Oracle Application Object Library Diagnostics Data Modification

The vulnerability of the Diagnostics component of the Oracle Application Object Library in the Oracle E-Business Suite automation system relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain access to and modify, add, or delete data using...

Oracle Trade Management UI Unauthorized Access Data Modification

The vulnerability of the User Interface component of the Oracle Trade Management application, part of the Oracle E-Business Suite, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or to...

Oracle REST Data Services Unauthorized Access

The vulnerability of the General component of the Oracle REST Data Services is related to security mechanism failures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information via the HTTP network protocol...

PT-2020-4492

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Suite8 versions 8.10.2 and 8.11 through 8.14 Description The issue is related to insufficient input validation in the WebConnect component of Oracle Hospitality Suite8, allowing a remote attacker to gain unauthorized access ...

DEBIAN-CVE-2020-13943

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it was possible that a subsequent request made on that connection could...

Information disclosure

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...

Oracle Commerce Guided Search Experience Manager Data Access

The vulnerability of the Workbench search engine component of Oracle Commerce Guided Search and the Oracle Commerce Experience Manager user environment management tool exists due to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to...

Marketing Administration Oracle Marketing E-Business Suite Data Modification

The vulnerability of the Marketing Administration sub-component of the Oracle Marketing component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to access and modify, add, or delete data...

HTTP-revshell - Powershell Reverse Shell Using HTTP/S Protocol With AMSI Bypass And Proxy Aware

HTTP-revshell is a tool focused on redteam exercises and pentesters. This tool provides a reverse connection through the http/s protocol. It use a covert channel to gain control over the victim machine through web requests and thus evade solutions such as IDS, IPS and AV. Help server.py unisessio...

Oracle Hyperion BI+ UI Visualization Unauthenticated Access

The vulnerability of the UI & visualization component of the Oracle Hyperion BI+ event service is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

Libraries Component Input Validation Unauthorized Access

The vulnerability of the Libraries component in Oracle Java SE and Java SE Embedded software platforms is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information, or to read, modify, add, or delete...

Oracle SD-WAN Edge UI Full Control

The vulnerability of the User Interface component of the Oracle SD-WAN Edge application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application using the HTTP protocol...

Oracle Business Intelligence Enterprise Edition Analytics Web General Full Control

The vulnerability of the Analytics Web General component of the Oracle Business Intelligence Enterprise Edition software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application through the...

Others Component Data Access

The vulnerability of the Others component in the Oracle iSupport web application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read, modify, add, or delete access to data using the HTTP protocol...

Oracle Configurator UI Servlet Data Access

The vulnerability of the UI Servlet component of the Oracle Configurator is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify, add, or delete data using the HTTP protocol...

Oracle Business Intelligence Enterprise Edition Analytics Actions Data Access

The vulnerability of the Analytics Actions component of the Oracle Business Intelligence Enterprise Edition software lies in deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to read, modify, add, or delete data using the HTTP protocol...

Oracle Financial Services Liquidity Risk Management Component Data Access

The vulnerability of the User Interface component of the Oracle Financial Services Liquidity Risk Management application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to read, modify, add, or delete da...

Oracle Financial Services Loan Loss Forecasting Data Access

The vulnerability of the User Interface component of the Oracle Financial Services Loan Loss Forecasting and Provisioning application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify, add, or...

Oracle Email Center Message Display Component Data Modification

The vulnerability of the Message Display component of the Oracle Email Center messaging software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to modify, add, or delete data using the HTTP protocol...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...