CVE-2023-21979

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

CVE-2023-21964

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

CVE-2023-21956

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic...

CVE-2023-21931

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

Code injection

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Services. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

Code injection

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2023-21996

CVE-2023-21996 affects Oracle WebLogic Server (Web Services component) with affected versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability allows an unauthenticated attacker, over HTTP, to cause a hang or frequent crash (DOS). The F5 advisory consolidates this vulnerability under CVE...

CVE-2023-21979

Oracle WebLogic Server (Core) vulnerability CVE-2023-21979 affects Oracle Fusion Middleware WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker can exploit over T3 to access or exfiltrate data, per multiple sources in the connected documents. The issue is a...

CVE-2023-21964

CVE-2023-21964 affects Oracle WebLogic Server Core, with vulnerable versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. The issue allows unauthenticated network access via T3 to trigger a hang or full crash (DoS). Several connected sources (Oracle APR 2023 CPU advisory, Nessus plugin, PT-2023-2481) c...

CVE-2023-21956

CVE-2023-21956 affects Oracle WebLogic Server (Fusion Middleware) Web Container. Affected: WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can compromise the server; attack requires user interaction and may lead to unauthorized update/i...

CVE-2023-21960

CVE-2023-21960 affects Oracle WebLogic Server (Core) with affected versions 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise WebLogic Server, enabling unauthorized update/insert/delete of data, unauthorized read access, and...

CVE-2023-21931

CVE-2023-21931 is a pre-auth, unauthenticated remote code execution/vulnerability in Oracle WebLogic Server (Fusion Middleware) affecting Core, with affected versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The public sources describe network access via T3 (and IIOP in related discussions) enabli...

rubygem-rack: crafted requests can cause shell escape sequences

A flaw was found in ruby gem-rack. This flaw allows a malicious actor to craft requests that can cause shell escape sequences to be written to the terminal via rack's Lint middleware and CommonLogger middleware. This issue can leverage these escape sequences to execute commands in the victim's...

Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file existence check exploit if they are not limiting who can query their server for...

Start from zero and scale to zero – Azure Spring Apps consumption plan

We are launching a new way to pay for Azure Spring Apps -- the consumption pricing plan. This plan is now in public preview so you can start creating and deploying apps today. This new plan is super-efficient because you can start from zero and scale to zero vCPU. You get more straightforward...

CVE-2023-26047

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...

CVE-2023-26047 teler-waf contains detection rule bypass via entities payload

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...

CVE-2023-26047 teler-waf contains detection rule bypass via entities payload

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...

CVE-2023-26047

CVE-2023-26047 affects the Go HTTP middleware teler-waf (pre-0.2.0). The issue is a bypass vulnerability where a specific case-sensitive hex-entities payload containing CR/LF and horizontal tab can bypass web-attack rules, enabling an attacker to inject and execute arbitrary JavaScript in victims...