PT-2023-16291 · Tenable · Tenable.Sc

Name of the Vulnerable Software and Affected Versions: Tenable.sc affected versions not specified Description: A LDAP injection issue exists due to improper validation of user-supplied input. An authenticated attacker could generate data in Active Directory using the application account through...

IDOR vulnerability allowing to update another user's annotations

Description IDOR vulnerability was discovered in wallabag. Proof of Concept 1. Login as a victim. 2. Create an entry and an annotation. In this case the annotation's ID is 3. 3. Login as an attacker. 4. Send the following request. request http PUT /annotations/3 HTTP/1.1 Host: localhost:8000...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Crlf injection

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2022-36437

A flaw was found in Hazelcast and Hazelcast Jet. This flaw may allow an attacker unauthenticated access to manipulate data in the cluster...

CVE-2023-21844

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

Code injection

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

Oracle Java SE Security Update (jan2023) 02 - Windows

Oracle Java SE is prone to an input validation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Oracle Java SE Security Update (jan2023) 03 - Windows

Oracle Java SE is prone to an input validation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-21891

Oracle BI Enterprise Edition (Oracle Fusion Middleware) Visual Analyzer contains an input-validation flaw that allows a low-privileged, network-facing attacker to access or modify data via HTTP. Affected versions are 5.9.0.0.0 through 6.4.0.0.0; successful attempts may update/insert/delete data a...

PT-2023-1183 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Auomated Test Suite component of Oracle HCM Common Architecture. This easily exploitable vulnerability allows an...

PT-2023-1180 · Oracle · Oracle Learning Management +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Setup component of the Oracle Learning Management product. This can be exploited by a remote attacker to...

NVIDIA BMC 代码问题漏洞

NVIDIA BMC is an OpenBMC open software framework from NVIDIA. A security vulnerability exists in NVIDIA BMC. An attacker exploiting this vulnerability could upload and download arbitrary files under certain circumstances, resulting in a denial of service, privilege escalation, information...

Oracle Enterprise Manager Ops Center UI or Other Patch (Oct 2019 CPU)

The version of Oracle Enterprise Manager Ops Center installed on the remote host is affected by a vulnerability as described in the October 2019 Critical Patch Update CPU. Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager component: Networking jQuery. Support...

Vulnerabilities fixed in Discourse

Vulnerabilities have been fixed in Discourse. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Access to system data When the "Mermaid" component is in use, there is also the possibility...

Security Bulletin: IBM Security Verify Governance is vulnerable to unauthenticated access resulting in various threats (CVE-2022-21496)

Summary IBM Security Verify Governance is vulnerable to sensitive information access, data manipulation and denial of service by an unauthenticated attacker due to a vulnerability in Java SE related to the JNDI component CVE-2022-21496. The fix includes upgrading Java SE and Liberty to patched...

Apiman Vert.x Gateway has Transitive Hazelcast connection caching issue

Impact If you are using the Apiman Vert.x Gateway prior to Apiman 3.0.0.Final, a connection caching issue in Hazelcast could allow an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. Hazelcast is a transitive dependenc...

GHSA-Q2FJ-6H62-59M2 Apiman Vert.x Gateway has Transitive Hazelcast connection caching issue

Impact If you are using the Apiman Vert.x Gateway prior to Apiman 3.0.0.Final, a connection caching issue in Hazelcast could allow an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. Hazelcast is a transitive dependenc...