Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 via a SOAP-based attack, but exploitation requires a user to interact with a malicious element (UI:R). This critical-severity issue (CVSS 9.6) has a scope change that can impact additional products beyond WebCenter Portal. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Oracle Managed File Transfer (MFT) Runtime Server, the file-transfer component of Oracle Fusion Middleware, allows an authenticated low-privileged attacker with network HTTP access to create, delete, modify, and read critical data handled by MFT, and the scope change (S:C) means a successful attack can escape the MFT trust boundary and impact additional Oracle products. The flaw is trivially reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 9.6), requiring no user interaction, but it is not pre-authentication: the attacker must already hold valid low-privileged credentials and be able to reach a MFT Runtime Server HTTP endpoint on versions 12.2.1.4.0 or 14.1.2.0.0. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (no CISA KEV listing); the 9.6 score reflects the confidentiality/integrity impact and cross-boundary scope change rather than observed exploitation, and the Oracle advisory provides no technical root-cause detail or CWE.
Authenticated attackers holding a low-privileged account can exploit the Authentication Engine in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTPS to read, create, delete, or modify all data reachable through the service, with CVSS 3.1 base score 9.6 reflecting high confidentiality and integrity impact and a scope change. The flaw is remotely reachable with low attack complexity and no user interaction, but it is not pre-authentication: a valid low-tier credential on the OAM instance is required, which is the main limiting factor on exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated access to the `/blacklist` endpoint of Maltrail (versions up to 3.0.1) allows any remote caller to retrieve source IP addresses of events that matched the operator's BLACKLIST rules, exposing internal network hosts flagged by the threat detection system. The oversight - a missing session check on one endpoint while all sibling endpoints (`/events`, `/counts`, `/hunt`, `/meta`, `/geo`) correctly required authentication - was confirmed by the vendor and patched in version 3.1 the same day it was reported. A public proof-of-concept exploit is available, making exploitation trivially scriptable against exposed instances.
Unauthenticated information disclosure in D-Link DIR-882 routers (firmware up to 20260814) allows remote attackers to retrieve sensitive data by sending crafted requests to the /HNAP1/dllog.cgi CGI binary endpoint. The vulnerability resides in the main() function of the dllog.cgi component, which fails to properly restrict output before returning it to the caller. A public proof-of-concept exists, per the GitHub reference, which also links this endpoint to quick VPN settings disclosure - suggesting credentials or configuration material may be exposed. No public KEV listing and no vendor patch have been identified at time of analysis.
Use-after-free in GPAC's LASeR scene graph command processing subsystem allows remote attackers to corrupt heap memory by supplying a crafted media file, potentially leading to process crash or code execution. Affected are GPAC builds up to commit f1219cde; the flaw stems from direct node-pointer assignment without proper reference counting in the LASeR decoder and scene graph command application paths. A public proof-of-concept exploit is confirmed available; vendor-released patch exists at commit e34f4ba and release abi-16.24.
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.
Authorization bypass in subhajitkhan's online-clinic-management-system lets a remote, unauthenticated attacker take over an administrator session by manipulating the adminmail argument processed by session_start() in adminappview.php, with no password or token required. Publicly available exploit code exists and the maintainer has not responded to the issue report filed against the project, so no fixed release is available. With CVSS 4.0 base metrics of AV:N/AC:L/PR:N/UI:N and E:P, impact is scored low across confidentiality, integrity and availability, but the resulting admin session can expose patient and appointment records.
Unauthenticated SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows remote attackers to inject arbitrary SQL through the ID argument of /delete_requirement.php, giving them read and write access to the application's clearance records. Publicly available exploit code exists (GitHub OnlyCMJB/cve issue 2), and the flaw is tracked by VulDB and ENISA EUVD, but CISA KEV does not list it as actively exploited. Because this is a demo-grade PHP application distributed as downloadable source with no vendor patch channel identified, exposure is concentrated among institutions that deployed it as-is on an internet-facing web server.
Unauthenticated SQL injection in the login handler (/College/login.php) of SourceCodester College Notes Gallery Management System 1.0 allows remote attackers to inject arbitrary SQL through the 'User' parameter. Publicly available exploit code exists (disclosed via a GitHub issue referenced by VulDB), and successful abuse can bypass authentication and expose or corrupt the backend database. The CVSS 4.0 base score is 5.5 with the E:P threat metric, reflecting limited but real confidentiality, integrity, and availability impact.
