The vulnerability of Microsoft Windows Defender operating system allows attackers to trigger false alerts and incorrect Windows Defender service responses.

The vulnerability of Microsoft Windows Defender operating system is related to security configuration errors. Exploiting this vulnerability can allow attackers to trigger false alerts and incorrect responses by Windows Defender services...

UBUNTU-CVE-2019-19331

knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A...

Insecure Random Generator

github.com/miekg/dns uses an insecure random generation for transaction IDs. The default Id function uses an insecure math/rand function, resulting in predictable output and allowing an attacker to exploit the vulnerability to forge responses without being on path...

PT-2019-15812 · Cz.Nic +2 · Knot Resolver +2

Name of the Vulnerable Software and Affected Versions: knot-resolver versions prior to 4.3.0 Description: The issue allows for denial of service through high CPU utilization. This occurs when DNS replies contain a large number of resource records, which can be processed inefficiently. In extreme...

Unspecified vulnerability in miekg Go DNS package

miekg Go DNS package is a DNS server software package. A security vulnerability exists in miekg Go DNS package versions prior to 1.1.25 used in CoreDNS versions prior to 1.6.6 and other products, which stems from the program not properly generating random numbers. An attacker can exploit the...

OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

CVE-2019-18850

TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITEPATHQUERY"...

CVE-2019-18850

TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITEPATHQUERY"...

Unescaped exception messages in error responses in Jetty

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output...

Microsoft Windows DHCP Client DhcpExtractFullOptions Code Execution (CVE-2019-0697)

A remote code execution vulnerability exists in Microsoft DHCP Client. A remote attacker could exploit this vulnerability by sending maliciously crafted DHCP responses to a vulnerable Windows system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code...

CVE-2015-3167

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

CVE-2018-21029

A flaw in systemd-resolved was found to incorrectly verify certificates of a DNS resolver used for DNS Over TLS when the DNSOverTLS option is set to yes. A remote attacker in the network path between the vulnerable system and the DNS resolver may use this flaw to perform a man-in-the-middle attac...

The vulnerability of the Java Virtual Machine component of Oracle GraalVM Enterprise Edition and the Oracle Java SE and Oracle Java SE Embedded software allows attackers to compromise the integrity of protected information.

The vulnerability of the Java Virtual Machine component of Oracle GraalVM Enterprise Edition and Oracle Java SE, Oracle Java SE Embedded software products is related to errors in handling HTTP proxy responses. Exploiting this vulnerability can allow an attacker to compromise the integrity of...

CVE-2019-3979

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the domain that was queried. Therefore, a remote attacker controlled DNS server can poison the router's...

The vulnerability of the NTLMv2 network protocol implementation in Windows operating systems allows a hacker to carry out a “man-in-the-middle” type attack.

The vulnerability of the NTLMv2 network protocol implementation in Windows operating systems relates to the bypassing of security functions. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack by sending LMV2 responses...