HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Oracle WebLogic Server Console Full Control

The vulnerability of the Console sub-component of the Oracle WebLogic Server application server software, part of the Oracle Fusion Middleware platform, is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control...

Segment Component Data Access Privilege Escalation

The vulnerability of the Segment component in Oracle Retail Customer Management and Segmentation Foundation software relates to access control deficiencies. Exploiting this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or gain unauthorized access to...

Oracle WebLogic Server Web Services Unauthenticated Access

The vulnerability of the Web Services sub-component of the Oracle WebLogic Server application server, a software platform of Oracle Fusion Middleware, is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

HTTP/2: flood using SETTINGS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using SETTINGS frames and queuing of SETTINGS ACK frames, a flood could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using empty frames results in excessive resource consumption

A flaw was found in HTTP/2. Using frames with an empty payload, a flood could occur that results in excessive CPU usage and starvation of other clients. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Siemens Desigo PX Web Remote Denial of Service Vulnerability

Desigo-PX automation stations and operator units control and monitor building automation systems. They allow alarm signals, time-based programs and trend logging. A remote denial of service vulnerability exists in Siemens Desigo PX Web. An attacker could cause a denial of service condition on the...

Oracle Hospitality Reporting and Analytics Unauthorized Access

The vulnerability of the Oracle Hospitality Reporting and Analytics component in the Oracle Food and Beverage Applications suite is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data usin...

Portal sub-component PeopleSoft Enterprise PeopleTools Data Access

The vulnerability of the Portal subcomponent of the Oracle PeopleSoft Enterprise PeopleTools business application suite relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data, or to unauthorizedly access...

Oracle WebLogic Server SOAP with Attachments API Unauthorized Access

The vulnerability of the SOAP with Attachments API for Java application servers on Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

Oracle Fusion Middleware Mobile Service Sub-component Data Access Bypass

The vulnerability of the Mobile Service sub-component of the BI Publisher formerly XML Publisher software platform from Oracle Fusion Middleware is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

Analytics Actions sub-component of Unauthorized Access

The vulnerability of the Analytics Actions sub-component of the Oracle Business Intelligence Enterprise Edition software component of the Oracle Fusion Middleware platform is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating...

Oracle Hospitality Reporting and Analytics Unauthorized Access

The vulnerability of the Oracle Hospitality Reporting and Analytics component in the Oracle Food and Beverage Applications suite is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data usin...

PeopleSoft Enterprise HCM Human Resources Unauthorized Access

The vulnerability of the US Federal Specific sub-component of the PeopleSoft Enterprise HCM Human Resources package from Oracle PeopleSoft Products is related to inadequate access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

Oracle JDeveloper ADF Faces Full Control

The vulnerability of the ADF Faces sub-component of the Oracle JDeveloper component and the ADF software platform of Oracle Fusion Middleware is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the...

Outside In Filters Component Unauthorized Access

The vulnerability of the Outside component in the software development toolset SDK related to Outside in Technology is linked to insufficient access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to read, modify, add, or delete data...