracle Critical Patch Update as soon as it is available. Until patched, restrict HTTP and network access to GraalVM hosts (development machines, CI runners, and servers running GraalVM-based applications) to trusted sources only. Review logs on affected hosts for unexplained compiler activity or anomalous process behavior indicative of post-compromise behavior.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Oracle Agile PLM 9.3.6 (Application Server component of Oracle Supply Chain) contains an easily exploitable flaw reachable over HTTP that requires no authentication, no user interaction, and no privileges. A remote attacker who can reach the application server over the network can trigger the flaw to gain unauthorized access to critical data — up to complete access to all Oracle Agile PLM accessible data — and can cause a partial denial of service. The issue is scored CVSS 3.1 8.2 (high), with high confidentiality impact and low availability impact but no integrity impact. Organizations running the affected 9.3.6 release, especially any instance reachable from the internet, are at risk of sensitive product-lifecycle, engineering, and supply-chain data disclosure. No public proof of concept is known and the CVE is not on CISA's KEV list, so exploitation is not currently observed.

Do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87266 to all Agile PLM 9.3.6 Application Server instances, obtainable via My Oracle Support. Verify that no Agile PLM application server is exposed to the public internet — place it behind a VPN or restrict access at the firewall to trusted networks. Review access and HTTP server logs around the application server for anomalous unauthenticated requests or large data retrieval, and rotate credentials for accounts with access to Agile PLM data.

CVE-2026-87265 is an improper authorization flaw in the Oracle Purchasing module of Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. A low-privileged attacker with a valid account and network access via HTTP can exploit the flaw easily, without user interaction, to compromise Oracle Purchasing. A successful attack yields unauthorized creation, deletion, or modification of critical Purchasing data — or all Oracle Purchasing-accessible data — as well as unauthorized read access up to complete exposure of that data (high confidentiality and integrity impact, CVSS 8.1). Organizations running affected EBS 12.2.x releases with Purchasing exposed to authenticated users, especially internet-facing self-service deployments, are at risk. The flaw is not in the CISA KEV catalog, no public PoC is known, and no exploitation in the wild has been reported.

Do: Apply the Oracle Critical Patch Update that remediates this CVE to all EBS environments on 12.2.3–12.2.15. Restrict HTTP access to EBS via network segmentation or VPN so that only trusted, authenticated users can reach the Purchasing module, and enforce least privilege on responsibilities that grant Purchasing access. Review audit trails for recent purchase orders, requisitions, and supplier records to detect any unauthorized creation, modification, or deletion.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).

CVE-2026-87259 is a high-severity (CVSS 8.4) flaw in the Engineering Communication Interface component of Oracle Agile Engineering Data Management, part of Oracle Supply Chain, affecting version 6.2.1. It is exploited by a low-privileged attacker who already has a logon on the host or infrastructure where the product executes, making it a local privilege-escalation-style weakness rather than a remotely reachable flaw. Because of a scope change, a successful attack can compromise not only Agile EDM but also significantly impact additional products on the same infrastructure. The attacker gains unauthorized ability to create, delete, or modify critical data, as well as full read access to all data accessible through the product; availability is not affected. The vulnerability is not in the CISA KEV catalog, no public proof of concept is known, and there is no evidence of in-the-wild exploitation.

Do: Apply the Oracle Critical Patch Update that remediates this issue as soon as Oracle releases it, and check the Oracle advisory for the fixed build of Agile EDM 6.2.1. In the meantime, restrict and audit local OS accounts with logon access to servers hosting Agile EDM, enforce least privilege on those hosts, and monitor for unauthorized creation, deletion, or modification of engineering data via the Engineering Communication Interface.

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: SDK). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. While the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).