Huawei EulerOS: Security Advisory for qemu-kvm (EulerOS-SA-2019-1815)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Pachev FTP Server 1.0 Path Traversal

Exploit Title: Pachev FTP Server 1.0 - Path Traversal Date: 2020-01-23 Vulnerability: Path Traversal Exploit Author: 1F98D Vendor Homepage: https://github.com/pachev/pachevftp from ftplib import FTP ip = rawinput"Target IP: " port = intrawinput"Target Port: " ftp = FTP ftp.connecthost=ip, port=po...

The vulnerability of the Web Container (JavaServer Faces) component of the Oracle WebLogic Server application server allows a attacker to disclose sensitive information that is protected by security measures.

The vulnerability of the Web Container JavaServer Faces component of the Oracle WebLogic Server application server is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information using the HTTP...

The vulnerability of the File Upload component of Oracle Financial Services Revenue Management and Billing system allows a hacker to compromise data integrity or expose confidential information.

The vulnerability of the File Upload component in Oracle Financial Services Revenue Management and Billing system relates to unlimited uploading of sensitive files. Exploiting this vulnerability could allow a malicious actor to compromise data integrity or disclose confidential information using...

undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS

A vulnerability was found in the Undertow HTTP server listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service DOS to make the service unavailable on SSL...

CVE-2020-2684

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications component: Infrastructure. Supported versions that are affected are 12.0.1-12.4.0 and 14.0.0-14.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

CVE-2020-2576

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Filters. The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...

CVE-2020-2559

Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM component: UIF Open UI. Supported versions that are affected are 19.7 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attack...

Denial of Service Vulnerability in Quick Easy FTP Server (CNVD-2020-12893)

Quick Easy FTP Server is a small FTP server. A denial of service vulnerability exists in Quick Easy FTP Server. An attacker can exploit the vulnerability to cause a denial of service...

PYSEC-2019-137

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with t...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using empty frames results in excessive resource consumption

A flaw was found in HTTP/2. Using frames with an empty payload, a flood could occur that results in excessive CPU usage and starvation of other clients. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

The vulnerability of the syntax analysis function for URI identifiers of HTTP-servers of TP-Link TL-R600VPN microprogramming devices allows a perpetrator to cause a service failure.

The vulnerability of the syntax analysis function for URI identifiers of HTTP-servers of TP-Link TL-R600VPN software-based routers exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending a specially...

The vulnerability of the microprogramming software used in data collection and analysis devices of FortiAnalyzer and the centralized management system FortiManager allows a malicious individual to gain unauthorized access to the IPMI web interface.

The vulnerability of the microprogramming software used in data collection and analysis devices of FortiAnalyzer and the centralized management system FortiManager is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

CVE-2019-5255

Certain Huawei products AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981 have a DoS vulnerability. An attacker may send crafted messages from a FTP clie...

CVE-2019-19782

The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server...

The vulnerability of the FTP protocol implementation that supports Kerberos authentication, as provided by the libcurl library, relates to the reallocation of memory. This vulnerability allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the FTP protocol implementation that supports Kerberos authentication, when using the libcurl library, is related to a memory reclamation error. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service...

CVE-2019-18342

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The SFTP service default port 22/tcp of the Control Center Server CCS does not properly limit its capabilities to the specified purpose. In conjunction with CVE-2019-18341, an unauthenticated remote attacker wit...

The vulnerability of the FTP server of the EKRA 200 series micro-processor terminal allows a hacker to gain access to arbitrary data in the file system.

The vulnerability of the FTP server of the EKRA 200 series micro-processor terminals is related to security flaws in their mechanisms. Exploiting this vulnerability allows a malicious actor to gain access to arbitrary files on the file system using the RETR command...