Server-side Request Forgery (SSRF)

github.com/hoppscotch/proxyscotch is vulnerable to server-side request forgery. When the interceptor mode is set to proxy, An attacker can make HTTP requests to untrusted URLs through the main function of server.go and gain access to sensitive information...

PT-2022-13970

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2022.07 Description This issue allows for reflected cross-site scripting attacks, enabling the arbitrary execution of javascript code. This can lead to the theft of users' cookies, performance of HTTP requests,...

Talend Administration Center code-related vulnerabilities

Talend Administration Center is a web-based application from Talend that allows centralized studio management. A security vulnerability exists in Talend Administration Center that originates from the use of the "Add" function of the service registry to perform cross-site request forgery of HTTP G...

Information disclosure in web proxy error pages

...

Improper Authentication in Apache Tomcat

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests...

Django vulnerable to Denial of Service via i18n middleware component

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

Django vulnerable to Denial of Service via i18n middleware component

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

Apache Tomcat Leaks Pathname Information via Error Message

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 /, and 4 %20/, which leaks the pathname in an error message...

Jetty HTTP Server Denial of Service vulnerability

HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service memory usage and application crash via HTTP requests with a large Content-Length...

PT-2022-2795

Name of the Vulnerable Software and Affected Versions Oracle JDeveloper versions 12.2.1.3.0 through 12.2.1.4.0 Description The issue is related to errors in the code of the Oracle JDeveloper product, specifically the ADF Faces component. This can be exploited by a remote attacker using HTTP...

WordPress plugin Autolinks cross-site request forgery vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress plugin Autolinks has a cross-site request forgery vulnerability, which can be exploited by remote attackers to perform...

Fusion Builder < 3.6.2 - Unauthenticated SSRF

Description The plugin, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network...

PT-2022-3112

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition version 5.9.0.0.0 Description The issue is related to a buffer overflow in the Visual Analyzer component of Oracle Business Intelligence Enterprise Edition, allowing a remote attacker to read dat...

PT-2022-2435

Name of the Vulnerable Software and Affected Versions Helidon versions 1.4.10 and 2.0.0-RC1 Description The issue exists due to insufficient input validation in the Reactive WebServer component of Helidon, allowing an unauthenticated attacker with network access via HTTP to compromise Helidon...

PT-2022-3116

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.58 through 8.59 Description The issue exists due to insufficient input validation in the Navigation Pages, Portal, Query component of Oracle PeopleSoft Enterprise PeopleTools. This allows a remote...

PT-2022-3123

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description The issue exists due to insufficient input validation in the Attachments component of Oracle Agile PLM. This allows a remote attacker to gain unauthorized access to the device via HTTP requests...

Race condition

A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to improper resource management in the HTTP server code. An attacker could exploit this...

CVE-2022-21210

An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Oracle Communications Billing and Revenue Management Connection Manager Insufficient Validation

The vulnerability of the Connection Manager component of the Oracle Communications Billing and Revenue Management software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise the confidentiality, integrity, an...

Delta Controls enteliTOUCH 3.40.3935 Cross-Site Request Forgery (CSRF)

Summary enteliTOUCH - Touchscreen Building Controller. Get instant access to the heart of your BAS. The enteliTOUCH has a 7-inch, high-resolution display that serves as an interface to your building. Use it as your primary interface for smaller facilities or as an on-the-spot access point for...