Design/Logic Flaw

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Preferences. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

PT-2019-16435

Name of the Vulnerable Software and Affected Versions Oracle Health Sciences Data Management Workbench version 2.4.8 Description The issue allows a low-privileged attacker with network access via HTTP to compromise Oracle Health Sciences Data Management Workbench. Successful attacks can result in...

Oracle Commerce Platform Component Access Control Error Vulnerability

Oracle Commerce is the United States Oracle Oracle company's set of e-business solutions. Commerce Platform is one of them to provide a multi-functional e-business platform components. An access control error vulnerability exists in the Oracle Commerce Platform component. An attacker could exploi...

The vulnerability of the `ofproto_rule_insert__()` function in the Open vSwitch software multi-level switch allows a attacker to cause a service failure.

The vulnerability of the ofprotoruleinsert function in the microprogramming-based software for programmable multi-level switches called Open vSwitch OvS is related to errors in rule checking during flow processing. Exploiting this vulnerability could allow a malicious actor to cause service...

CVE-2019-2397

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker having Report privilege with logon to the infrastructure where Oracl...

Design/Logic Flaw

Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications subcomponent: Login. Supported versions that are affected are 8.1 and 8.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Argus Safety...

CVE-2018-3311

Vulnerability in the Oracle Retail Xstore Payment component of Oracle Retail Applications subcomponent: Security. The supported version that is affected is 3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Payment...

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

An issue was discovered in Open vSwitch OvS, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2, where the ofprotoruleinsert function inside ofproto/ofproto.c is affected by an assertion failure under certain circumstances. A specially crafted flow update applied using the bundling...

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

An issue was discovered in Open vSwitch OvS, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2, where the ofprotoruleinsert function inside ofproto/ofproto.c is affected by an assertion failure under certain circumstances. A specially crafted flow update applied using the bundling...

PT-2019-16414

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Cruise Shipboard Property Management System version 8.0.8 Description The issue allows an unauthenticated attacker with logon to the infrastructure where the system executes to compromise it. Successful attacks can result in...

PT-2019-16431

Name of the Vulnerable Software and Affected Versions Oracle FLEXCUBE Direct Banking version 12.0.2 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Direct Banking. Successful attacks require human interaction from a person other...

CVE-2019-6294

An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI...

PT-2019-18081

Name of the Vulnerable Software and Affected Versions EasyCMS version 1.5 Description An issue was discovered that allows for CSRF via the "index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent" URI. Recommendations For EasyCMS version 1.5, consider implementing proper...

Cross site request forgery (csrf)

DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account...

PT-2018-15363

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 Description The issue allows for a CSRF attack via the "upload/admin/manager.php?rec=insert" endpoint to add an administrator account. Recommendations For DouPHP version 1.5, consider implementing CSRF protection measures to...

postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements

It was discovered that PostgreSQL failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limit...

Amazon Linux AMI : postgresql96 (ALAS-2018-1119)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side...

Amazon Linux AMI : postgresql95 (ALAS-2018-1118)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side...

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

An issue was discovered in Open vSwitch OvS, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2, where the ofprotoruleinsert function inside ofproto/ofproto.c is affected by an assertion failure under certain circumstances. A specially crafted flow update applied using the bundling...