Brian

Memory safety bugs involving memory corruption could allow an attacker to run arbitrary code.

The issue is related to inadequate access control in the Thales Imperva SecureSphere WAF, allowing remote attackers to bypass WAF rules via crafted POST requests. This could lead to devastating breaches, including SQL injection and cross-site scripting (XSS) attacks. The vulnerability can be exploited by sending a request with specially crafted Content-Encoding headers, such as multiple headers or specific combinations like gzip and deflate. The estimated number of potentially affected devices is not specified.

A vulnerability in the Remember Me function of Masa CMS allows attackers to bypass authentication via a crafted web request.

A vulnerability in the Remember Me function allows attackers to bypass authentication via a crafted web request.

The issue is related to the XML parsers in Apache Tika not being configured to limit entity expansion, making them vulnerable to an entity expansion vulnerability. This can lead to a denial of service attack. The vulnerability is also associated with incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to cause a denial of service.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `post id` parameter in a modify action in the "forum.php" file.

Name of the Vulnerable Software and Affected Versions: Oracle Portal versions prior to 10g Description: The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the `enc` parameter in the `/webapp/jsp/calendar.jsp` endpoint. Recommendations: For Oracle Portal versions prior to 10g, update to a version that is not affected by this issue to prevent HTTP response splitting attacks.