CVE-2021-32455

CVE-2021-32455 affects SITEL CAP/PRX firmware version 5.2.01. Affected component: firmware running on SITEL CAP/PRX devices. Root cause described as a resource/handling issue that allows an attacker with access to the device network to trigger a denial-of-service condition by sending HTTP request...

CVE-2021-32455 SITEL CAP/PRX vulnerable to a denial of service attack

SITEL CAP/PRX firmware version 5.2.01, allows an attacker with access to the device´s network to cause a denial of service condition on the device. An attacker could exploit this vulnerability by sending HTTP requests massively...

Unspecified Vulnerability in JetBrains WebStorm

JetBrains WebStorm is an application from the Czech company JetBrains. Provides an IDE for programming. A security vulnerability exists in JetBrains WebStorm versions prior to 2021.1. The vulnerability stems from the program's use of HTTP requests instead of HTTPS.No detailed vulnerability detail...

RHEL 8 : Red Hat OpenShift Service Mesh 1.1.14 (RHSA-2021:1540)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1540 advisory. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise...

The vulnerability of the Create Contracts sub-component of the Oracle Legal Entity Configurator, a component of the Oracle E-Business Suite, allows a violator to gain unauthorized access to the device.

The vulnerability of the Create Contracts sub-component of the Oracle Legal Entity Configurator, a component of the Oracle E-Business Suite, is related to code errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP...

The vulnerability of the India Localization sub-component and the Results component of Oracle Payables in the Oracle E-Business Suite automation system allows a perpetrator to gain unauthorized access to the device.

The vulnerability of the India Localization sub-component and the Results component of Oracle Payables in the Oracle E-Business Suite system are related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP...

istio/istio: HTTP request with escaped slash characters can bypass authorization mechanisms

An authorization bypass flaw was found in Istio. This flaw allows an attacker to craft an HTTP request that defines a certain pattern of escaped characters in the URI path such as %2F, %2f, %5C, or %5c, allowing them to bypass the authorization service. The highest threat from this vulnerability ...

CVE-2021-31898

In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS...

Design/Logic Flaw

In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS...

CVE-2021-31898

CVE-2021-31898 affects JetBrains WebStorm prior to 2021.1, where HTTP requests were used instead of HTTPS. The issue is documented across multiple sources (NVD entry and Red Hat/CNVD mirrors, PT-Security notes, and JetBrains’ security bulletin), with CVSS data indicating NETWORK access, low compl...

CVE-2021-31898

In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS...

Adobe Magento 路径遍历漏洞

Adobe Magento is the United States of America Odobie Adobe company's set of open source PHP e-commerce system . The system provides rights management, search engine and payment gateway features. A path traversal vulnerability exists in Adobe Magento. The vulnerability exists due to an input...

Totolink X5000R Operating System Command Injection Vulnerability

Totolink X5000R is a router from China's Gion Electronics Totolink. The TOTOLINK X5000R router suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary operating system commands by sending a modified HTTP request...

Server side request forgery (ssrf)

An SSRF issue in Open Distro for Elasticsearch ODFE before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope...

CVE-2021-31828

An SSRF issue in Open Distro for Elasticsearch ODFE before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope...

CVE-2021-1516

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA, Cisco Email Security Appliance ESA, and Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to access sensitive information on an affecte...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA, Cisco Email Security Appliance ESA, and Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to access sensitive information on an affecte...

CVE-2021-1516 Cisco Content Security Management Appliance, Email Security Appliance, and Web Security Appliance Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA, Cisco Email Security Appliance ESA, and Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to access sensitive information on an affecte...

CVE-2021-1516

CVE-2021-1516 affects Cisco AsyncOS Software on the Cisco Content Security Management Appliance (SMA), Email Security Appliance (ESA), and Web Security Appliance (WSA). Root cause: confidential information is included in HTTP requests exchanged between the user and the device, allowing an authent...

Server-Side Request Forgery (SSRF)

An SSRF issue in Open Distro for Elasticsearch ODFE allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope...