deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-21579
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-21580
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-21581
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-21582
Published: 2025-04-15
Description: Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data as well as  unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-863
References: https://www.oracle.com/security-alerts/cpuapr2025.html
CVE: CVE-2025-21583
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.4.0 and  9.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-21584
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-21585
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-21586
Published: 2025-04-15
Description: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html
CVE: CVE-2025-21587
Published: 2025-04-15
Description: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition:20.3.17 and  21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://lists.debian.org/debian-lts-announce/2025/05/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-21588
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-24487
Published: 2025-04-15
Description: An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE: CVE-2025-27568
Published: 2025-04-15
Description: An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE: CVE-2025-27938
Published: 2025-04-15
Description: Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE: CVE-2025-27939
Published: 2025-04-15
Description: An attacker can change registered email addresses of other users and take over arbitrary accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE: CVE-2025-2497
Published: 2025-04-15
Description: A maliciously crafted DWG file, when parsed through Autodesk Revit, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0005
CVE: CVE-2025-30254
Published: 2025-04-15
Description: An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE: CVE-2025-30511
Published: 2025-04-15
Description: An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE: CVE-2025-30514
Published: 2025-04-15
Description: Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE: CVE-2025-30681
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 2.7 (LOW)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30682
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30683
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30684
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30685
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30686
Published: 2025-04-15
Description: Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: EMC).  Supported versions that are affected are 19.1-19.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data as well as  unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Simphony. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
CVSS Score: 7.6 (HIGH)
CWE: CWE-497
References: https://www.oracle.com/security-alerts/cpuapr2025.html
CVE: CVE-2025-30687
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30688
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30689
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30690
Published: 2025-04-15
Description: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem).   The supported version that is affected is 11. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H).
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html
CVE: CVE-2025-30691
Published: 2025-04-15
Description: Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and  24. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://lists.debian.org/debian-lts-announce/2025/05/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30692
Published: 2025-04-15
Description: Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments).  Supported versions that are affected are 12.2.7-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupplier Portal.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html
CVE: CVE-2025-30693
Published: 2025-04-15
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html; https://lists.debian.org/debian-lts-announce/2025/06/msg00005.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-30694
Published: 2025-04-15
Description: Vulnerability in the XML Database component of Oracle Database Server.  Supported versions that are affected are 19.3-19.26, 21.3-21.17 and  23.4-23.7. Easily exploitable vulnerability allows low privileged attacker having User Account privilege with network access via HTTP to compromise XML Database.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in XML Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of XML Database accessible data as well as  unauthorized read access to a subset of XML Database accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2025.html