oracle application server 1.0 vulnerabilities and exploits

(subscribe to this query)

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and...

1 Github repository1 Article

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. ...

2 Articles

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creatin...

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations a...

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame ...

In Apache httpd prior to 2.2.34 and 2.4.x prior to 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '...

1 Github repository

VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA up to and including 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA up to and including 6.6; Veritas Storage Foundation (SF) 3.5; V...

Symantec Veritas Cluster Server One 2.0.1 Symantec Veritas Storage Foundation For Oracle Real Application Cluster 3.5 Symantec Veritas Storage Foundation Cluster File System 4.0 Symantec Veritas Storage Foundation Manager 1.1 Symantec Veritas Cluster Server 5.0 Symantec Veritas Storage Foundation Cluster File System 5.0 Symantec Veritas Netbackup Operations Manager 6.5.5 Symantec Veritas Storage Foundation For Windows High Availability 5.0rp1a Symantec Veritas Storage Foundation Manager 1.0 Symantec Veritas Storage Foundation For Windows High Availability 4.3mp2 Symantec Veritas Storage Foundation Cluster File System 3.5 Symantec Veritas Storage Foundation For Oracle Real Application Cluster 4.0 Symantec Veritas Storage Foundation 3.5 Symantec Veritas Micromeasure 5.0 Symantec Veritas Storage Foundation For Windows High Availability 5.1 Symantec Backup Exec Continuous Protection Server 12.5 Symantec Veritas Storage Foundation For High Availability 3.5 Symantec Veritas Cluster Server One 2.0 Symantec Veritas Storage Foundation For Windows High Availability 5.1ap1 Symantec Veritas Netbackup Operations Manager 6.0 Ga Symantec Veritas Storage Foundation For Oracle Real Application Cluster 5.0 Symantec Veritas Storage Foundation For Sybase 5.0

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer...

1 Article

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (whi...

« PREV 1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook