The vulnerability of the API sub-component of the Oracle Installed Base component of the Oracle E-Business Suite allows a perpetrator to gain unauthorized access to the device.

The vulnerability of the API sub-component of the Oracle Installed Base component in the Oracle E-Business Suite system for automating business operations is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device...

The vulnerability of the User Interface sub-component of the Oracle Projects component in the Oracle E-Business Suite, which allows a malicious individual to gain unauthorized access to the device.

The vulnerability of the User Interface component of the Oracle Projects component in the Oracle E-Business Suite automation system is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP requests...

The vulnerability in the “Export to Reporting and Analytics” sub-component of the Oracle Hospitality Inventory Management component of the Oracle Food and Beverage Applications suite allows a malicious individual to gain unauthorized access to the device.

The vulnerability of the “Export to Reporting and Analytics” sub-component of the Oracle Hospitality Inventory Management component in the Oracle Food and Beverage Applications suite exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operatin...

The vulnerability of the Core component of the Oracle Coherence data processing software allows a hacker to gain unauthorized access to the device.

The vulnerability of the Core component of the Oracle Coherence data processing software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP requests...

The vulnerability of the Template and GTIN search components in the Oracle Product Hub system, a business automation solution from Oracle E-Business Suite, allows unauthorized access to devices by attackers.

The vulnerability of the Template sub-component and the GTIN search component of the Oracle Product Hub system, a business automation system within the Oracle E-Business Suite, is related to errors in the code. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

The vulnerability of the Intelligence and RFx sub-components of the Oracle Sourcing system, a business automation solution for Oracle E-Business Suite, allows a malicious individual to gain unauthorized access to the device.

The vulnerability of the Intelligence and RFx components of the Oracle Sourcing system, a component of the Oracle E-Business Suite, is related to code errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP requests...

IBM Cloud Pak for Security 输入验证错误漏洞

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A malicious data injection vulnerability exists in IBM Cloud Pak for Security...

The vulnerability of the Process Operations sub-component of the Oracle MES for Process Manufacturing component of the Oracle E-Business Suite allows a intruder to gain unauthorized access to the device.

The vulnerability of the Process Operations sub-component of the Oracle MES for Process Manufacturing component of the Oracle E-Business Suite is related to errors in the code. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to the device...

The vulnerability of the User Interface sub-component of the Oracle Labor Distribution component in the Oracle E-Business Suite allows a perpetrator to gain unauthorized access to the device.

The vulnerability of the User Interface sub-component of the Oracle Labor Distribution component in the Oracle E-Business Suite is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP requests...

Vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle E-Business Suite. This component allows unauthorized access by attackers to devices.

The vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle’s E-Business Suite, is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device...

envoyproxy/envoy: HTTP request with escaped slash characters can bypass Envoy's authorization mechanisms

An authorization bypass vulnerability was found in envoyproxy/envoy. An attacker can potentially craft an HTTP request that defines a certain pattern of escaped characters in the URI path such as %2F, %2f, %5C or %5c, allowing them to bypass the envoy authorization service. The highest threat fro...

CVE-2021-1284

A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authentication and authorization and modify the configuration of an affected system. To exploit this vulnerability, the attacker must be able t...

CVE-2021-1516

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA, Cisco Email Security Appliance ESA, and Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to access sensitive information on an affecte...

The vulnerability of the DBI Setup component of the Oracle E-Business Intelligence system, a business automation solution from Oracle E-Business Suite, allows a malicious individual to gain unauthorized access to the device and disclose protected information.

The vulnerability of the DBI Setup component of the Oracle E-Business Intelligence system, a business automation solution from Oracle E-Business Suite, is related to errors in the code. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the...

INIM ELECTRONICS SmartLiving System 代码问题漏洞

INIM ELECTRONICS SmartLiving System is an application of the Italian company INIM ELECTRONICS. A SmartLiving System. A security vulnerability exists in INIM ELECTRONICS SmartLiving System, which stems from a lack of validation of parameters, and can be exploited by an attacker to specify an...

eclipse: Help Subsystem does not authenticate active help requests

It was found that the Eclipse Platform does not authenticate requests to the Help subsystem on the local web server. A local attacker could use this vulnerability to disrupt the Eclipse user's session, potentially causing Eclipse to damage or disclose data owned by that user...

Subreddit Home Automation 跨站请求伪造漏洞

Subreddit Home Automation is an automation device for the Subreddit community. An automated electric light. A cross-site request forgery vulnerability exists in HomeAutomation version 3.3.2 that allows a user to perform certain actions via an HTTP request without performing any validity checks to...

Consul Enterprise Audit Log Bypass for HTTP Events

Summary A vulnerability was identified in Consul Enterprise such that a specially crafted HTTP request can be used to bypass the audit log for HTTP events. This vulnerability, CVE-2021-28156, affects Consul Enterprise versions 1.8.0 up to 1.9.4, and is fixed in the 1.9.5 and 1.8.10 releases...

GHSA-25XC-JWFQ-39JW OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 Vaadin 12.0.0 through 14.4.9, and 6.0.0 through 6.0.1 Vaadin 19.0.0 allows attacker to access application classes and resources on the server via crafted HTTP request. -...

PYSEC-2021-22

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perfor...