HTTP/2: flood using PRIORITY frames results in excessive resource consumption

A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability...

HTTP/2: large amount of data requests leads to denial of service

A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...

The vulnerability of the component responsible for checking the protocols of Microprogrammable Network Interface Cards from Cisco Firepower Threat Defense allows attackers to circumvent existing access control policies.

The vulnerability of the component responsible for processing SSL/TLS messages in Cisco Firepower Threat Defense microprogramming systems arises from errors in their processing of these messages. Exploiting this vulnerability allows a malicious actor to bypass existing access control policies by...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PRIORITY frames results in excessive resource consumption

A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability...

The vulnerability of the Infrastructure component of Oracle Retail Point-of-Service software allows a hacker to gain access to protected information, alter file access rights, or cause partial service disruption.

The vulnerability of the Oracle Retail Point-of-Service software’s infrastructure component is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain access to protected information, modify file access rights, or cause partial service interruptions...

Schneider Electric Modicon M340 PLC Has Denial of Service Vulnerability

Schneider Electric Modicon M340 is a medium-sized PLC from Schneider Electric, which has a wide range of applications in the industrial control field in China. A denial of service vulnerability exists in the Schneider Electric Modicon M340 PLC. The vulnerability can be exploited to cause a denial...

The vulnerability relates to the implementation of the HTTP/2 network protocol on Windows operating systems, Apache Traffic Server web servers, H2O web servers, network programming tools such as netty, SwiftNIO, Envoy, and the Node.js software platform. This allows attackers to induce service failures.

The vulnerability of the HTTP/2 network protocol implementation in Windows operating systems, Apache Traffic Server web servers, H2O web servers, network programming tools such as netty, SwiftNIO, Envoy, and Node.js software platforms is related to an uncontrolled resource consumption. Exploiting...

CVE-2019-15497

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

The vulnerability in the implementation of the HTTP/2 protocol for Firefox ESR, Firefox, and the Thunderbird email client allows a attacker to cause a service failure.

The vulnerability in the implementation of the HTTP/2 protocol in Firefox ESR browsers, Firefox browsers, and the Thunderbird email client relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of the URL parser in the Node.js library allows a hacker to gain unauthorized access to protected data.

The vulnerability of Node.js’s URL parser lies in errors during the processing of HTTP packets. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected data through HTTP requests...

ALPINE-CVE-2019-10081

HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client...

EUVD-2019-2135

HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client...

ALPINE-CVE-2019-9515

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost...

ALPINE-CVE-2019-9512

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU,...

PT-2019-2979 · Alt Linux +7 · Alt Linux +7

Name of the Vulnerable Software and Affected Versions: HTTP/2 implementations affected versions not specified Description: The issue is related to a flood of empty frames in HTTP/2 implementations, which can lead to a denial of service. An attacker sends a stream of frames with an empty payload a...

Cisco Firepower Threat Defense Policy Bypass Vulnerability

Cisco Firepower Threat Defense FTD is a suite of unified software from the U.S. company Cisco Cisco that provides next-generation firewall services. A policy bypass vulnerability exists in the Secure Sockets Layer SSL/Transport Layer Security TLS protocol inspection engine in Cisco FTD versions...

Cisco Small Business 220 Series Smart Switches Input Validation Error Vulnerability

Cisco Small Business 220 Series Smart Switches is a small smart switch device from Cisco USA. An input validation error vulnerability exists in Cisco Small Business 220 Series Smart Switches. An attacker can exploit this vulnerability by sending a malicious HTTP or HTTPS request to execute...