PT-2022-7649

Name of the Vulnerable Software and Affected Versions Puma versions prior to 5.6.2 Puma version 4.3.11 Rails versions prior to 7.0.2.2 Rails versions prior to 6.1.4.6 Rails versions prior to 6.0.4.6 Rails versions prior to 5.2.6.2 Description The issue is related to information leakage due to Pum...

Possible exposure of information vulnerability in Action Pack

Impact Under certain circumstances response bodies will not be closed, for example a bug in a webserver https://github.com/puma/puma/pull/2812 or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for...

CVE-2022-23633 Exposure of sensitive information in Action Pack

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to dat...

CVE-2022-23633 Exposure of sensitive information in Action Pack

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to dat...

Weak Password Vulnerability in InforSuite AS of CCTC Commercial Middleware Co.

Ltd. is a middleware technology research and product development company. A weak password vulnerability exists in InforSuite AS, which can be exploited by attackers to gain access to the server...

Oracle Business Intelligence Publisher (Jan 2022 CPU)

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware component: BI Publisher Security. Supported versions that are affected are 5.5.0.0, 5.9.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion

Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion Date: 25/1/2022 Exploit Author: Jonah Tan @picar0jsu Vendor Homepage: https://www.oracle.com Software Link: https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html Version: 12.1.3.0.0,...

Oracle WebLogic Server 14.1.1.0.0 Local File Inclusion

Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion Date: 25/1/2022 Exploit Author: Jonah Tan @picar0jsu Vendor Homepage: https://www.oracle.com Software Link: https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html Version: 12.1.3.0.0,...

Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion Vulnerability

Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion Exploit Author: Jonah Tan @picar0jsu Vendor Homepage: https://www.oracle.com Software Link: https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0...

Oracle WebLogic Server (Jan 2022 CPU)

The 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Cor...

Apache ShardingSphere Information Disclosure Vulnerability

Apache ShardingSphere is an open source distributed database middleware solution from the Apache Foundation.Apache ShardingSphere ElasticJob-UI is vulnerable to an information disclosure vulnerability that stems from the exposure of sensitive information to unauthorized participants, which could ...

Oracle WebLogic Server Input Validation Error Vulnerability (CNVD-2022-05875)

Oracle WebLogic Server is an application services middleware from Oracle for cloud and traditional environments that provides a modern, lightweight development platform that supports full lifecycle management of applications from development to production and simplifies application deployment and...

Oracle Access Manager Unknown Vulnerability (Jan 2022 CPU)

The version of Oracle Access Manager installed on the remote host is affected by the following vulnerability as noted in the January 2022 CPU advisory - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: OpenSSO Agent. Supported versions that are affected ar...

isomorphic-git 代码问题漏洞

isomorphic-git is a pure JavaScript implementation of open source git for node and browser environments including WebWorkers and ServiceWorkers. A security vulnerability exists in isomorphic-git cors-proxy versions prior to 2.7.1, which stems from a lack of cleanup and validation of redirect...

Oracle WebLogic Server Input Validation Error Vulnerability (CNVD-2022-05878)

Oracle WebLogic Server is an application services middleware from Oracle for cloud and traditional environments that provides a modern, lightweight development platform that supports full lifecycle management of applications from development to production and simplifies application deployment and...

Oracle Business Process Management Suite (Jan 2022 CPU)

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware component: Installer Apache Commons Compress. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access...

Oracle HTTP Server (Jan 2022 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by a vulnerability as referenced in the January 2022 CPU advisory: - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: OSSL Module Apache HTTP Server. Supported versions that are affect...

Oracle WebLogic Server Input Validation Error Vulnerability (CNVD-2022-25228)

Oracle WebLogic Server is an Oracle Oracle application service middleware for cloud and traditional environments, which provides a modern lightweight development platform that supports the entire lifecycle management of applications from development to production and simplifies application...

Oracle WebLogic Server Input Validation Error Vulnerability (CNVD-2022-05879)

Oracle WebLogic Server is an application services middleware from Oracle for cloud and traditional environments that provides a modern, lightweight development platform that supports full lifecycle management of applications from development to production and simplifies application deployment and...

CVE-2022-21371

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...