CVE-2023-21916

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Web Server. Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris...

Code injection

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Web Server. Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris...

CVE-2023-21941

CVE-2023-21941 affects Oracle BI Publisher (Oracle Analytics) Web Server component. Affected versions are 6.4.0.0.0 and 12.2.1.4.0. The vulnerability allows a low-privilege, network-accessing attacker over HTTP to obtain unauthorized read access to a subset of Oracle BI Publisher data. CVSS 3.1 b...

CVE-2023-21916

CVE-2023-21916 affects Oracle PeopleSoft Enterprise PeopleTools Web Server, specifically the Web Server component in PeopleSoft versions 8.58–8.60. The vulnerability allows an unauthenticated attacker with network access via HTTP to read a subset of PeopleSoft data, per CVSS 3.1 base score 5.3 (C...

CVE-2023-26049: Exposure of Sensitive Information to an Unauthorized Actor

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " double...

PT-2023-2487

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher versions 6.4.0.0.0 and 12.2.1.4.0 Description The issue exists due to insufficient input validation in the Web Server component of Oracle BI Publisher. This allows a remote attacker to disclose protected information using...

CVE-2023-21916: Undefined Security Weakness

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Web Server. Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris...

PT-2023-2640

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.58 through 8.60 Description The issue exists due to insufficient input validation in the Web Server component of Oracle PeopleSoft Enterprise PeopleTools. This allows a remote attacker to gain...

CVE-2023-21941: Undefined Security Weakness

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. Supported versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful...

Denial of Service Vulnerability in Multiple Siemens Products (CNVD-2023-35756)

Siemens SIMATIC IPC DiagMonitor is a suite of system monitoring and troubleshooting software from Siemens, Germany.The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as...

Denial of Service Vulnerability in Multiple Siemens Products (CNVD-2023-35758)

Siemens SIMATIC IPC DiagMonitor is a suite of system monitoring and troubleshooting software from Siemens, Germany.The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as...

Denial of Service Vulnerability in Multiple Siemens Products (CNVD-2023-35759)

Siemens SIMATIC IPC DiagMonitor is a suite of system monitoring and troubleshooting software from Siemens, Germany.The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as...

Mars: Information Exposure Through Directory Listing

The vulnerability allowed an attacker to view the directory contents of the web server, leading to information disclosure. The directory listing function was not properly configured, exposing sensitive information...

OESA-2023-1230 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Apache HTTP Server versions 2.4.6 to 2.4.46 modproxywstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for...

OESA-2023-1222 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Apache HTTP Server versions 2.4.6 to 2.4.46 modproxywstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for...

CVE-2023-27747

BlackVue DR750-2CH LTE v.1.0122022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access sensitive information such as configurations and recordings...

Design/Logic Flaw

BlackVue DR750-2CH LTE v.1.0122022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access sensitive information such as configurations and recordings...

Anarchy in the UK? Not Quite: A look at the cyber health of the FTSE 350

The attack surface of the United Kingdom's 350 largest publicly traded companies has—drum roll, please—improved. But it could be better. Those are the high level findings of the latest in Rapid7's looks at the cybersecurity health of companies tied to some of the globe's largest stock indices. Th...

BlackVue DR750-2CH LTE 访问控制错误漏洞

BlackVue DR750-2CH LTE is an in-vehicle full HD monitor from BlackVue. A security vulnerability exists in the BlackVue DR750-2CH LTE version v.1.0122022.10.26 that stems from not authenticating in its web server. An attacker exploiting this vulnerability could access sensitive information such as...

CVE-2023-27747

CVE-2023-27747 affects BlackVue DR750-2CH LTE v.1.012_2022.10.26. The root cause is lack of authentication in the device’s web server, allowing an attacker to access sensitive information such as configurations and recordings. Multiple connected documents corroborate this description across sourc...