netty: Request smuggling via content-length header

A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The...

The vulnerability of the Customer Tab sub-component of the Oracle Customers Online component of the Oracle E-Business Suite allows a malicious actor to gain unauthorized access to the device and disclose protected information.

The vulnerability of the Customer Tab sub-component of the Oracle Customers Online component of the Oracle E-Business Suite is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device and disclose protected...

The vulnerability of the Thunderbird email client, as well as the Firefox and Firefox ESR browsers, relates to errors during permission saving, allowing a malicious actor to mistakenly assign a security certificate to an HTTP page.

The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to errors during the saving of permissions. Exploiting this vulnerability could allow a remote attacker to erroneously assign a security certificate to an HTTP page...

The vulnerability of the LOV sub-component of the Oracle Depot Repair component in the Oracle E-Business Suite automation system allows a malicious individual to gain unauthorized access to the device and disclose protected information.

The vulnerability of the LOV sub-component of the Oracle Depot Repair component in the Oracle E-Business Suite automation system is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device and disclose protected...

The vulnerability of the Document Management sub-component of the Oracle Document Management and Collaboration system, a business automation solution from Oracle E-Business Suite, allows an intruder to gain unauthorized access to the device and disclose protected information.

The vulnerability of the Document Management sub-component of the Oracle Document Management and Collaboration component in the Oracle E-Business Suite system relates to coding errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the devi...

The vulnerability of the iRecruitment component of the Oracle Human Resources workforce management software allows a hacker to gain access to data for editing, adding, or deleting.

The vulnerability of the iRecruitment component of the Oracle Human Resources staffing management software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTP protocol...

PT-2021-7372

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description A flaw in the HTTP client code of Python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat fro...

Mozilla: Secure Lock icon could have been spoofed

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

CVE-2021-2314

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Profiles. Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2021-2134

Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager component: FMW Control Plugin. The supported version that is affected is 12.2.1.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterpri...

Oracle Financial Services Analytical Applications 安全漏洞

Oracle Financial Services Analytical Applications Infrastructure is the Oracle Financial Services Analytical Applications Infrastructure that powers the Oracle Financial Services Analytical Applications family of products. A security vulnerability exists in the Rules Framework component of Oracle...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management and so on, a collection of management software, is a seamless integration of a management suite.Oracle Universal...

Oracle Business Intelligence Enterprise Edition 安全漏洞

Oracle Business Intelligence Enterprise Edition OBIEE is a business intelligence BI tool from Oracle Corporation. A security vulnerability exists in the Analytics Actions component in Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0. An attacker could...

wendu dio 注入漏洞

wendu dio is a wendu open source application system . Dart's powerful Http client , it supports interceptor , global configuration , FormData, request cancelation , file downloads, timeout and so on . dio package version 4.0.0 injection vulnerability , an attacker can use the vulnerability to...

CVE-2021-21409

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final there is a vulnerability that enables request smuggling. The...

The vulnerability of Squid’s request headers, related to HTTP request processing flaws, allows attackers to compromise data integrity.

The vulnerability of Squid proxy server requests is related to a lack of proper interpretation of HTTP requests. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

The vulnerability of Moxa VPORT 06EC-2V series IP cameras’ microprogramming software is related to integer overflow. This allows a intruder to trigger a service failure.

The vulnerability of Moxa VPORT 06EC-2V series IP cameras’ microprogramming software is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to trigger a service failure through a specially crafted HTTP request...

The vulnerability of Moxa VPORT 06EC-2V series IP cameras’ microprogramming software lies in the fact that the output operation goes beyond the buffer in memory, allowing an intruder to gain unauthorized access to the protected information.

The vulnerability of Moxa VPORT 06EC-2V series IP cameras’ microprogramming software is related to the escape of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a speciall...

Missing permission check in Team Foundation Server allows enumerating credentials IDs

Team Foundation Server 5.157.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

The vulnerability of Google Chrome’s HTTP protocol implementation lies in the improper implementation of security checks for standard elements, allowing attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of Google Chrome’s HTTP protocol implementation is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and accessibility of protected information...