3257 matches found
PT-2024-41074 · Ооо 'Нпо Мир' · Контроллер Мир Кт-51 +3
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to the implementation of the HTTP protocol in software products, which involves the transmission of data in an open format. This could allow a remote attacker to disclos...
The vulnerability of the administrative interface of the FortiADC application controller allows a perpetrator to gain access to write arbitrary files.
The vulnerability of the FortiADC application delivery controller’s administrative interface is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain write access to arbitrary files by sending specially crafted HTTP or HTTPS requests...
The vulnerability of the user interface of the Oracle ZFS Storage Appliance Kit allows a intruder to gain unauthorized access to protected information.
The vulnerability of the Oracle ZFS Storage Appliance Kit’s user interface is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using the HTTP network protocol...
httpd: CONTINUATION frames DoS
A vulnerability was found in how Apache httpd implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers,...
tomcat: Improper Handling of Exceptional Conditions
A vulnerability was found in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This issue led to a miscounting of active HTTP/2 streams, which in turn led to using an incorrect infinite timeout that allowed connections to remain...
SUSE CVE-1999-0183
Linux implementations of TFTP would allow access to files outside the restricted directory...
golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS
A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service DoS attack...
filestash 安全漏洞
filestash is a Dropbox-like file manager by the individual developer Mickael. A security vulnerability exists in filestash v0.4, which stems from a TLS certificate validation being skipped when using the FTPS protocol. An attacker can perform a man-in-the-middle attack via the Init function of...
PT-2024-6026 · Zyxel · Zyxel Usg Flex Series +3
Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions V5.00 through V5.38 Zyxel USG FLEX series versions V5.00 through V5.38 Zyxel USG FLEX 50W series versions V5.00 through V5.38 Zyxel USG20W-VPN series versions V5.00 through V5.38 Description: A post-authentication...
Webuzo 安全漏洞
Webuzo is a powerful and easy-to-use web hosting control panel from Webuzo Inc. Allows hosting providers and users to automate server administration tasks while providing customers with the tools they need to manage their sites. A security vulnerability exists in Webuzo that stems from the...
Medium: ecs-init
Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...
The vulnerability of the Text Catalog component of the Oracle PeopleSoft Enterprise HCM Shared Components application allows a hacker to gain access to modify, add, or delete data, or to unauthorizedly access protected information.
The vulnerability of the Text Catalog component of the Oracle PeopleSoft Enterprise HCM Shared Components application exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to modify, add, or delete data, or gain unauthorized...
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2024-2043)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
...
The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain unauthorized access to protected information.
The vulnerability of the Core component of the Oracle VM VirtualBox software relates to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...
The vulnerability of the sub-component of the Oracle Commerce Platform component, a e-commerce platform, allows a hacker to gain access to modify, add, or delete data.
The vulnerability of the sub-component of the Oracle Commerce Platform exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to modify, add, or delete data using the HTTP protocol...
qtbase: qtbase: Delay any communication until encrypted() can be responded to
A vulnerability was found in Qt where, during a TLS connection for servers supporting HTTP2, Qt may send data to a server even if the TLS certificate doesn't match the redirected address. This occurs because Qt fails to validate the certificate against the redirected address, potentially sending...
CVE-2024-21132
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite component: Approvals. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks...
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2024-1916)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS
A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service DoS attack...