Oracle Hyperion Infrastructure Technology vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Oracle Hyperion Infrastructure Technology: 10 record(s), with affected versions and fixes.cpe:2.3:a:oracle:hyperion_infrastructure_technology
CVE-2026-35244
Medium · 5.2
CWE-284 Apr 21, 2026
Improper Access Control in Oracle Hyperion Infrastructure Technology
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version that is affected is 11.2.24.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 5.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N).
CVE-2020-5421
Medium · 6.5
Sep 19, 2020
RFD Protection Bypass via jsessionid
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-15358
Medium · 5.5
CWE-787 Jun 27, 2020
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a...
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
CVE-2020-13871
High · 7.5
CWE-416 Jun 6, 2020
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite...
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-11656
Critical · 9.8
CWE-416 Apr 9, 2020
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by...
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVE-2020-11655
High · 7.5
CWE-665 Apr 9, 2020
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a...
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
CVE-2020-1935
Medium · 4.8
CWE-444 Feb 24, 2020
HTTP Request Smuggling in Apache Software Foundation Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVE-2020-9327
High · 7.5
CWE-476 Feb 21, 2020
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference...
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.
CVE-2019-17563
High · 7.5
CWE-384 Dec 23, 2019
Session Fixation in Apache Software Foundation Tomcat
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
CVE-2019-10219
Medium · 6.1
CWE-79 Nov 8, 2019
Cross-site Scripting (XSS) in Red Hat Hibernate Validator
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.