Unauthenticated remote SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows an attacker to inject arbitrary SQL through the ID argument of /delete_faculty1.php, exposing or destroying records in the underlying database. The CVSS 4.0 vector rates network-reachable, low-complexity, no-privilege, no-interaction exploitation with low confidentiality, integrity and availability impact (base 5.5), and publicly available exploit code exists, so unpatched internet-facing instances are immediately at risk. No CISA KEV entry or EPSS score was supplied, so there is no confirmed evidence of active exploitation in the wild at time of analysis.
SQL injection in zyx0814 FilePress up to version 3.0.1 allows remote unauthenticated attackers to manipulate database queries via the orderby and order parameters in dzz/publish/search.php. The Publish Module's search endpoint accepts unsanitized user-controlled sorting parameters directly into a SQL ORDER BY clause, enabling blind or time-based data extraction. A publicly available proof-of-concept exploit exists; the vendor has not responded to the coordinated disclosure report as of the time of analysis.
SQL injection in PHPGurukul Daily Expense Tracker System 1.1 exposes the unauthenticated forgot-password endpoint `/dets/forgot-password.php`, where the `email` and `contactno` parameters are passed unsanitized to backend SQL queries. Any remote, unauthenticated attacker can exploit this to read or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation; no KEV listing exists at time of analysis.
SQL injection in PHPGurukul Daily Expense Tracker System 1.1 allows unauthenticated remote attackers to manipulate the email parameter in the pre-authentication login form at /dets/index.php, enabling authentication bypass or database content extraction. A public exploit is available on GitHub, removing any meaningful skill barrier to exploitation. No vendor-released patch has been identified; the CVSS 4.0 score of 5.5 with all impacts rated Low reflects the application's narrow data scope rather than a general downgrade of the SQL injection risk class.
Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1) allows any remote caller who can reach the service to read configured agent names, roles and the first 100 characters of each agent's instructions via GET /api/agents, and to invoke a chosen agent through POST /api/chat, potentially reaching that agent's tools, memory, external APIs, credentials and workflow state. The default configuration binds to 0.0.0.0 with corsOrigins set to ['*'] and registers both routes without any authentication or authorization middleware (CWE-306), so the missing-authentication weakness applies unauthenticated over the network (CVSS 3.1 PR:N); version 1.7.2 is the vendor-released fix. No public exploit code has been identified at time of analysis, EPSS is low at 0.56% (45th percentile) and the issue is not in CISA KEV, but CISA SSVC rates it automatable with total technical impact and the exposure depends entirely on whether an operator has left AgentOS reachable on a routable interface.
A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.
Denial of service in Open5GS 2.7.7 and earlier lets a remote attacker crash the SGW-U/UPF process by sending a crafted PFCP Session Establishment or Modification Request containing a malformed Outer Header Creation IE. The handler fails to validate the Outer Header Creation description bits and payload length, so a failed GTP-U peer connection leaves a node with an unset address family in the peer list; a subsequent request referencing the same address reaches ogs_pfcp_far_f_teid_hash_set and aborts the process. Publicly available exploit code exists (GitHub issue #4699) and an upstream fix commit has been published, but the flaw is not listed in CISA KEV.
Unauthenticated SQL injection in WuzhiCMS 4.0 and 4.1.0 allows remote attackers to tamper with backend database queries through the article::getDataOfJson action, because the title and master_table parameters are passed into SQL statements without sanitization. Publicly available exploit code exists (referenced via the vendor's own GitHub issue tracker), and the upstream project has not responded or issued a fix at the time of analysis. The CVSS v4.0 score of 6.9 with an E:P threat metric reflects confirmed proof-of-concept availability rather than an abstract theoretical risk.
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
GitLab CE/EE instances that enforce SAML single sign-on can be bypassed by an authenticated user who signs in through another authentication path, because the sign-in enforcement check is missing (CWE-306). Affected releases are all versions from 18.6 up to 19.1.7, 19.2.x through 19.2.5, and 19.3.0/19.3.1; GitLab has published fixes in 19.1.8, 19.2.6 and 19.3.2. Publicly available exploit code exists (a HackerOne report is linked), but the issue is not listed in CISA KEV and no active exploitation has been confirmed; CVSS is a moderate 5.4 and impact is limited to partial confidentiality and integrity loss, not remote code execution or full account takeover of the platform.
Sandbox escape in Docker Sandboxes on macOS (0.28.0 through 0.41.x) lets a workload running inside a sandbox break out of its shared workspace and read or modify arbitrary files on the host as the VMM user, with host code execution possible where the reachable files are executable or otherwise privileged. The virtio-fs host server follows symlinks when reopening an unlinked file from a stored path, so a guest that replaces a parent directory of a workspace file with a symlink can redirect host-side file operations outside the workspace bind mount. Exploitation requires the attacker to already control a guest workload (for example an untrusted agent or repository), is macOS-specific, and depends on winning a directory-swap timing race; SSVC records Exploitation: none, and no public exploit code was identified at time of analysis. The raw 9.4 CVSS 4.0 score should be read alongside these preconditions rather than at face value - this is a genuine sandbox escape leading to host compromise, but it is not remotely reachable and is bounded by the privileges of the VMM user rather than root.
