Oracle Application Express Group Calendar Data Compromise

The vulnerability of the Oracle Application Express Group Calendar component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the protected...

Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS

An HTTP detection flaw was discovered in Django. If deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme incorrectly detected client requests made using HTTP as using HTTPS. This resulted in incorrect results for issecure and buildabsoluteuri, and HTTP...

IBM Oracle E-Business Suite Secure Enterprise Search Code Execution Vulnerability

IBM Oracle E-Business Suite Secure Enterprise Search is an enterprise asset search product from IBM USA. The product can search for public and private information from LANs, databases, disks, and file servers. A code execution vulnerability exists in Oracle E-Business Suite Secure Enterprise Sear...

Oracle Applications Framework Code Execution Vulnerability

Oracle Applications Framework is the United States Oracle Oracle company's a MVC-based Web development framework. A security vulnerability exists in Oracle Applications Framework product versions 12.1.3, 12.2.3 through 12.2.10, which can be exploited by an attacker accessing Oracle Applications...

Oracle WebLogic Server Insufficient Validation

The vulnerability of the Web Container sub-component of the Oracle WebLogic Server application server, a software platform of Oracle Fusion Middleware, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorize...

Oracle WebLogic Server Console Component Authorization Bypass

The vulnerability of the Console component of the Oracle WebLogic Server application lies in insufficient validation of input data. Exploiting this vulnerability allows an attacker to gain unauthorized access to read, modify, add, or delete data using the HTTP protocol...

Oracle PeopleSoft Enterprise PeopleTools Environment Mgmt Console Data Access

The vulnerability of the Environment Mgmt Console component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause system downtime, service failures, or gain...

Portal Component Unauthenticated Access

The vulnerability of the Portal component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information using the HTTP...

Analytics Web Answers component

The vulnerability of the Analytics Web Answers component of the Oracle Business Intelligence Enterprise Edition software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data, or cause a service failure...

Oracle Primavera Unifier Unauthorized Access

The vulnerability of Platform and Mobile App components of Oracle Primavera Unifier relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTPS protocol...

Reporting Component Unauthorized Access

The vulnerability of the Reporting component of the Oracle Hospitality Reporting and Analytics application is related to lack of access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTP...

Oracle BI Publisher Layout Templates Data Access

The vulnerability of the Layout Templates component in the Oracle BI Publisher reporting software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify, add, or delete data using the HTTP protocol...

Oracle Depot Repair Component Access Bypass

The vulnerability of the Estimate and Actual Charges component of the Oracle Depot Repair application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read, modify, add, or delete access to data using the HTTP protoco...

Oracle CRM Technical Foundation Preferences Data Modification

The vulnerability of the Preferences component in the Oracle CRM Technical Foundation system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTP protocol...

Infrastructure Component Data Access Bypass

The vulnerability of the Oracle Financial Services Analytical Applications Infrastructure component is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read, modify, add, or delete access to data using the HTTP protocol...

tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS

A flaw was found in Apache Tomcat, where an h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests are made, an OutOfMemoryException could occur, leading to a denial of service. The highest threat from this vulnerability i...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Enterprise Config Management Unauthorized Access

The vulnerability of the Enterprise Config Management component of the Enterprise Manager Base Platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to...

Oracle Application Express Data Access

The vulnerability of the Oracle Application Express component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized acces...

CVE-2020-2973

Vulnerability in the Oracle Application Express component of Oracle Database Server. Supported versions that are affected are 5.1-19.2. Easily exploitable vulnerability allows low privileged attacker having SQL Workshop privilege with network access via HTTP to compromise Oracle Application...