Instantis Enterprisetrack (Oracle) - vulnerabilities (CVEs)

57 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2021-12-20. Vendor: Oracle.

CVEs of Instantis Enterprisetrack

CVE-2021-44790 - CVSS 9.8 (critical), 2021-12-20: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is…
CVE-2021-44224 - CVSS 8.2 (high), 2021-12-20: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing…
CVE-2021-45105 - CVSS 5.9 (medium), 2021-12-18: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This…
CVE-2021-42013 - CVSS 9.8 (critical), 2021-10-07: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files…
CVE-2021-41773 - CVSS 9.8 (critical), 2021-10-05: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files…
CVE-2021-41524 - CVSS 7.5 (high), 2021-10-05: While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server.…
CVE-2021-34798 - CVSS 7.5 (high), 2021-09-16: Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2021-39275 - CVSS 9.8 (critical), 2021-09-16: ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but…
CVE-2021-36160 - CVSS 7.5 (high), 2021-09-16: A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server…
CVE-2021-2351 - CVSS 8.3 (high), 2021-07-21: Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c.…
CVE-2021-33037 - CVSS 5.3 (medium), 2021-07-12: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some…
CVE-2021-33503 - CVSS 7.5 (high), 2021-06-29: An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular…
CVE-2021-31618 - CVSS 7.5 (high), 2021-06-15: Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used…
CVE-2019-17567 - CVSS 5.3 (medium), 2021-06-10: Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the…
CVE-2021-26690 - CVSS 7.5 (high), 2021-06-10: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading…
CVE-2020-35452 - CVSS 7.3 (high), 2021-06-10: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this…
CVE-2021-30641 - CVSS 5.3 (medium), 2021-06-10: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
CVE-2020-13950 - CVSS 7.5 (high), 2021-06-10: Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both…
CVE-2021-26691 - CVSS 9.8 (critical), 2021-06-10: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
CVE-2021-22222 - CVSS 7.5 (high), 2021-06-07: Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file
CVE-2021-25329 - CVSS 7 (high), 2021-03-01: The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a…
CVE-2021-25122 - CVSS 7.5 (high), 2021-03-01: When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request…
CVE-2020-11987 - CVSS 8.2 (high), 2021-02-24: Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted…
CVE-2020-17527 - CVSS 7.5 (high), 2020-12-03: While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request…
CVE-2019-17566 - CVSS 7.5 (high), 2020-11-12: Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted…
CVE-2020-13943 - CVSS 4.3 (medium), 2020-10-12: If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent…
CVE-2020-9490 - CVSS 7.5 (high), 2020-08-07: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the…
CVE-2020-11993 - CVSS 7.5 (high), 2020-08-07: Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were…
CVE-2020-11984 - CVSS 9.8 (critical), 2020-08-07: Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2020-13935 - CVSS 7.5 (high), 2020-07-14: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to…
CVE-2020-13934 - CVSS 7.5 (high), 2020-07-14: An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the…
CVE-2020-9484 - CVSS 7 (high), 2020-05-20: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the…
CVE-2020-11655 - CVSS 7.5 (high), 2020-04-09: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's…
CVE-2020-1927 - CVSS 6.1 (medium), 2020-04-02: In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…
CVE-2020-1934 - CVSS 5.3 (medium), 2020-04-01: In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
CVE-2020-1938 - CVSS 9.8 (critical), 2020-02-24: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…
CVE-2019-17569 - CVSS 4.8 (medium), 2020-02-24: The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was…
CVE-2020-1935 - CVSS 4.8 (medium), 2020-02-24: In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed…
CVE-2019-0219 - CVSS 9.8 (critical), 2020-01-14: A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted…
CVE-2019-17563 - CVSS 7.5 (high), 2019-12-23: When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2019-12415 - CVSS 5.5 (medium), 2019-10-23: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an…
CVE-2019-10082 - CVSS 9.1 (critical), 2019-09-26: In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection…
CVE-2019-10097 - CVSS 7.2 (high), 2019-09-26: In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially…
CVE-2019-9517 - CVSS 7.5 (high), 2019-08-13: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2…
CVE-2019-0197 - CVSS 4.2 (medium), 2019-06-11: A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host,…
CVE-2019-0227 - CVSS 7.5 (high), 2019-05-01: A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits…
CVE-2019-0211 - CVSS 7.8 (high), 2019-04-08: In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads…
CVE-2019-0190 - CVSS 7.5 (high), 2019-01-30: A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a…
CVE-2018-17189 - CVSS 5.3 (medium), 2019-01-30: In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request…
CVE-2018-11784 - CVSS 4.3 (medium), 2018-10-04: When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.…
CVE-2018-11763 - CVSS 5.9 (medium), 2018-09-25: In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any…
CVE-2018-8032 - CVSS 6.1 (medium), 2018-08-02: Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2018-8013 - CVSS 9.8 (critical), 2018-05-24: In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then…
CVE-2017-12617 - CVSS 8.1 (high), 2017-10-04: When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the…
CVE-2017-5645 - CVSS 9.8 (critical), 2017-04-17: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…