Denial Of Service Attack

org.grails:grails-databinding is vulnerable to Denial Of Service Attack. The vulnerability is due to a lack of validation in processing of web requests. An attacker can send specially crafted requests to cause a JVM crash or Denial of Service...

Grails Resource Management Error Vulnerability

Grails is a suite of open source frameworks for rapid web application development based on the Groovy programming language from the Grails project. Grails suffers from a resource management error vulnerability that originates from allowing an attacker to cause a denial of service DOS to the JVM v...

The vulnerability of the FortiWAN traffic balancing system lies in the incorrect restriction on the path name to the restricted access catalog. This allows a malicious actor to gain read, modify, or delete access to data, as well as execute arbitrary commands.

The vulnerability of the FortiWAN traffic balancing system lies in incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to gain read, modify, or delete access to data, as well as execute arbitrary commands by sending specially...

The vulnerability of the User macros function in the Nagios XI monitoring tool allows a hacker to gain access to read, modify, or delete data, or to cause a service failure.

The vulnerability of the User macros function in the Nagios XI monitoring tool is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data, or to cause a service failure by sending specially crafted HTTP...

The vulnerability of the graphical interface of the FortiSandbox threat detection and mitigation system allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the FortiSandbox threat detection and mitigation graphical interface is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks by sending specially crafted HTTP...

CVE-2023-22439

Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface Port 80 can be used to perform a Denial of Service of the diagnostic web interface. This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a...

WordPress Premium Starter Templates Plugin < 3.2.5 SSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.127659";...

The vulnerability of the Supplier Management sub-component of the Oracle iSupplier Portal, a component of the Oracle E-Business Suite, allows a malicious individual to gain access to and read data.

The vulnerability of the Supplier Management sub-component of the Oracle iSupplier Portal, a component of the Oracle E-Business Suite enterprise automation system, is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely,...

CVE-2023-44252

UNSUPPORTED WHEN ASSIGNED An improper authentication vulnerability CWE-287 in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values...

UBUNTU-CVE-2023-45725

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output,...

CVE-2023-41844

A improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 and above...

CVE-2023-41673

An improper authorization vulnerability CWE-285 in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests...

WordPress Premium Starter Templates Plugin < 3.2.5 SSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:brainstormforce:startertemplatespro"; if description...

The vulnerability of the `max_request_duration` component in the platform for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a perpetrator to trigger a service failure.

The vulnerability of the maxrequestduration component in the HashiCorp Vault and Vault Enterprise platforms for archiving corporate information involves unlimited resource allocation during HTTP request processing. Exploiting this vulnerability could allow a malicious actor to cause service...

PT-2023-7870 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: FortiADC versions 7.2.2 through 7.4.0 Description: The issue is related to an improper authorization procedure in the application delivery controller. This can be exploited by a remote attacker to gain unauthorized access to configuration fil...

The vulnerability of the aiohttp HTTP client arises from insufficient validation of input data, allowing attackers to modify existing HTTP requests or create new ones.

The vulnerability of the aiohttp HTTP client exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to modify existing HTTP requests or create new ones...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. PrestaShop suffers from a SQL injection vulnerability that stems from the module havi...

Microsoft Graphics Component Information Disclosure Vulnerability

Microsoft Graphics Component is a graphics driver component from Microsoft Corporation USA. An information disclosure vulnerability exists in Microsoft Graphics Component microsoft-graph-core that originates from a vulnerability that allows an attacker to craft HTTP requests to be able to access...

The vulnerability of the Cisco AnyConnect VPN client software, which is part of the Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) network devices, allows a attacker to cause a service outage.

The vulnerability of the Cisco AnyConnect VPN client software, which is part of the Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems, is related to an uncontrolled resource consumption during HTTPS requests processing. Exploiting this vulnerability can allow a...

aiohttp Injection Vulnerability

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. An injection vulnerability exists in aiohttp versions prior to 3.9.0, which stems from incorrect validation that allows an attacker to modify an HTTP request e.g., by inserting a new header, or even create...