10114 matches found
CVE-2026-101469
A vulnerability exists in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues ), specifically affecting version 3.6.1 . A low privileged attacker with network access via SQL can exploit this difficult-to-exploit vulnerability to compromise the pro...
CVE-2026-101471
A vulnerability exists in the Installation Issues component of the Oracle Product Lifecycle Analytics product (version 3.6.1 ) within the Oracle Supply Chain suite. A low-privileged attacker with local access to the infrastructure can exploit this flaw to compromise the product, potentially gaini...
CVE-2026-112068
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...
CVE-2026-112070
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to...
CVE-2026-112068 Insecure Direct Object Reference in extension "Analytics" (analytics)
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...
EUVD-2026-104871
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...
CVE-2026-112068
The typo3-ext-sa-2026-031 extension (specifically the Analytics module) contains an Insecure Direct Object Reference (IDOR) vulnerability. The backend module fails to verify if a backend user has authorized access to a requested site, allowing users with module access to view the analytics dashbo...
EUVD-2026-104862
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to...
CVE-2026-112070 Broken Access Control in extension "Analytics" (analytics)
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to...
CVE-2026-112070
The Analytics extension (analytics) contains a Broken Access Control vulnerability due to a failure in the AJAX routes , which do not verify if a backend user has permission to access the associated module or dashboard widget. Consequently, any backend user can retrieve analytics data from sites ...
TYPO3-EXT-SA-2026-031: Insecure Direct Object Reference in extension "Analytics" (analytics)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031...
TYPO3-EXT-SA-2026-031: Broken Access Control in extension "Analytics" (analytics)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031...
PT-2026-120141
Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper bounds checking leads to a stack-based buffer overflow, which occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold. Th...
PT-2026-118307
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to...
PT-2026-119214
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Server. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...
PT-2026-119157
šØ CVE-2026-101469 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain component: Installation Issues. The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise...
PT-2026-118305
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...
Malicious code in @fcsmc/commercial-analytics (npm)
Source: ossf-package-analysis 2a6c1e570c16bbf3b94ecc31e622c4d31be7c8575c90eaffc238ca1ef36e659d The OpenSSF Package Analysis project identified '@fcsmc/commercial-analytics' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...
Malicious code in @fcsmc/commercial-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdca5cebb5734d25233e8016eb494ab6ec1a099899f0814fc846e46ad351582c The package ships an inert index.js stub but declares its sole dependency ltidisafe as a direct HTTPS tarball URL...
MAL-2026-17928 Malicious code in @fcsmc/commercial-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdca5cebb5734d25233e8016eb494ab6ec1a099899f0814fc846e46ad351582c The package ships an inert index.js stub but declares its sole dependency ltidisafe as a direct HTTPS tarball URL...