The vulnerability of the Profile component in the Oracle iSupport web application allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Profile component in the Oracle iSupport web application is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or unauthorizedly access protected information using the HTTP...

PT-2020-2236 · Cisco · Snort +3

Name of the Vulnerable Software and Affected Versions: Cisco IOS versions prior to the fixed version Cisco Firepower Threat Defense versions prior to the fixed version Cisco Firepower Management Center versions prior to the fixed version Description: The issue is related to errors in how the Snor...

Schneider Electric Modicon Quantum Has Arbitrary File Read Vulnerability

The Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process applications, high availability and safety solutions. An arbitrary file read vulnerability exists in the Schneider Electric Modicon Quantum. A remote attacker could exploit this vulnerability by...

The vulnerability of Firefox’s browser security policy, related to the lack of input data validation mechanisms, allows attackers to compromise data integrity.

The vulnerability of Firefox’s browser security policy is related to the lack of a mechanism for checking input data. Exploiting this vulnerability allows an attacker to compromise data integrity by using the HTTP protocol...

CVE-2020-2866

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Attachments / File Upload. Supported versions that are affected are 12.2.5-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2020-2837

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing...

UBUNTU-CVE-2020-2778

Vulnerability in the Java SE product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

HTTP/2: flood using empty frames results in excessive resource consumption

A flaw was found in HTTP/2. Using frames with an empty payload, a flood could occur that results in excessive CPU usage and starvation of other clients. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

HTTP/2: flood using empty frames results in excessive resource consumption

A flaw was found in HTTP/2. Using frames with an empty payload, a flood could occur that results in excessive CPU usage and starvation of other clients. The highest threat from this vulnerability is to system availability...

PT-2020-12350 · Draytek · Draytek Vigor2960 +2

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 versions prior to 1.5.1 Draytek Vigor2960 versions prior to 1.5.1 Draytek Vigor300B versions prior to 1.5.1 Description: A stack-based buffer overflow in the apmd service allows remote attackers to achieve code execution via...

Unspecified Vulnerability in NETSAS Enigma NMS

NETSAS Enigma NMS is a suite of network management and monitoring tools from NETSAS Australia. A security vulnerability exists in NETSAS Enigma NMS version 65.0.0 and earlier, which stems from the program's use of a weak authentication mechanism over the HTTP protocol. The vulnerability can be...

HTTP/2: flood using SETTINGS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using SETTINGS frames and queuing of SETTINGS ACK frames, a flood could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...

The vulnerability of the Oracle Flow Builder component in the software for testing web applications, web services, and Oracle databases within the Oracle Application Testing Suite allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Oracle Flow Builder component, a software tool for testing web applications, web services, and databases within the Oracle Application Testing Suite, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker operating remotely to gai...

The vulnerability of the Close Manager component of the Oracle Hyperion Financial Close Management application allows a perpetrator to gain unauthorized access to modify, add, or delete data.

The vulnerability of the Close Manager component of the Oracle Hyperion Financial Close Management application relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to modify, add, or delete data using the...