Zeddyu Lu

The issue is related to the FTP client in Apache Commons Net, which trusts the host from PASV response by default. This allows a malicious server to redirect the Commons Net code to use a different host, potentially leading to leakage of information about services running on the private network of the client. The default behavior was changed in version 3.9.0 to ignore such hosts.

The issue concerns the ftp client in GNU Inetutils, which fails to validate addresses returned by PASV/LSPV responses, ensuring they match the server address.

The issue allows for HTTP Request Smuggling, which can be exploited.

The issue is related to weak cipher suites being enabled by default. This could potentially lead to security risks.

The issue is related to insufficient input validation in the Web Container component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data, as well as unauthorized read access to a subset of accessible data.

The issue is related to insufficient input validation in the Web Container component of Oracle WebLogic Server, allowing a remote attacker to cause a denial of service. Successful attacks can result in the ability to cause a hang or frequently repeatable crash of Oracle WebLogic Server. The vulnerability can be exploited by an unauthenticated attacker with network access via HTTP.

The issue is related to insufficient access control in the Web Container component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all accessible data, as well as unauthorized read access to a subset of accessible data.

The issue is related to inconsistent interpretation of HTTP requests, specifically with Transfer-Encoding and Content length headers in the context of a reverse proxy and proxy redirection. This can be exploited by a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service. The vulnerability involves a smuggling attack.