WP Directory Kit, a WordPress directory/listing plugin, exposes the content of draft and unapproved listings to anyone who can reach its public AJAX actions. Versions through 1.5.7 omit status and ownership checks before returning listing content, so unauthenticated attackers can enumerate other users' unpublished submissions (CWE-200, information disclosure). Publicly available exploit code exists per the WPScan reference, though EPSS is only 0.14% (4th percentile) and there is no CISA KEV listing, so this is a moderate, opportunistic-targeting issue rather than a mass-exploitation event.
A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard.
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
Unauthenticated attackers on the same adjacent network segment can compromise the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0), bypassing authentication to gain unauthorized read/write access to critical data, with scope change potentially affecting other Oracle products. This high-severity vulnerability (CVSS 9.3) requires local network adjacency but no credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated network attackers can obtain complete confidentiality and integrity compromise of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 through the Portlet Services component, but only after a legitimate portal user is induced to interact with attacker-influenced content - exploitation is gated by the UI:R prerequisite, which requires human interaction from a person other than the attacker. With a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), the flaw allows unauthorized creation, deletion or modification of, and complete read access to, data accessible through the portal, and because scope changes (S:C) the impact can extend to additional integrated products. There is no KEV listing and no public exploit identified at time of analysis, so this is a high-severity issue whose real-world risk is bounded by the need to socially engineer a valid portal user and by the narrow set of affected releases.
Improper authorization checks on GitLab CE/EE internal data emission endpoints let an authenticated user retrieve sensitive credentials and tokens that should only have been returned along the expected proxy path. All releases from 10.1.0 before 19.1.8, the 19.2 branch before 19.2.6, and the 19.3 branch before 19.3.2 are affected according to the vendor, and publicly available exploit code exists (HackerOne report 3907835). Impact is confidentiality-only (CVSS 5.3, C:L/I:N/A:N), with no CISA KEV listing and no EPSS score supplied in the source data.
Bambuddy, a self-hosted print archive and management system for Bambu Lab 3D printers, fails open when its database is unavailable: versions from 0.1.6 up to (but not including) 0.2.4.4 catch every exception in the authentication probe and treat the failure as 'auth disabled', granting unauthenticated access to every protected endpoint. A remote attacker with no credentials can force the condition by flooding the public /api/v1/auth/login endpoint until the process exhausts its file-descriptor budget so the next SQLite connect() raises, then timing requests into that transient window to create a persistent admin account or API key, download the database backup (hashed passwords, encryption keys, printer access codes, MFA secrets), alter settings, or control printers. Vendor/CISA scoring is critical (CVSS 4.0 9.3; vendor advisory states 9.8), while independent assessment rates it high with high attack complexity because the bypass exists only during the resource-exhaustion window; no public exploit code identified at time of analysis, no KEV listing, and CWE-636 (Failing Open) is the root class.
Unauthenticated remote command execution in Issabel Framework (the web framework bundled with Issabel PBX) lets any attacker who can reach the pbxapi endpoint forge valid HS256 JSON Web Tokens, because the signing key was a fixed string identical on every installation prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. With a forged bearer token the attacker calls the Asterisk manager originate endpoint using the System application parameter, causing Asterisk to execute arbitrary operating-system commands as the unprivileged Asterisk service user. Rated 9.3 (CVSS 4.0) / assessed 9.8 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and the Shadowserver Foundation observed exploitation evidence beginning 2026-09-09; there is no CISA KEV entry and no public exploit-code reference in the supplied data, but the hard-coded key is trivially recoverable from the public source, so treat exposure as urgent.
Heap-based buffer overflow in Ghostscript's JPEG 2000 (JPX) stream decoder (base/sjpx_openjpeg.c) allows unauthenticated remote attackers to corrupt memory, and potentially achieve code execution, by supplying a crafted PDF containing a JPEG 2000 image whose components declare mismatched subsampling factors. All Ghostscript/GhostPDL releases before 10.08.0 are affected; exploitation requires only that the target render the malicious file, which is effectively automatic in server-side pipelines such as CUPS/print spoolers, ImageMagick/GhostPDL conversion services and web PDF renderers, while desktop use requires a victim to open the document. Vendor-released patch: Ghostscript 10.08.0; no public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV), though the CVSS 4.0 base score of 9.3 reflects the trivial attack complexity and the high confidentiality, integrity and availability impact of a heap allocator corruption primitive.
