CVE-2019-18465

In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH SFTP interface. The vulnerability affects only certain SSH SFTP configurations, and is applicable only if the MySQL database is being used...

Schneider Electric Modicon M580/M340/BMxCRA/140CRA Denial of Service Vulnerability (CNVD-2019-41497)

The Modicon M580/M340/BMxCRA/140CRA are programmable logic controllers from Schneider Electric. A denial of service vulnerability exists in the Schneider Electric Modicon M580/M340/BMxCRA/140CRA. An attacker can exploit this vulnerability to cause a denial of service by upgrading the controller v...

Schneider Electric Modicon M580/M340/BMxCRA/140CRA Denial of Service Vulnerability

The Modicon M580/M340/BMxCRA/140CRA are programmable logic controllers from Schneider Electric. A denial of service vulnerability exists in the Schneider Electric Modicon M580/M340/BMxCRA/140CRA. An attacker could use this vulnerability to cause a denial of service by upgrading the firmware via t...

Schneider Electric Modicon M580/M340/BMxCRA/140CRA Denial of Service Vulnerability (CNVD-2019-41493)

The Modicon M580/M340/BMxCRA/140CRA are programmable logic controllers from Schneider Electric. A denial of service vulnerability exists in the Schneider Electric Modicon M580/M340/BMxCRA/140CRA. An attacker can exploit this vulnerability to cause a denial of service by upgrading the controller v...

The vulnerability of the BI Platform Security sub-component of the Business Intelligence Enterprise Edition software platform of Oracle Fusion Middleware allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the BI Platform Security sub-component of the Business Intelligence Enterprise Edition software platform of Oracle Fusion Middleware is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

The vulnerability of the Loan Calculator sub-component of the Oracle Banking Digital Experience component in the bank analytics system’s simulation model, allowing a perpetrator to access the ability to modify, add, or delete data.

The vulnerability of the Loan Calculator sub-component of the Oracle Banking Digital Experience component of the banking analytics system’s simulation model, Oracle Financial Services Applications, is related to lack of access control. Exploiting this vulnerability could allow a malicious actor t...

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server allows for uncontrolled resource consumption, enabling attackers to cause service failures.

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the Integration Broker sub-component of the PeopleSoft Enterprise PeopleTools component of the Oracle PeopleSoft Enterprise business application suite allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Integration Broker component of the PeopleSoft Enterprise PeopleTools business application package of Oracle PeopleSoft Enterprise is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

The vulnerability of the Stylesheet sub-component of the PeopleSoft Enterprise PeopleTools business application package from Oracle PeopleSoft Enterprise allows a hacker to gain access to modify, add, or delete data.

The vulnerability of the Stylesheet sub-component of the PeopleSoft Enterprise PeopleTools business application package from Oracle PeopleSoft Enterprise is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify,...

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server allows for uncontrolled resource consumption, enabling attackers to disclose sensitive information.

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

DEBIAN-CVE-2019-10079

Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Phorpiex Botnet Shifts Gears From Ransomware to Sextortion

A recent wide-scale campaign indicates that a decade-old botnet is shifting gears from distributing ransomware to delivering millions of sextortion threats to innocent recipients. Worse, researchers say that the botnet’s spam campaign can affect up to 27 million potential victims. The botnet,...

CVE-2019-3025

Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. The supported version that is affected is 5.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality RES 3700. While the...

CVE-2019-3012

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: BI Platform Security. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2019-2932

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Tree Manager. Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

The vulnerability of syntactic analysis in HTTP/1 and the HTTP accelerator Varnish allows attackers to induce a service failure.

The vulnerability of syntactic analysis in HTTP/1 and HTTP accelerator Varnish exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...