Latest oracle hospitality guest access Vulnerabilities

● CVE-2020-9484

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; a...

redhat/tomcat6<0:6.0.24-115.el6_10

redhat/tomcat<0:7.0.76-12.el7_8

redhat/tomcat7<0:7.0.70-40.ep7.el6

redhat/tomcat8<0:8.0.36-44.ep7.el6

redhat/tomcat-native<0:1.2.23-22.redhat_22.ep7.el6

redhat/tomcat7<0:7.0.70-40.ep7.el7

and 99 more

● CVE-2020-1935

Apache Tomcat is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vuln...

redhat/tomcat<0:7.0.76-16.el7_9

redhat/tomcat<0:7.0.76-11.el7_6

redhat/tomcat<0:7.0.76-12.el7_7

redhat/tomcat7<0:7.0.70-41.ep7.el6

redhat/tomcat8<0:8.0.36-45.ep7.el6

redhat/tomcat7<0:7.0.70-41.ep7.el7

and 75 more

● CVE-2019-17569

redhat/jws5-tomcat<0:9.0.30-3.redhat_4.1.el6

redhat/jws5-tomcat-native<0:1.2.23-4.redhat_4.el6

redhat/jws5-tomcat<0:9.0.30-3.redhat_4.1.el7

redhat/jws5-tomcat-native<0:1.2.23-4.redhat_4.el7

redhat/jws5-tomcat<0:9.0.30-3.redhat_4.1.el8

redhat/jws5-tomcat-native<0:1.2.23-4.redhat_4.el8

and 30 more

● CVE-2020-1938

Apache Tomcat Improper Privilege Management Vulnerability

redhat/tomcat6<0:6.0.24-114.el6_10

redhat/tomcat<0:7.0.76-11.el7_7

redhat/tomcat<0:7.0.76-10.el7_6

redhat/jbossweb<0:7.5.30-2.Final_redhat_2.1.ep6.el5

redhat/glassfish-jsf12-eap6<0:1.2.15-11.b01_SP2_redhat_2.1.ep6.el5

redhat/hornetq<0:2.3.25-29.SP31_redhat_00001.1.ep6.el5

and 265 more

● CVE-2019-17359

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api=1.63

Apache TomEE=7.0.7

Apache TomEE=7.1.2

Apache TomEE=8.0.1

Netapp Active Iq Unified Manager Linux>=7.3

Netapp Active Iq Unified Manager Windows>=7.3

and 28 more

● CVE-2019-0227

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversi...

Apache Axis=1.4

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile Product Lifecycle Management Framework=9.3.3

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Big Data Discovery=1.6

and 76 more

● CVE-2019-10246

Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw when configured for showing a listing of directory contents. By sending a specially-crafted request, a rem...

Eclipse Jetty=9.2.27-20190403

Eclipse Jetty=9.3.26-20190403

Eclipse Jetty=9.4.16-20190411

Microsoft Windows

NetApp OnCommand System Manager>=3.0<=3.1.3

NetApp Snap Creator Framework

and 49 more

● CVE-2019-10247

Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw in the DefaultHandler. By sending a specially-crafted request, a remote attacker could exploit this vulner...

IBM Cognos Command Center<=10.2.4.1

debian/jetty9

redhat/jetty<9.2.28

redhat/jetty<9.3.27

redhat/jetty<9.4.16

Eclipse Jetty=7.0.0-20091005

and 334 more

● CVE-2019-11358

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted J...

redhat/ansible-tower<0:3.5.2-1.el7a

redhat/cfme<0:5.10.9.1-1.el7cf

redhat/cfme-amazon-smartstate<0:5.10.9.1-1.el7cf

redhat/cfme-appliance<0:5.10.9.1-1.el7cf

redhat/cfme-gemset<0:5.10.9.1-1.el7cf

redhat/ovirt-ansible-hosted-engine-setup<0:1.0.23-1.el7e

and 267 more

● CVE-2019-0190

A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bu...

Apache HTTP server=2.4.37

OpenSSL OpenSSL>=1.1.1

Oracle Enterprise Manager Ops Center=12.3.3

Oracle Hospitality Guest Access=4.2.0

Oracle Hospitality Guest Access=4.2.1

Oracle Instantis Enterprisetrack=17.1

and 4 more

● CVE-2018-17189

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up tha...

redhat/jbcs-httpd24-apr<0:1.6.3-63.jbcs.el6

redhat/jbcs-httpd24-apr-util<0:1.6.1-48.jbcs.el6

redhat/jbcs-httpd24-brotli<0:1.0.6-7.jbcs.el6

redhat/jbcs-httpd24-curl<0:7.64.1-14.jbcs.el6

redhat/jbcs-httpd24-httpd<0:2.4.37-33.jbcs.el6

redhat/jbcs-httpd24-jansson<0:2.11-20.jbcs.el6

and 60 more

● CVE-2018-11784

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/fo...

Apache Tomcat>=7.0.23<=7.0.90

Apache Tomcat>=8.5.0<=8.5.33

Apache Tomcat>=9.0.1<=9.0.11

Apache Tomcat=9.0.0

Apache Tomcat=9.0.0-m1

Apache Tomcat=9.0.0-m10

and 87 more

● CVE-2018-11763

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This ...

ubuntu/apache2<2.4.35

ubuntu/apache2<2.4.29-1ubuntu4.4

>=2.4.17<=2.4.34

=18.04

=6.0

=7.0

and 33 more

● CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

Apache Axis>=1.0<=1.4

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile Product Lifecycle Management Framework=9.3.3

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Big Data Discovery=1.6

and 73 more

● CVE-2018-11040

Pivotal Spring Framework could allow a remote attacker to bypass security restrictions, caused by a flaw in AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView. By sending...

IBM GDE<=3.0.0.2

maven/org.springframework:spring-core>=4.3.0<4.3.18

maven/org.springframework:spring-core>=5.0.0<5.0.7

VMware Spring Framework<4.3.18

VMware Spring Framework>=5.0.0<5.0.7

Oracle Agile Product Lifecycle Management=9.3.3

and 48 more

● CVE-2018-11039

Pivotal Spring Framework is vulnerable to cross-site tracing, caused by a flaw in the HiddenHttpMethodFilter in Spring MVC. By persuading a victim to visit a specially-crafted Web site, an attacker co...

IBM GDE<=3.0.0.2

maven/org.springframework:spring-web>=4.3.0<4.3.18

maven/org.springframework:spring-web>=5.0.0<5.0.7

VMware Spring Framework<4.3.18

VMware Spring Framework>=5.0.0<5.0.7

Oracle Agile PLM=9.3.3

and 61 more

Latest oracle hospitality guest access Vulnerabilities

Company

Resources

Contact