CVE-2023-21847

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: Download. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle Web...

CVE-2023-21847

CVE-2023-21847 (Oracle E-Business Suite — Oracle Web Applications Desktop Integrator, Download component) affects Oracle Web Applications Desktop Integrator versions 12.2.3–12.2.12. The root cause is insufficient input validation in the Download component of the E-Business Suite’s Web Application...

PT-2023-1200 · Oracle · Oracle Web Applications Desktop Integrator

Name of the Vulnerable Software and Affected Versions: Oracle Web Applications Desktop Integrator versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Download component of Oracle Web Applications Desktop Integrator, part of the Oracle E-Busine...

The vulnerability of FortiWeb web applications’ network firewalls, related to writing data beyond the buffer in memory, allows attackers to execute arbitrary code.

The vulnerability of FortiWeb web applications’ network firewalls is related to writing data beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created request...

Fedora: Security Advisory for trafficserver (FEDORA-2022-62b61a8542)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: trafficserver-9.1.4-1.fc36

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

[SECURITY] Fedora 37 Update: trafficserver-9.1.4-1.fc37

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

vulhub

This is an offensive tool for web application security training and education. It is a collection of vulnerable web applications and tools for testing and training purposes. The repository is a clone of vulhub/vulhub, which is a collection of vulnerable web applications and tools for testing and...

Zerobot Botnet Emerges as a Growing Threat with New Exploits and Capabilities

The Zerobot DDoS botnet has received substantial updates that expand on its ability to target more internet-connected devices and scale its network. Microsoft Threat Intelligence Center MSTIC is tracking the ongoing threat under the moniker DEV-1061, its designation for unknown, emerging, or...

RHEL 8 : Red Hat Single Sign-On 7.6.1 security update on RHEL 8 (Important) (RHSA-2022:8962)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8962 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 9 : Red Hat Single Sign-On 7.6.1 security update on RHEL 9 (Important) (RHSA-2022:8963)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8963 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.1 release and security update

Red Hat JBoss Web Server 5.7.1 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft Windows. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which give...

Apache Tapestry Remote Code Execution Vulnerability

Apache Tapestry is a component-oriented framework for creating highly scalable Web applications in Java.A remote code execution vulnerability exists in Apache Tapestry, which can be exploited by attackers to cause remote code execution...

IBM DB2 Cross-Site Request Forgery Vulnerability

IBM DB2 is a relational database management system from International Business Machines IBM. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM Db2 versions 3.5, 4.0, and 4.5 are vulnerable to cross-site request forgery, which stems from WEB...

Input validation

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is...

CVE-2022-45442

Sinatra (Ruby) suffers a reflected file download (RFD) vulnerability where a response’s Content-Disposition header is derived from user-supplied input. Affected versions are 2.0.x before 2.2.3 and 3.0.x before 3.0.4; patches exist in 2.2.3 and 3.0.4. Remediation is to upgrade to those fixed relea...

CVE-2022-44787

An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Scripting issue. The idPagina parameter is reflected inside the server response without any HTML encoding, resulting in XSS when the victim moves the mouse pointer inside the page...

CVE-2022-44786

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to specify the JSP page to be rendered. This affects ApriPagina.do POST and GET requests to each application...

Code injection

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to specify the JSP page to be rendered. This affects ApriPagina.do POST and GET requests to each application...