nginx: Excessive CPU usage via flaw in HTTP/2 implementation

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngxhttpv2module not compiled by default if the 'http2' option of the 'listen' directive is used in a configuration file...

The vulnerability of the Process Analysis & Discovery component of the Business Process Management Suite allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the Process Analysis & Discovery component in the Business Process Management Suite is related to lack of access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

Junos OS: SRX Series: Credentials exposed when using HTTP and HTTPS Firewall Pass-through User Authentication

When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a...

msystem Remote Code Execution Vulnerability

msystem is a package used in Node.js for downloading and installing the MyStem morphological text analyzer. A security vulnerability exists in msystem that originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing...

Unspecified vulnerability in pk-app-wonderbox

pk-app-wonderbox is an app that integrates wonderbox and pillakloud. A security vulnerability exists in pk-app-wonderbox that originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the respons...

CVE-2018-0956

A denial of service vulnerability exists in the HTTP 2.0 protocol stack HTTP.sys when HTTP.sys improperly parses specially crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers...

Embedthis Software Appweb Embedthis HTTP Library Authentication Bypass Vulnerability

Embedthis Software AppWeb is a fast and small web server from Embedthis Software, USA, which is mainly used for embedded applications, devices and web services with support for security defense policies, digest authentication, virtual hosting, etc. HTTP library is one of the HTTP libraries. The...

UBUNTU-CVE-2015-5206

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168...

The vulnerability of the iOS operating system and the Mac OS X operating system allows attackers to compromise the security of information.

The vulnerability of the HTTPProtocol component in the iOS operating system and the Mac OS X operating system is related to errors in the code. Exploiting this vulnerability allows remote HTTP/2 servers to affect the security of the information being processed...

UBUNTU-CVE-2017-5446

An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

CVE-2017-2428

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves nghttp2 before 1.17.0 in the "HTTPProtocol" component. It allows remote HTTP/2 servers to have an...

CVE-2016-8329

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Mobile Application Platform. Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

Oracle Outside In Technology has an unspecified vulnerability (CNVD-2017-00917)

Oracle Outside In Technology is the United States Oracle Oracle company for software developers to provide a comprehensive set of solutions. It can be used to handle the access, conversion and control of content in more than 500 unstructured file formats. An unspecified vulnerability exists in...

Unspecified Vulnerability in Oracle FLEXCUBE Universal Banking (CNVD-2017-00942)

Oracle FLEXCUBE Universal Banking is the United States Oracle Oracle company's set of real-time, online coverage of retail, group, investment banking, a comprehensive solution. The program supports multi-currency, multi-language and multi-entity operations. A remote security vulnerability exists ...

Oracle FLEXCUBE Private Banking Security Bypass Vulnerability (CNVD-2017-00786)

Oracle FLEXCUBE Private Banking is a product of Oracle Corporation USA. It plans, records, tracks and manages client wealth across a range of asset classes and tools to increase financial advisor productivity and improve client relationships. A remote security bypass vulnerability exists in Oracl...

Oracle E-Business Suite Remote Security Vulnerability (CNVD-2017-00638)

Oracle E-Business Suite is a suite of fully integrated, global business management software from Oracle Corporation. Oracle Common Applications also known as Oracle Common Application Calendar, CAC is one of the components that can simplify the management of daily activities, appointments, and...

Oracle FLEXCUBE Private Banking Security Bypass Vulnerability (CNVD-2017-00789)

Oracle FLEXCUBE Private Banking is a product of Oracle Corporation USA. It plans, records, tracks and manages client wealth across a range of asset classes and tools to increase financial advisor productivity and improve client relationships. A remote security bypass vulnerability exists in Oracl...

Unspecified Vulnerability in Oracle Hospitality Applications

Oracle Hospitality Applications is a software from Oracle Corporation. A vulnerability in the "OPERA Application Login" of Oracle Hospitality Applications could be exploited by a remote attacker via the 'HTTP' protocol, affecting the confidentiality, integrity, and availability of the system...

BINOM3 Electric Power Quality Meter Sensitive Information Disclosure Vulnerability

The BINOM3 Electric Power Quality Meter is a universal multifunctional power quality monitor. BINOM3 Electric Power Quality Meter is vulnerable to sensitive information disclosure. Since the management portal is configured for HTTP by default, an attacker in the right position could sniff all log...

The vulnerability of the microprogramming software of the Harman AMX multimedia stream management system allows a intruder to gain access to protected information.

The vulnerability of the setUpSubtleUserAccount/bin/bw function in the Harman AMX multimedia stream management software exists due to the rigid encoding of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information...