CVE-2020-5875

On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel TMM may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

PT-2020-2127

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.9 Description The issue is related to inadequate access control in the Attachments component of Oracle Document Management and...

PT-2020-2606

Name of the Vulnerable Software and Affected Versions Oracle Knowledge versions 8.6.0 through 8.6.3 Description The issue is related to insufficient input validation in the Web Applications - InfoCenter component of Oracle Knowledge, which can be exploited by a remote attacker to impact the...

PT-2020-2132

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.9 Description The issue is related to inadequate access control in the Diagnostics component of the Oracle Applications Framework. It can be exploited by a remote attacker to gain...

PT-2020-3471 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools version 9.2 Description: The issue is related to inadequate access control in the Monitoring and Diagnostics component of JD Edwards EnterpriseOne Tools, allowing an unauthenticated attacker with network access...

PT-2020-2540

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.1.2.4 Description The issue is related to insufficient access control in the Security component of Oracle Hyperion Financial Management. It allows a remote attacker to modify, add, or delete data...

PT-2020-2627

Name of the Vulnerable Software and Affected Versions Oracle Configurator versions 12.1 and 12.2 Description The issue is related to insufficient access control in the Installation component of the Oracle Configurator application. It allows a remote attacker to gain unauthorized access to protect...

PT-2020-2390

Name of the Vulnerable Software and Affected Versions Oracle Trade Management versions 12.1.1 through 12.1.3 Oracle Trade Management versions 12.2.3 through 12.2.8 Description The issue is related to insufficient access control in the Budget component of Oracle Trade Management. It can be exploit...

PT-2020-2304

Name of the Vulnerable Software and Affected Versions Oracle Advanced Outbound Telephony versions 12.1.1 through 12.1.3 Description The issue is related to insufficient access controls in the Calendar component of Oracle Advanced Outbound Telephony, allowing a remote attacker to gain unauthorized...

PT-2020-2322

Name of the Vulnerable Software and Affected Versions Oracle Marketing versions 12.1.1 through 12.1.3 Description The issue is related to insufficient access control in the Marketing Administration component of Oracle Marketing, allowing a remote attacker to gain unauthorized access to protected...

PT-2020-2299

Name of the Vulnerable Software and Affected Versions Oracle Marketing versions 12.1.1 through 12.1.3 Description The issue is related to insufficient access control in the Marketing Administration component of Oracle Marketing. It can be exploited by a remote attacker to gain unauthorized access...

PT-2020-2592

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise CS Campus Community version 9.2 Description The issue is related to insufficient access control in the Self-Service component of the PeopleSoft Enterprise CS Campus Community product. It allows a low-privileged attacker...

PT-2020-2531 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

WildPressure targets industrial-related entities in the Middle East

In August 2019, Kaspersky discovered a malicious campaign distributing a fully fledged C++ Trojan that we call Milum. All the victims we registered were organizations from the Middle East. At least some of them are related to industrial sector. Our Kaspersky Threat Attribution Engine KTAE doesn't...

PlayStation: SSRF chained to hit internal host leading to another SSRF which allows to read internal images.

Report Summary: We found an SSRF at https://image.api.np.km.playstation.net/ Vulnerable endpoints: /images , /dis/images. using image GET parameter. Description This endpoint allows us to fetch a remote image over HTTP protocol using the image GET parameter and convert them to the desired format...

CVE-2019-16067

NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication...

CVE-2019-16067

NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication...

HTTP Asynchronous Reverse Shell - Asynchronous Reverse Shell Using The HTTP Protocol

Today there are many ways to create a reverse shell in order to be able to remotely control a machine through a firewall. Indeed, outgoing connections are not always filtered. However security software and hardware IPS, IDS, Proxy, AV, EDR... are more and more powerful and can detect these attack...