Vulnerabilities

Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client).

Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server).

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.

Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server).

Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client).

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used…

Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server).

Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client).

Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway).

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled…

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte r…

libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP.

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow.

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read.

XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4).

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack.

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect.

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of…

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_d…