HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

CloudBees Jenkins Relution Enterprise Appstore Publisher Plugin Authorization Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Relution Enterprise Appstore Publisher Plugin...

UBUNTU-CVE-2019-10082

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown...

DEBIAN-CVE-2019-9516

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory fo...

UBUNTU-CVE-2019-9513

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU...

UBUNTU-CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write many of the byt...

Oracle Identity Manager Advanced Console Controller Unauthorized Access

The vulnerability of the Advanced Console controller’s sub-component in Oracle Identity Manager, a software platform of Oracle Fusion Middleware, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

Oracle Commerce Data Access

The vulnerability of the sub-component of the Dynamo Application Framework within the Oracle Commerce Platform of the e-commerce platform Oracle Commerce is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data...

Oracle CRM Technical Foundation Preferences Data Access

The vulnerability of the Preferences sub-component of the Oracle CRM Technical Foundation component of the Oracle E-Business Suite is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data using the HTTP protoco...

CVE-2019-7225

The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags MODBUS coils mapping to the HMI. These credentials are the idal123...

Oracle Service Bus Web Container DoS

The vulnerability of the Web Container sub-component of the Oracle Service Bus component of the Oracle Fusion Middleware software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service failures using the HTTP protocol...

Siebel Core Server BizLogic Script Data Manipulation DoS

The vulnerability of the Siebel Core component – the Server BizLogic Script of the Siebel CRM system’s customer relationship management software – is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data, and...

Oracle WebLogic Server Data Modification

The vulnerability of Oracle WebLogic Server’s application server’s WLS core components is related to lack of access control mechanisms. Exploiting this vulnerability allows an attacker to remotely modify, add, or delete data using the HTTP protocol...

Oracle Trade Management UI Unauthorized Access

The vulnerability of the User Interface component of the Oracle Trade Management component in the Oracle E-Business Suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using th...

PeopleSoft Enterprise PT PeopleTools RemoteCall Unauthorized Access

The vulnerability of the RemoteCall sub-component of the PeopleSoft Enterprise PT PeopleTools component of the Oracle PeopleSoft Products suite is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

Oracle Work in Process Messages Sub-component Unauthenticated Access

The vulnerability of the Messages sub-component of the Oracle Work in Process component in the Oracle E-Business Suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the...

Marketing Administration Oracle Marketing E-Business Suite Data Modification

The vulnerability of the Marketing Administration sub-component of the Oracle Marketing component in the Oracle E-Business Suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data...

Outside In Filters Oracle SDK Unauthorized Access Partial

The vulnerability of the Outside In Filters sub-component of the Oracle Outside In Technology SDK is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information or cause a partial servic...

Oracle CRM Technical Foundation Preferences Data Access

The vulnerability of the Preferences sub-component of the Oracle CRM Technical Foundation component of the Oracle E-Business Suite is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data using the HTTP protoco...

Marketing Administration Oracle Marketing E-Business Suite Data Modification

The vulnerability of the Marketing Administration sub-component of the Oracle Marketing component in the Oracle E-Business Suite is related to lack of access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data using the HTTP protocol...