Business-central 信息泄露漏洞

Business-central is a software package. A security vulnerability exists in Business-central that originates when logging into the Business-central console, an HTTP request, when intercepted, discloses sensitive information such as usernames and passwords...

DEBIAN-CVE-2021-33620

Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service affecting availability to all clients via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server...

HTTP Protocol Stack Code Execution

The vulnerability of the HTTP Protocol Stack in Microsoft Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created HTTP request...

PeopleSoft Enterprise CS Campus Community Unauthorized Access

The vulnerability of the Frameworks component in the Oracle PeopleSoft Enterprise CS Campus Community application is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using the HTTP protocol...

Oracle Cloud Infrastructure Storage Gateway Data Compromise

The vulnerability of the Management Console component in Oracle Cloud Infrastructure Storage Gateway is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information throu...

Oracle Cloud Infrastructure Storage Gateway Data Compromise

The vulnerability of the Management Console component in Oracle Cloud Infrastructure Storage Gateway is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information throu...

TopLink Integration Oracle WebLogic Server Unauthorized Access

The vulnerability of the TopLink Integration component of Oracle WebLogic Server applications exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP requests...

Rules Framework component of

The vulnerability of the Rules Framework component of the Oracle Financial Services Analytical Applications Infrastructure software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain read access to data or modify...

Oracle Site Hub Unauthorized Access

The vulnerability of the Sites sub-component of the Oracle Site Hub component in the Oracle E-Business Suite system for enterprise automation activities is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device...

Oracle E-Business Suite Receipts Unauthorized Access

The vulnerability of the Receipts sub-component of the Oracle Receivables component in the Oracle E-Business Suite system is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP requests...

Courseware Sub-component Oracle E-Business Suite Unauthorized Access

The vulnerability of the Courseware sub-component of the Oracle Quoting component in the Oracle E-Business Suite system’s enterprise automation activity system is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the...

python: CRLF injection via HTTP request method in httplib/http.client

A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat fr...

CVE-2021-31922

An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3...

Quote Oracle Lease Finance Management Unauthorized Access

The vulnerability of the Quotes sub-component of the Oracle Lease and Finance Management component within the Oracle E-Business Suite automation system is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device...

Oracle E-Business Suite Loan Details Loan Accounting Events Unauthorized Access

The vulnerability of the Loan Details and Loan Accounting Events subcomponents of the Oracle Loans component in the Oracle E-Business Suite is related to code errors. Exploitation of this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device through HT...

Oracle Secure Global Desktop Gateway Full Control

The vulnerability of the Oracle Secure Global Desktop software’s Gateway component is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP protocol...

Oracle Email Center Message Display Component Privilege Escalation

The vulnerability of the Message Display component of the Oracle Email Center messaging software, a part of the Oracle E-Business Suite for enterprise automation, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or...

CVE-2021-31898

In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS...

PT-2021-3092

Name of the Vulnerable Software and Affected Versions Microsoft HTTP Protocol Stack versions prior to the fixed version Description The issue is related to a memory usage problem after memory release in the HTTP Protocol Stack of Microsoft Windows operating systems. This can be exploited by a...

CVE-2021-1516

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA, Cisco Email Security Appliance ESA, and Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to access sensitive information on an affecte...