httpd: mod_http2: DoS via slow, unneeded request bodies

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 modhttp2 connections...

CVE-2020-14750

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP...

The vulnerability of the Oracle Application Express Data Reporter component of the Oracle Database Server database management system allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Oracle Application Express Data Reporter component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the protected...

The vulnerability of the Database Filesystem component of the Oracle Database Server system allows a attacker to cause a service failure.

The vulnerability of the Database Filesystem component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures using the HTTP network protocol...

The vulnerability of the Oracle Application Express Group Calendar component of the Oracle Database Server database management system allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Oracle Application Express Group Calendar component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the protected...

CVE-2020-27651

Synology Router Manager SRM before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

Unspecified Vulnerability in Oracle Financial Services Analytical Applications Infrastructure

Oracle Financial Services Analytical Applications is a financial services analytics software from Oracle. A security vulnerability exists in Oracle Financial Services Analytical Applications that could be exploited by an attacker to compromise the Oracle Financial Services Analytical Applications...

Unspecified Vulnerability in Oracle Hospitality OPERA Property Services

Oracle Hospitality OPERA 5 Property Services is a Windows-based application component of Oracle Corporation for processing payment card payments. A security vulnerability in Oracle Hospitality OPERA 5 Property Services Logging version 5.5, 5.6 allows a highly privileged attacker to compromise...

USN-4600-1 netty-3.9 vulnerabilities

It was discovered that Netty had HTTP request smuggling vulnerabilities. A remote attacker could used it to extract sensitive information. CVE-2019-16869, CVE-2019-20444, CVE-2019-20445, CVE-2020-7238...

CVE-2020-3299

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker...

VulnCheck KEV: CVE-2020-2555

Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail...

The vulnerability of the Apache Tomcat application server, related to the inconsistent interpretation of HTTP requests, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Apache Tomcat application server is related to the inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality and integrity of the protected information...

DEBIAN-CVE-2020-10687

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

The vulnerability of the Security component of the Oracle AutoVue data visualization application allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Security component of the Oracle AutoVue data visualization application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to modify, add, or delete data using the HTTP protocol...

The vulnerability of the Popups component of the Oracle Applications Framework software platform allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Popups component in the Oracle Applications Framework exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to protected information...

The vulnerability of the Data, Domain & Function Security component of the Oracle Transportation Management software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Data, Domain, and Function Security component of the Oracle Transportation Management software lies in the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the Analytics Web General component of the Oracle Business Intelligence Enterprise Edition software platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Analytics Web General component of the Oracle Business Intelligence Enterprise Edition software exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the Security Framework component of the Oracle WebCenter Portal web platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Security Framework component of the Oracle WebCenter Portal exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

The vulnerability of the Web Server component of the Primavera Portfolio Management software allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Web Server component of the Primavera Portfolio Management software for automating production processes exists due to insufficient verification of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to...

The vulnerability of the SWSE Server component of the Siebel UI Framework allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the SWSE Server component of the Siebel UI Framework is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to protected information using the HTTP...