CVE-2020-10719

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...

varnish: denial of service handling certain crafted HTTP/1 requests

A flaw was found in the way Varnish parsed certain HTTP/1 requests. A remote attacker could use this flaw to crash Varnish by sending specially crafted multiple HTTP/1 requests processed on the same HTTP/1 keep-alive connection. This causes Varnish to restart with a clean cache, causing a denial ...

PT-2020-12298

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 2.1.1.Final Description A flaw was found in the processing of invalid HTTP requests with large chunk sizes, allowing an attacker to take advantage of HTTP request smuggling. Recommendations For versions prior to...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-1591)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to acce...

Oracle Financial Services Balance Sheet Planning Access Management

The vulnerability of the User Interface sub-component of the Oracle Financial Services Balance Sheet Planning banking analytics system’s simulation model relates to the lack of protection for operational data. Exploiting this vulnerability allows an attacker to create, delete, or modify access...

CVE-2020-10719: Inconsistent Interpretation of HTTP Requests

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...

CVE-2020-6091

An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can send an...

CVE-2020-6091

An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can send an...

Epson EB-1470Ui ESPON Web Control Authentication Bypass Vulnerability

Summary An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can...

Securing GraphQL API

Introduction to GraphQL Representational state transfer REST APIs are the most popular type of API. However, GraphQL is rapidly growing in popularity as a competitor to REST. GraphQL is a meta-layer with built-in query language to access object-oriented data. It’s based on JSON-encoded HTTP...

IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2020-30842)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...

Oracle Learning Management OTA Training Activities Data Access Modification

The vulnerability of the OTA Training Activities sub-component of the Oracle Learning Management component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, add, or delete data...

Oracle E-Business Suite Miscellaneous Sub-component Data Access Modification

The vulnerability of the Miscellaneous sub-component of the Oracle Scripting component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to read, modify, add, or delete data...

Cisco Data Center Network Manager SQL Injection (CVE-2019-15984)

An SQL injection vulnerability exists in Cisco Data Center Network Manager. The vulnerability is due to insufficient input validation when processing HTTP requests in the Java class smartLicensingController...

CVE-2020-10719

A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...

CVE-2020-5562

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...

CVE-2020-5562

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...

CVE-2020-5562

CVE-2020-5562 is an SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3. A remote attacker with administrative privileges can trigger arbitrary HTTP requests to external web servers via the product’s V-CUBE Meeting function. The flaw is rooted in how the V-CUBE Meeting feature handles outbound req...

Cybozu Garoon Code Issue Vulnerability

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A code issue vulnerability exists in the V-CUBE Meeting feature in Cybozu Garoon versions 4.0.0 through 4.10.3. A...