Oracle Identity Manager LDAP Exposed Information

The vulnerability of the OIM component – LDAP user and role synchronization of the Oracle Identity Manager – is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information using the HTTP protocol...

CVE-2020-2675

Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications component: Login. The supported version that is affected is 5.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5...

CVE-2020-2661

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite component: Others. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iSupport...

CVE-2020-2600

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search. Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

Firefox Mixed Content Spoofing

The vulnerability of Firefox browsers arises from the lack of a warning about mixed content when the favicon of a web page is loaded via HTTP. Exploiting this vulnerability allows a remote attacker to perform spoofing attacks...

Unspecified Vulnerability in HAProxy

HAProxy is an open source TCP/HTTP load balancing server from the French company HAProxy. The server provides 4-layer , 7-layer proxy , and can support tens of thousands of level of connections , with high efficiency , stability and other characteristics . A security vulnerability exists in the...

Oracle Retail Xstore Payment Internal Operations Privilege Escalation

Vulnerability of the Internal Operations component of the Oracle Retail Xstore Payment software, with access control deficiencies. Exploitation of this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or gain unauthorized access to protected information usi...

httpd: mod_http2: possible crash on late upgrade

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server...

BI Publisher Security Sub-component Unauthorized Access

The vulnerability of the BI Publisher Security sub-component of the BI Publisher reporting tool formerly XML Publisher, a software platform of Oracle Fusion Middleware, is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating...

Siebel UI Framework Unauthorized Access

The vulnerability of the Siebel UI Framework component of the Oracle Siebel CRM system relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

Oracle Hospitality Reporting and Analytics Component Privilege Escalation

The vulnerability of the Oracle Hospitality Reporting and Analytics component in the Oracle Food and Beverage Applications suite is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to remotely modify, add, or delete data, or gain unauthorized access to...

Oracle Workflow Worklist Privilege Escalation

The vulnerability of the Worklist sub-component of the Oracle Workflow component in the Oracle E-Business Suite automation system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or gain...

Fluid Core Sub-component PeopleSoft Enterprise Data Access

The vulnerability of the Fluid Core sub-component of the PeopleSoft Enterprise PeopleTools business application package from Oracle PeopleSoft Enterprise is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read,...

Oracle Business Intelligence Enterprise Edition Analytics Actions Unauthorized Access

The vulnerability of the Analytics Actions sub-component of the Oracle Business Intelligence Enterprise Edition software component of the Oracle Fusion Middleware software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating...

Marketing Administration Oracle Marketing E-Business Suite Privilege Escalation

The vulnerability of the Marketing Administration sub-component of the Oracle Marketing component in the Oracle E-Business Suite is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized...

Oracle Java SE Unauthorized Access

The vulnerability of the Oracle Java SE and Oracle Java SE Embedded software deployment components is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to protected informati...

PeopleSoft Enterprise Performance Monitor Unauthorized Access

The vulnerability of the Performance Monitor sub-component of the PeopleSoft Enterprise component of the Oracle PeopleSoft Enterprise business application suite is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthoriz...

Oracle E-Business Suite Engineering Change Order Data Modification

The vulnerability of the Engineering Change Order component of the Oracle Installed Base component in the Oracle E-Business Suite system for enterprise automation activities is related to lack of access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...

DEBIAN-CVE-2019-17420

In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the httpheader signature to not alert on a response with a single \r\n ending...

HTTP/2: large amount of data requests leads to denial of service

A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...