Jpom through 2.11.12 exposes a broken object-level authorization flaw on the /build/branch-list endpoint, letting any authenticated user supply a repositoryId belonging to a different workspace and have the server resolve it without verifying ownership. This enables cross-workspace repository enumeration, disclosure of repository type, and execution of git ls-remote calls that reuse another workspace's stored Git credentials, leaking private repository metadata. Exploitation is low-complexity over the network with only a low-privileged account required, and publicly available exploit code exists, though the CVSS 4.0 base score is only 5.3 because the impact is limited to confidentiality.
Crafted Bidirectional Forwarding Detection (BFD) control packets can force authenticated BFD sessions on Arista EOS to drop, which in turn triggers reconvergence in the routing protocols that monitor those sessions (BGP, OSPF, IS-IS, or static-route failover) and can disrupt or blackhole traffic. The root cause is CWE-303, an incorrect implementation of the authentication algorithm: a packet that should fail BFD authentication is mishandled and can terminate the session, and the published CVSS 4.0 vector scores this 9.2 with unauthenticated network access (PR:N, UI:N) and high subsequent-system availability impact. Exposure is limited to devices running EOS 4.33.0-4.33.8M, 4.34.0-4.34.7M, 4.35.0-4.35.5M, or 4.36.0-4.36.1F that have authenticated BFD sessions explicitly configured; there is no public exploit identified at time of analysis and no CISA KEV listing.
Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access controls, splice a victim request onto an attacker-controlled prefix, or poison a caching layer, but only where ember-server runs as an origin behind a keep-alive intermediary that forwards both Transfer-Encoding and Content-Length headers and frames the body by Content-Length while Ember frames by chunked (a CL.TE mismatch); a standalone Ember server with no fronting proxy is not exploitable, and the client path only desyncs when a malicious or compromised upstream sends both headers over a pooled ember-client connection. The flaw affects http4s-ember-core 0.23.34 and earlier in the 0.23.x line, plus 1.0.0-M1 through 1.0.0-M46, with a parser that fails to treat dual-framed messages as the framing error RFC 9112 §6.1 requires; the vendor-assessed CVSS 4.0 score is 9.2, with the topology dependency captured by the AT:P metric. Fixed in 0.23.35 and 1.0.0-M47 (vendor-released patch); no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.
Code execution on the agent host is achievable in atomic-agents-stack through version 1.0.0 because the HTTP MCP server-registry backend factory accepts cleartext http:// catalog URLs alongside https://, letting a network man-in-the-middle rewrite catalog responses and inject arbitrary command/args values that MCPClientPool subsequently spawns as local subprocesses. The flaw is genuine but conditional and its real-world risk is materially lower than the 9.2 CVSS 4.0 headline suggests: exploitation requires an operator to have configured a cleartext http catalog URL (a deployment choice, not a default-reachable condition), an active man-in-the-middle position on the path to that catalog server, and no operator-authored allowlist (mcp_allow_fn defaults to None); the https:// path is not vulnerable because httpx verifies certificates and does not follow redirects. No authentication or user interaction is required and no LLM involvement is needed, no public exploit code has been identified at time of analysis (SSVC exploitation: none, automatable: no), and the vendor-released fix in 1.1.0 requires https by default and gates http:// behind an explicit opt-in.
Unauthenticated remote attackers can bypass the RDSTLS-disabling policy on FreeRDP servers 3.0.0 through 3.30.0 by sending incompatible protocol requests that produce a negotiation failure, then completing a TLS handshake and entering RDSTLS anyway, defeating the intended pre-authentication transport restriction. The vendor CVSS 4.0 base score is 9.2, but our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a policy bypass with limited confidentiality and integrity impact rather than direct code execution; no public exploit was identified at time of analysis. Only network-reachable FreeRDP server-mode deployments with RDSTLS administratively disabled are affected, while client-side FreeRDP deployments are not impacted.
Trust-boundary spoofing in the proxy-addr Node.js module (versions 1.1.0 through 2.0.7), the library that backs Express req.ip and req.ips, lets unauthenticated clients forge their apparent source address. When an operator declares a trusted-proxy subnet in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 rather than the correct /104), proxy-addr silently accepts it but trusts every IPv4 address on the internet, so the direct socket peer becomes trusted at hop 0 and any client can set an arbitrary X-Forwarded-For header. This is a fail-open regression introduced in 1.1.0, fixed in 2.0.8; no public exploit identified at time of analysis, and it is not in CISA KEV.
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via Oracle Net to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).