1941 matches found
USN-4600-1 netty-3.9 vulnerabilities
It was discovered that Netty had HTTP request smuggling vulnerabilities. A remote attacker could used it to extract sensitive information. CVE-2019-16869, CVE-2019-20444, CVE-2019-20445, CVE-2020-7238...
CVE-2020-3299
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker...
VulnCheck KEV: CVE-2020-2555
Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment...
Apache Tomcat HTTP Request Interpretation Data Compromise
The vulnerability of the Apache Tomcat application server is related to the inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality and integrity of the protected information...
DEBIAN-CVE-2020-10687
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...
Oracle Applications Framework Popups Component Data Access Privilege Escalation
The vulnerability of the Popups component in the Oracle Applications Framework exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to protected information...
Security Component Data Modification
The vulnerability of the Security component of the Oracle AutoVue data visualization application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to modify, add, or delete data using the HTTP protocol...
Data Domain & Function Security Oracle Transportation Management Unauthorized Access
The vulnerability of the Data, Domain, and Function Security component of the Oracle Transportation Management software lies in the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...
Primavera Portfolio Management Web Server Privilege Escalation
The vulnerability of the Web Server component of the Primavera Portfolio Management software for automating production processes exists due to insufficient verification of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to...
Security Framework Component Unauthorized Access
The vulnerability of the Security Framework component of the Oracle WebCenter Portal exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...
Oracle Business Intelligence Enterprise Edition Analytics Web General Unauthorized Access
The vulnerability of the Analytics Web General component of the Oracle Business Intelligence Enterprise Edition software exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...
Primavera Portfolio Management Access Modification
The vulnerability of the Web Access component of Primavera Portfolio Management software exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to protected...
SWSE Server Authorization Bypass
The vulnerability of the SWSE Server component of the Siebel UI Framework is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to protected information using the HTTP...
Investor Module Component Privilege Escalation
The vulnerability of the Investor Module component of Primavera Portfolio Management software exists due to insufficient verification of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or gain unauthorized access to protected...
Oracle Commerce Data Access
The vulnerability of the sub-component of the Dynamo Application Framework within the Oracle Commerce Platform of the e-commerce platform Oracle Commerce exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to remotely access and modify,...
Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests
A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...
Squid proxy CRLF Injection
The vulnerability of the Squid proxy server is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...
DeepService Endpoint Monitoring Response Platform (EDR) Remote Command Execution Vulnerability
DeepTrust terminal detection and response platform EDR can help users quickly dispose of terminal security problems through cloud-network-terminal linkage and collaboration, threat intelligence sharing, and multi-level response mechanism, and build a next-generation terminal security system that ...
Mobile Service component of Unauthorized Access
The vulnerability of the Mobile Service component in the BI Publisher reporting tool, a software platform developed by Oracle Fusion Middleware, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...
Oracle Primavera Portfolio Management Web Access Data Access
The vulnerability of the Web Access component of Primavera Portfolio Management, a software solution for automating production process management, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or...