The vulnerability of the CORS component of Apache Tomcat servers allows attackers to access protected information.

The vulnerability of the CORS component in Apache Tomcat servers is related to insufficient access control. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected data using the HTTP protocol...

MiniShare Buffer Error Vulnerability (CNVD-2018-25030)

MiniShare is a file sharing system. A buffer overflow vulnerability exists in MiniShare version 1.4.1. An attacker can exploit this vulnerability by sending a long HTTP POST request to execute arbitrary code...

ruby: HTTP response splitting in WEBrick

It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client...

DEBIAN-CVE-2018-12116

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to...

httpd: DoS for HTTP/2 connections by continuous SETTINGS frames

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

The vulnerability of the WLS component – the Web Services server of Oracle WebLogic Server – allows a attacker to disclose sensitive information that is protected by this system.

The vulnerability of the WLS component—the Web Services server of Oracle WebLogic Server—is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information using the HTTP network protocol...

OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

Cisco RV180W Wireless-N Multifunction VPN Router WEB Framework Directory Traversal Vulnerability

The Cisco RV180W Wireless-N Multifunction VPN Router is a multifunction VPN router device. A directory traversal vulnerability exists in the Cisco RV180W Wireless-N Multifunction VPN Router WEB framework, which stems from the program failing to properly filter user-submitted input in HTTP request...

BSA-2018-710

Security Advisory ID : BSA-2018-710 Component : Apache HTTPD Revision : 1.0: Final In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only...

DEBIAN-CVE-2018-11763

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

ALPINE-CVE-2018-11763

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

CVE-2018-8479

A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK...

CVE-2018-15502

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

The vulnerability of the built-in web server of Schneider Electric’s Modicon Premium, Modicon Quantum PLC, Modicon M340, and Modicon BMXNOR0200 allows a perpetrator to execute arbitrary code.

The vulnerability of Schneider Electric Modicon BMXNOR0200 embedded web servers is related to an error in HTTP request analysis. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the web server using specially crafted HTTP requests...

The vulnerability of the Core component of the Primavera Unifier application, which allows a hacker to gain unauthorized access to protected data.

The vulnerability of the Core component of the Primavera Unifier application, which is used for automating project management processes, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protecte...

The vulnerability of the Layout Tools component of the BI Publisher software, which is used for creating reports, allows a malicious individual to gain unauthorized access to protected data.

The vulnerability of the Layout Tools component of the BI Publisher reporting software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

The vulnerability of the Outside In Filters component of the software development kit (SDK) provided by Outside In Technology allows a perpetrator to gain unauthorized access to protected data or cause service failures.

The vulnerability of the Outside In Filters component within the software development kit SDK of Outside In Technology is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected data or cause service failures...

The vulnerability of the Outside In Filters component of the software development kit (SDK) provided by Outside In Technology allows a perpetrator to gain unauthorized access to protected data or cause service failures.

The vulnerability of the Outside In Filters component within the software development kit SDK of Outside In Technology is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected data or cause service failures...

The vulnerability of the BI Publisher Security component of the BI Publisher reporting tool allows a malicious individual to gain unauthorized access to protected data.

The vulnerability of the BI Publisher Security component of the BI Publisher reporting tool is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

The vulnerability of the User Interface component of the Trade Management business platform allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the User Interface component of the Trade Management business platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...