5353 matches found
Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests
A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...
The vulnerability of the Squid proxy server, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to inject arbitrary HTTP headers.
The vulnerability of the Squid proxy server is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...
chromium-browser: Use after free in ANGLE
Use after free in ANGLE in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
UBUNTU-CVE-2020-8189
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html including local links when responding with invalid data on the login attempt...
UBUNTU-CVE-2020-14201
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code...
The vulnerability of the WordPress website content management system lies in the lack of measures to eliminate script-related HTML tags on web pages, allowing attackers to compromise data integrity.
The vulnerability of the WordPress website content management system is related to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to compromise data integrity...
Ubiquiti Networks EdgeSwitch Operating System Command Injection Vulnerability
The Ubiquiti Networks EdgeSwitch is a Gigabit network switch device from Ubiquiti Networks, Inc. A command injection vulnerability exists in the Ubiquiti Networks EdgeSwitch using firmware version v1.9.0. The vulnerability can be exploited to execute arbitrary shell commands with elevated...
DeepService Endpoint Monitoring Response Platform (EDR) Remote Command Execution Vulnerability
DeepTrust terminal detection and response platform EDR can help users quickly dispose of terminal security problems through cloud-network-terminal linkage and collaboration, threat intelligence sharing, and multi-level response mechanism, and build a next-generation terminal security system that ...
The vulnerability of the Mobile Service component of the BI Publisher software platform from Oracle Fusion Middleware relates to insufficient validation of input data. This allows a malicious individual to gain unauthorized access to protected information or to modify, add, or delete data.
The vulnerability of the Mobile Service component in the BI Publisher reporting tool, a software platform developed by Oracle Fusion Middleware, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software lies in insufficient validation of input data. This allows an attacker to gain unauthorized access to protected information or to modify, add, or delete data.
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Investor Servicing financial management software lies in insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information ...
The vulnerability of the Web Access component of the Oracle Primavera Portfolio Management software lies in insufficient validation of input data. This allows attackers to gain access to modify, add, or delete data.
The vulnerability of the Web Access component of Primavera Portfolio Management, a software solution for automating production process management, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or...
The vulnerability of Google Chrome’s general access mechanism allows a perpetrator to compromise data integrity.
The vulnerability of the Google Chrome browser’s general access mechanism is related to a bug in the system’s resource management mechanism. Exploiting this vulnerability allows an attacker to influence data integrity through a specially created HTML page...
The vulnerability of the Tile Server component of the Oracle Fusion Middleware MapViewer software allows a intruder to gain access to modify, add, or delete data.
The vulnerability of the Tile Server component of the Oracle Fusion Middleware MapViewer software relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTP protocol...
The vulnerability of the Attachments/File Upload component of the Oracle Applications Framework allows a perpetrator to gain access to modify, add, or delete data.
The vulnerability of the Attachments/File Upload component in the Oracle Applications Framework is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows an attacker to gain access to, modify, add, or delete data using the HTTP protocol...
The vulnerability of the Query component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain read, modify, add, or delete access to data.
The vulnerability of the Query component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify, add, or delete data using th...
The vulnerability in the full-screen mode of the Google Chrome browser allows a hacker to compromise data integrity.
The vulnerability of the full-screen mode of the Google Chrome browser is related to a bug in the system’s resource management mechanism. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially created HTML page...
The vulnerability of the Logging component of the Oracle Application Object Library allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Logging component of the Oracle Application Object Library relates to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...
The vulnerability of the Advanced User Interface component of the Oracle WebCenter Sites application allows a malicious actor to gain access to modify, add, or delete data, or to unauthorizedly access protected information.
The vulnerability of the Advanced User Interface component of the Oracle WebCenter Sites application for online user services is related to the lack of protective measures for the website structure. Exploiting this vulnerability may allow an attacker, operating remotely, to modify, add, or delete...
chromium-browser: Heap buffer overflow in history
Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...