CKAN DataStore SQL Search - SQL Injection

CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastoresearchsql API endpoint. id: CVE-2026-42031 info: name: CKAN DataStore SQL Search - SQL Injection author: theamanrawat severity: high description...

CVE-2026-116817

OpenPanel versions prior to 3.0.0 are vulnerable to a missing authentication vulnerability (CWE-306) within the Worker Bull Board . This flaw allows unauthenticated attackers to access the Bull Board dashboard via the worker HTTP port. Specifically, attackers can query the /api/queues endpoint an...

Oracle PeopleSoft Enterprise PeopleTools security vulnerabilities

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 have security vulnerabilities. These vulnerabilities stem from issues with the Business Interlink component. Unauthorized attackers may gain access through HTTP network interactions that require user interaction. This allows...

Oracle Java SE security vulnerabilities

Security vulnerabilities exist in Oracle Java SE versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; as well as in Oracle GraalVM versions 17.0.20.1 and 21.0.12.1, and in Oracle GraalVM Enterprise Edition version 21.3.19.1.1. These vulnerabilities stem from issues withi...

Oracle Java SE security vulnerabilities

Oracle Java SE versions 21.0.12.1, 25.0.4.1, and 27 have security vulnerabilities. These vulnerabilities stem from issues with the Compiler component. Unauthorized attackers may gain network access through various protocols, resulting in unauthorized updates, insertion of or deletion of certain...

Oracle Siebel CRM Deployment Security Vulnerabilities

The Oracle Siebel CRM deployment from version 17.0 to 26.9 has security vulnerabilities. These vulnerabilities stem from issues with the Server Infrastructure component. Attackers with low privileges who have access through the network can cause the service to hang or crash frequently via HTTP...

Oracle Business Intelligence Enterprise Edition security vulnerabilities

Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 have security vulnerabilities. These vulnerabilities stem from issues with the Analytics Server component, which may allow attackers with low privileges and access through the network to unauthorizedly read certain...

Oracle MySQL Router permission licensing and access control issues

The Oracle MySQL Router version 26.7.0 contains vulnerabilities related to permission licensing and access control. These vulnerabilities stem from issues with the Router: General component, which may allow unauthenticated attackers to access through an HTTPS network. Unauthorized data reading...

Oracle REST Data Services security vulnerabilities

Oracle REST Data Services versions 24.2.0 to 26.1.0 have security vulnerabilities. These vulnerabilities stem from issues with the ADP component. Unauthorized attackers may exploit these vulnerabilities to access the system via HTTP. This could lead to unauthorized updates, insertions, or deletio...

Oracle Enterprise Manager Base Platform security vulnerabilities

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 have security vulnerabilities. These vulnerabilities stem from issues with the Security Framework component. They may allow unauthenticated attackers to access through the HTTP network, resulting in unauthorized updates, insertion of ...

Oracle JD Edwards EnterpriseOne Tools security vulnerabilities

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 to 9.2.26.5 have security vulnerabilities. These vulnerabilities stem from issues with the Web Runtime SEC component. Unauthorized attackers may gain access through the HTTP network. Under user interaction, unauthorized updates, insertions, o...

Oracle Timesten In-memory Database security vulnerability

A security vulnerability exists in Oracle Timesten In-memory Database versions 26.1 through 26.1.1.3.0. This vulnerability stems from issues within the TimesTen IMDB component and is difficult to exploit. Privileged attackers who gain access to the infrastructure can perform unauthorized updates,...

Oracle PeopleSoft Enterprise FIN Cash Management security vulnerabilities

The Oracle PeopleSoft Enterprise FIN Cash Management 9.2 version has a security vulnerability. This vulnerability stems from issues with the Cash Management component. It requires user interaction to be exploited. Attackers with high privileges who log in to the infrastructure running this produc...

Oracle BI Publisher security vulnerability

Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 have security vulnerabilities. These vulnerabilities stem from issues with the BI Publisher Security component. Unauthorized attackers may gain access through the HTTP network, allowing them to perform unauthorized updates, inser...

Oracle JavaFX security vulnerabilities

Oracle JavaFX versions 25.0.4 and 27 have security vulnerabilities. These vulnerabilities stem from issues with JavaFX components, which may allow unauthorized attackers to access network connections via various protocols. Unauthorized access can lead to unauthorized reading of certain accessible...

Oracle Solaris security vulnerabilities

Oracle Solaris 11.4 contains a security vulnerability stemming from an issue in the Services component. This vulnerability may allow low-privilege attackers to gain network access via HTTP, leading to service hangs or frequent crashes complete denial of service, and potentially unauthorized readi...

CVE-2026-111439 pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块

在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pgreadbinaryfileblocks 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 isrowdatafile...

CVE-2026-111439 pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块

在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pgreadbinaryfileblocks 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 isrowdatafile...

CVE-2026-111439

The openGauss-server software contains a permission validation logic flaw within the src/common/backend/utils/adt/genfile.cpp module, specifically in the pg_read_binary_file_blocks() built-in function. The vulnerability exists because the function only validates the range of the start block numbe...

CVE-2026-111439: Missing Authorization

在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pgreadbinaryfileblocks 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 isrowdatafile...