Peoplesoft Enterprise Peopletools

PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.

Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.

Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.

Unauthorized data access in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 allows a low-privileged, authenticated network attacker to read a subset of PeopleTools data and perform unauthorized insert, update, or delete operations via the Panel Processor component, with a confirmed scope change meaning successful exploitation can extend impact to additional dependent products. The attack carries high complexity and requires human interaction from a third-party victim. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though Oracle's tagging of 'Authentication Bypass' suggests the Panel Processor may allow privilege escalation beyond what the attacker's credential level should permit.

Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.

SQL-based exploitation in Oracle PeopleSoft Enterprise PeopleTools Configuration Manager (versions 8.61-8.63) enables a low-privileged authenticated attacker to achieve full system takeover over the network. The vulnerability is rated CVSS 8.8 High with complete Confidentiality, Integrity, and Availability impacts, and Oracle's own description characterizes it as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad enterprise deployment footprint make this a credible priority for organizations running affected PeopleTools versions.

Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.

Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.

Full system takeover is achievable against Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 via an unauthenticated HTTP attack targeting the Integration Broker component. The vulnerability carries a CVSS 3.1 score of 8.1 with complete confidentiality, integrity, and availability impact, though the AC:H metric indicates exploitation is not trivial and requires meeting specific attack complexity conditions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack path and full-takeover impact class make this a high-priority patching candidate for organizations running affected PeopleTools versions.

Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.

Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.

Cross-site or client-side injection in Oracle PeopleSoft Enterprise PeopleTools Panel Processor (versions 8.61 and 8.62) enables unauthenticated remote attackers to achieve limited unauthorized data read and write access by luring an authenticated user into interacting with a crafted HTTP request. The attack requires no privileges and no special configuration, but depends on human interaction from a victim - consistent with a reflected attack surface in the Panel Processor UI component. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Despite the 'Authentication Bypass' tag, the CVSS vector and impact scope indicate this is a partial, integrity-and-confidentiality-affecting client-side flaw rather than a full authentication bypass.

Cross-user attack in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 enables a low-privileged network attacker to compromise confidentiality and integrity of data across component boundaries when a victim user interacts with attacker-controlled content. The Security component is the attack surface, consistent with stored or reflected client-side injection (e.g., XSS) that hijacks session or data context of another user. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Unauthorized data disclosure in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology component) allows a high-privileged attacker with HTTP network access to read critical or all accessible PeopleSoft data. Affecting supported versions 8.61 and 8.62, Oracle classifies this as easily exploitable despite the PR:H requirement, yielding a CVSS 3.1 score of 4.9 with confidentiality-only impact. No public exploit code and no CISA KEV listing exist at time of analysis; however, the 'Authentication Bypass' tag in the advisory metadata warrants attention in environments with multiple admin-tier users.

Cross-boundary exploitation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of data - including in additional downstream PeopleSoft products - by inducing a victim user to perform an action via HTTP. The CVSS scope-change indicator (S:C) and required user interaction (UI:R) are characteristic of a client-side injection class (e.g., stored or reflected XSS within the Security component) that crosses trust boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.

Cross-site scripting or client-side injection in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.62 permits a low-privileged, authenticated network attacker to compromise confidentiality and integrity of accessible PeopleTools data - and, due to a scope change, potentially additional Oracle products - when a victim user interacts with attacker-controlled content. The attack vector is HTTP, requires no elevated complexity, and is classified as easily exploitable. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the Critical Patch Update for July 2026.

Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.

Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.

Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Management component via unauthenticated HTTP requests. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation against any internet- or intranet-exposed instance, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language and the unauthenticated nature make this a high-priority patching target.

Broad data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.62 allows a low-privileged, network-adjacent attacker to reach any data the platform can access. The flaw sits in the Security component and is characterized by improper access control (CWE-284, tagged as Authentication Bypass), letting an authenticated-but-unprivileged user read, create, delete, or modify critical data across the deployment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.03%), and it is not on CISA KEV.

Improper access control in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of accessible data when a victim user interacts with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates successful exploitation can impact resources beyond the vulnerable component, consistent with client-side attack patterns such as stored or reflected XSS enabling cross-context data access. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), indicating negligible observed exploitation pressure at time of analysis.

Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.

Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.

Peoplesoft Enterprise Peopletools versions up to 8.60 is affected by cross-site scripting (xss) (CVSS 6.1).

Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 6.1).

Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 5.4).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).4.30 to 2.4.48 (inclusive). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

Malformed requests may cause the server to dereference a NULL pointer.4.48 and earlier. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

jsoup is a Java library for working with HTML. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

libcurl-using applications can ask for a specific client certificate to be used in a transfer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

There's a flaw in libxml2 in versions before 2.9.11. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Multichannel Framework). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.