7025 matches found
PT-2021-2918
Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.1.2.4 Description The issue exists due to insufficient input validation in the Task Automation component of Oracle Hyperion Financial Management. This allows a remote attacker to read data, modif...
PT-2021-2923
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description The issue is related to errors in the code of a subcomponent of Oracle Site Hub in the Oracle E-Business Suite system. It allows a remote attacker to gain unauthorized access t...
PT-2021-2845
Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description: The issue is related to errors in the code of the Loan Details and Loan Accounting Events components of the Oracle Loans product in Oracle E-Business Suite. This can be...
PT-2021-2927
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server version 10.3.6.0.0 Description The issue exists due to insufficient input validation in the Console component of Oracle WebLogic Server, allowing a remote attacker to modify, add, or delete data via HTTP requests...
PT-2021-2933
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description The issue is related to errors in the code of a subcomponent of Oracle Service Contracts in Oracle E-Business Suite. It allows a remote attacker to gain unauthorized access to...
PT-2021-2943
Name of the Vulnerable Software and Affected Versions Oracle Hospitality Inventory Management version 9.1.0 Description The issue exists due to insufficient input validation in the Export to Reporting and Analytics component of Oracle Hospitality Inventory Management. This allows a remote attacke...
PT-2021-2914
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.10 Description The issue is related to errors in the code of a subcomponent of Oracle E-Business Suite, specifically in the Time and...
Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management...
PT-2021-2863 · Cisco · Cisco Sd-Wan Vmanage
Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: The issue is related to errors in the authorization procedure of the Cisco SD-WAN vManage web interface. It allows a remote attacker to gain unauthorized access to...
SUSE: Security Advisory (SUSE-SU-2018:3963-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Server-Side Request Forgery (SSRF)
matrixsydent is vulnerable to server-side request forgery SSRF. An attacker is able to send HTTP GET requests on behalf of the server to internal systems due to lack of parameter validation or IP address blacklisting...
OpenClinic GA SQL Injection Vulnerability (CNVD-2021-29432)
OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the code parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attac...
OpenClinic GA SQL Injection Vulnerability (CNVD-2021-29426)
OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the description parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injectio...
CVE-2021-29430
Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it...
Design/Logic Flaw
Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it...
Command injection
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...
Rukovoditel SQL Injection Vulnerability (CNVD-2021-28755)
Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...
OutSystems Platform Server Server Cross-Site Request Forgery Vulnerability
Outsystems OutSystems Platform is a set of enterprise-level low-code development platform from OutSystems Outsystems. The platform is mainly used for the visual development of applications. A server cross-site request forgery vulnerability exists in OutSystems Platform Server, which can be...
OpenClinic GA SQL injection vulnerability
OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the serviceuid parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection...
