Securing GraphQL API

Introduction to GraphQL Representational state transfer REST APIs are the most popular type of API. However, GraphQL is rapidly growing in popularity as a competitor to REST. GraphQL is a meta-layer with built-in query language to access object-oriented data. It’s based on JSON-encoded HTTP...

The vulnerability of the OTA Training Activities sub-component of the Oracle Learning Management component in the Oracle E-Business Suite system allows a malicious user to gain access to and modify data.

The vulnerability of the OTA Training Activities sub-component of the Oracle Learning Management component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, add, or delete data...

The vulnerability of the Miscellaneous sub-component of the Oracle Scripting component in the Oracle E-Business Suite allows a perpetrator to gain access to and modify data.

The vulnerability of the Miscellaneous sub-component of the Oracle Scripting component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to read, modify, add, or delete data...

IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2020-30842)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...

Cisco Data Center Network Manager SQL Injection (CVE-2019-15984)

An SQL injection vulnerability exists in Cisco Data Center Network Manager. The vulnerability is due to insufficient input validation when processing HTTP requests in the Java class smartLicensingController...

CVE-2020-10719

A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...

CVE-2020-5562

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...

CVE-2020-5562

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...

CVE-2020-5562

CVE-2020-5562 is an SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3. A remote attacker with administrative privileges can trigger arbitrary HTTP requests to external web servers via the product’s V-CUBE Meeting function. The flaw is rooted in how the V-CUBE Meeting feature handles outbound req...

Cybozu Garoon Code Issue Vulnerability

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A code issue vulnerability exists in the V-CUBE Meeting feature in Cybozu Garoon versions 4.0.0 through 4.10.3. A...

Oracle JDeveloper ADF Faces Insecure Deserialization (CVE-2019-2904)

An insecure deserialization vulnerability exists in Oracle JDeveloper ADF Faces. This vulnerability is due to insufficient validation of HTTP requests...

CVE-2020-5868

In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP requests to the BIG-IQ user interface...

Improper access control

In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP requests to the BIG-IQ user interface...

CVE-2020-5868

In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP requests to the BIG-IQ user interface...

CVE-2020-5868

CVE-2020-5868 is a remote command execution vulnerability in F5 BIG‑IQ Centralized Management that leverages the Grafana component. Affected versions include BIG-IQ Centralized Management 6.0.0–6.1.0 and 7.x (e.g., 7.0.x); exploitation could allow a remote attacker to run local shell commands via...

Wotop - Web On Top Of Any Protocol

WOTOP is a tool meant to tunnel any sort of traffic over a standard HTTP channel. Useful for scenarios where there's a proxy filtering all traffic except standard HTTPS traffic. Unlike other tools which either require you to be behind a proxy which let's you pass arbitrary traffic possibly after ...

Ubuntu 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-4333-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4333-1 advisory. It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF...

Ubuntu: Security Advisory (USN-4333-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4333-1: Python vulnerabilities

It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. CVE-2019-18348 It was discovered that Python incorrectly handled certain HTTP requests. An attacker could possibly use this issue to cause a denia...