HTTP/2: flood using empty frames results in excessive resource consumption

A flaw was found in HTTP/2. Using frames with an empty payload, a flood could occur that results in excessive CPU usage and starvation of other clients. The highest threat from this vulnerability is to system availability...

PT-2020-12350 · Draytek · Draytek Vigor2960 +2

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 versions prior to 1.5.1 Draytek Vigor2960 versions prior to 1.5.1 Draytek Vigor300B versions prior to 1.5.1 Description: A stack-based buffer overflow in the apmd service allows remote attackers to achieve code execution via...

Unspecified Vulnerability in NETSAS Enigma NMS

NETSAS Enigma NMS is a suite of network management and monitoring tools from NETSAS Australia. A security vulnerability exists in NETSAS Enigma NMS version 65.0.0 and earlier, which stems from the program's use of a weak authentication mechanism over the HTTP protocol. The vulnerability can be...

HTTP/2: flood using SETTINGS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using SETTINGS frames and queuing of SETTINGS ACK frames, a flood could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...

The vulnerability of the Oracle Flow Builder component in the software for testing web applications, web services, and Oracle databases within the Oracle Application Testing Suite allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Oracle Flow Builder component, a software tool for testing web applications, web services, and databases within the Oracle Application Testing Suite, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker operating remotely to gai...

The vulnerability of the WLS Core Components of Oracle WebLogic Server application servers allows attackers to gain unauthorized access to protected information.

The vulnerability of the WLS Core Components component of Oracle WebLogic Server applications is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

The vulnerability of the Security component of the Oracle Demantra Demand Management platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Oracle Demantra Demand Management’s Security component is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

The vulnerability of the Company Dir/Org Chart Viewer component of the PeopleSoft Enterprise HCM Human Resources management platform allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Company Dir/Org Chart Viewer component of the PeopleSoft Enterprise HCM Human Resources management platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the Advanced UI interface of Oracle WebCenter Sites for online user services allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Advanced UI interface of Oracle WebCenter Sites for online user services is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTP...

The vulnerability of the Outside In Filters component within Oracle’s SDK for software development tools allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

The vulnerability of Juniper Networks’ Junos Space platform, related to the lack of protection for service data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Juniper Networks Junos Space network resource management platform is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information using specially...

The vulnerability of the Analytics Server component of the Oracle Business Intelligence Enterprise Edition allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Analytics Server component of the Oracle Business Intelligence Enterprise Edition software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Security and Authentication component of the Oracle Business Intelligence Enterprise Edition allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Security and Authentication component of the Oracle Business Intelligence Enterprise Edition is related to deficiencies in access control. Exploitation of this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthoriz...

The vulnerability of the Close Manager component of the Oracle Hyperion Financial Close Management application allows a perpetrator to gain unauthorized access to modify, add, or delete data.

The vulnerability of the Close Manager component of the Oracle Hyperion Financial Close Management application relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to modify, add, or delete data using the...

The vulnerability of the WLS Core Components of the Oracle WebLogic Server application server allows a hacker to gain full control over the application.

The vulnerability of the WLS Core Components component of Oracle WebLogic Server applications is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP protocol...

undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS

A vulnerability was found in the Undertow HTTP server listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service DOS to make the service unavailable on SSL...

The vulnerability of the Enterprise Config Management component of the Enterprise Manager Base Platform allows a malicious individual to gain access to modify, add, or delete data, to gain unauthorized access to protected information, or to cause service failures.

The vulnerability of the Enterprise Config Management component of the Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, gain unauthorized access to protected...

The vulnerability of the PIA Core Technology component of the PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the PIA Core Technology component in the PeopleSoft Enterprise PeopleTools business application suite is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data, or to unauthorizedly access...