Django vulnerable to Denial of Service via i18n middleware component

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

Django vulnerable to Denial of Service via i18n middleware component

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

Apache Tomcat Leaks Pathname Information via Error Message

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 /, and 4 %20/, which leaks the pathname in an error message...

Jetty HTTP Server Denial of Service vulnerability

HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service memory usage and application crash via HTTP requests with a large Content-Length...

Fusion Builder < 3.6.2 - Unauthenticated SSRF

Description The plugin, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network...

PT-2022-2795

Name of the Vulnerable Software and Affected Versions Oracle JDeveloper versions 12.2.1.3.0 through 12.2.1.4.0 Description The issue is related to errors in the code of the Oracle JDeveloper product, specifically the ADF Faces component. This can be exploited by a remote attacker using HTTP...

PT-2022-3116

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.58 through 8.59 Description The issue exists due to insufficient input validation in the Navigation Pages, Portal, Query component of Oracle PeopleSoft Enterprise PeopleTools. This allows a remote...

PT-2022-3112

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition version 5.9.0.0.0 Description The issue is related to a buffer overflow in the Visual Analyzer component of Oracle Business Intelligence Enterprise Edition, allowing a remote attacker to read dat...

PT-2022-3123

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description The issue exists due to insufficient input validation in the Attachments component of Oracle Agile PLM. This allows a remote attacker to gain unauthorized access to the device via HTTP requests...

PT-2022-2435

Name of the Vulnerable Software and Affected Versions Helidon versions 1.4.10 and 2.0.0-RC1 Description The issue exists due to insufficient input validation in the Reactive WebServer component of Helidon, allowing an unauthenticated attacker with network access via HTTP to compromise Helidon...

WordPress plugin Autolinks cross-site request forgery vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress plugin Autolinks has a cross-site request forgery vulnerability, which can be exploited by remote attackers to perform...

Race condition

A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to improper resource management in the HTTP server code. An attacker could exploit this...

CVE-2022-21210

An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Oracle Communications Billing and Revenue Management Connection Manager Insufficient Validation

The vulnerability of the Connection Manager component of the Oracle Communications Billing and Revenue Management software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise the confidentiality, integrity, an...

Delta Controls enteliTOUCH 3.40.3935 Cross-Site Request Forgery (CSRF)

Summary enteliTOUCH - Touchscreen Building Controller. Get instant access to the heart of your BAS. The enteliTOUCH has a 7-inch, high-resolution display that serves as an interface to your building. Use it as your primary interface for smaller facilities or as an on-the-spot access point for...

Code injection

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

PT-2022-3574

Name of the Vulnerable Software and Affected Versions SCALANCE X302-7 SCALANCE X304-2FE SCALANCE X306-1LD FE SCALANCE X307-2 SCALANCE X307-3 SCALANCE X307-3LD SCALANCE X308-2 SCALANCE X310 SCALANCE X320-1 FE SCALANCE X408-2 SCALANCE XR324-4M SCALANCE XR324-12M SIPLUS NET SCALANCE X308-2 Descripti...

[SECURITY] [DLA 2973-1] minidlna security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2973-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz April 10, 2022 https://wiki.debian.org/LTS -...

Fortinet FortiWAN OS Command Injection Vulnerability

Fortinet FortiWan is a network appliance from Fortinet, Inc. It is used to perform load balancing and fault tolerance across different networks.An operating system command injection vulnerability exists in versions prior to Fortinet FortiWAN 4.5.9. An attacker could exploit this vulnerability to...

Fortinet FortiWAN SQL Injection Vulnerability

Fortinet FortiWan is a network appliance from Fortinet, Inc. It is used to perform load balancing and fault tolerance across different networks. SQL injection vulnerability exists in versions prior to Fortinet FortiWAN 4.5.9, which stems from a program that does not properly filter special elemen...