Oracle E-Business Suite Remote Security Vulnerability (CNVD-2017-00645)

Oracle E-Business Suite is a fully integrated suite of global business management software from Oracle Corporation. Oracle Service Fulfillment Manager is one of the components that provide telecommunications providers, ISPs Internet Service Providers and similar vendor companies with the ability ...

Oracle E-Business Suite Remote Security Vulnerability (CNVD-2017-00655)

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A remote vulnerability exists in Oracle Partner...

Cisco Jabber Guest Server Open Redirect Vulnerability

Cisco Jabber Guest Server is the United States of America Cisco Cisco company's set of users to interact with the enterprise staff in real time software. A security vulnerability exists in Cisco Jabber Guest Server, which arises from the program's failure to adequately enforce access controls on...

CVE-2016-9205

A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon emsd to crash, resulting in a denial of service DoS condition. More Information: CSCvb14425. Known Affected Releases:...

Cisco IOS XR Software Denial of Service Vulnerability (CNVD-2016-12410)

Cisco IOS is the interconnected Internet operating system used on most Cisco Systems routers and network switches. A denial of service vulnerability exists in Cisco IOS XR Software's handling of HTTP 2.0 requests, which allows remote attackers to exploit the vulnerability by submitting a special...

OpenJDK: insufficient checks of JDWP packets (Hotspot, 8159519)

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol JDWP packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP request...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker coul...

CVE-2016-6839

CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

HTTP Information Disclosure Vulnerability

HTTP HyperText Transfer Protocol is one of the most widely used network protocols on the Internet. HTTP was designed to provide a means of publishing and receiving HTML pages, and the resources requested through the HTTP protocol are identified by Uniform Resource Identifiers URIs.HTTP/2 is one o...

Siemens SIPROTEC 4/SIPROTEC Compact Denial of Service Vulnerability

SIPROTEC 4 and SIPROTEC Compact devices provide a wide range of centralized protection, control and automation functions for substations and other applications. A denial of service vulnerability exists in Siemens SIPROTEC 4, SIPROTEC Compact devices, versions prior to EN100 Ethernet 4.29. A remot...

UBUNTU-CVE-2016-5137

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs,...

The vulnerability of the Cisco Wireless LAN Controller 4100 software allows for circumventing access restrictions.

Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to the widespread use of the Aironet IOS software. This leads to a state where the controller acts as an administrative HTTP server. Exploiting this vulnerability allows malicious actors to bypass access restrictions by...

DEBIAN-CVE-2016-5301

The parsechunkheader function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service crash via a crafted 1 HTTP response or possibly a 2 UPnP broadcast...

Multiple Huawei OceanStor Products Transmitting Token in Plaintext Vulnerability

Huawei OceanStor 5300 and others are storage products from Huawei, a Chinese company. A security vulnerability exists in multiple Huawei OceanStor products, which originates from a program sending session tokens in plaintext in HTTP headers. A remote attacker could exploit the vulnerability by...

Cisco RV110W/RV130W/RV215W Routers HTTP Request Buffer Overflow Vulnerability (CNVD-2016-04097 )

The Cisco RV130W Wireless-N is a multifunction VPN router; the Cisco RV110W/RV215W is a router that combines wired/wireless network connectivity, VPN, and firewall features. The Cisco RV110W/RV130W/RV215W routers have an HTTP request buffer overflow vulnerability that allows an unauthenticated,...

Trend Micro Worry-Free Business Security and Worry-Free Business Security Services HTTP Header Injection Vulnerability

Trend Micro Worry-Free Business Security and Worry-Free Business Security Services are both antivirus programs from Trend Micro. An HTTP header injection vulnerability exists in Trend Micro Worry-Free Business Security version 9.0 and Worry-Free Business Security Services version 5.x, which can b...

squid: Cache poisoning issue in HTTP Request handling

An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid...

squid: Header Smuggling issue in HTTP Request processing

An input validation flaw was found in Squid's mimegetheaderfield function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid...

Apple iOS/watchOS and OS X El Capitan MapKit Sensitive Information Disclosure Vulnerability

Apple iOS is an operating system on Apple's cell phones. oS X El Capitan is a specialized operating system developed for Mac computers. watchOS is a smartwatch operating system. Apple iOS\watchOS and OS X El Capitan's MapKit fails to properly handle HTTP and HTTPS requests, allowing an attacker t...