646 matches found
CVE-2022-32229
A information disclosure vulnerability exists in Rockert.Chat v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection...
CVE-2022-36305
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the body function at /web/api/v1/upload/UploadHandler.php...
CVE-2022-36303
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the handlefileupload function at /web/api/v1/upload/UploadHandler.php...
CVE-2022-34025
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...
PT-2022-23299
Name of the Vulnerable Software and Affected Versions Vesta versions 1.0.0 through 1.0.5 Description A cross-site scripting XSS issue was found in Vesta via the generate response function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation...
PT-2022-23298
Name of the Vulnerable Software and Affected Versions Vesta versions 1.0.0 through 1.0.5 Description A cross-site scripting XSS issue was found in the handle file upload function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation. No information is...
CVE-2022-34025: Improper Neutralization of Input During Web Page Generation
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...
PT-2022-23300
Name of the Vulnerable Software and Affected Versions Vesta versions 1.0.0 through 1.0.5 Description A cross-site scripting XSS issue was found in the body function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation. Recommendations For versions 1.0...
CVE-2022-36304: Improper Neutralization of Input During Web Page Generation
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the generateresponse function at /web/api/v1/upload/UploadHandler.php...
PT-2022-3648
Name of the Vulnerable Software and Affected Versions FortiDeceptor versions 1.0.0 through 4.0.1 Description The issue is related to relative path traversal errors in the management interface, allowing a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying...
PT-2022-3282
Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.8 Description The issue is related to the incorrect use of privileged APIs in the PingID multi-factor authentication MFA software for Windows. This could allow an attacker to elevate their privileges...
MAL-2022-3147 Malicious code in free-fortnite-skins-api-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84adc7f3e89bcdaf2440857943395002466913468cf0aed35f78e5879eaf84d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2022-19343
Name of the Vulnerable Software and Affected Versions OrangeHRM version v4.10.1 Description A stored cross-site scripting XSS issue in the addNewPost component allows attackers to execute arbitrary web scripts or HTML via a crafted POST request to the /api/v1/addNewPost endpoint, using vulnerable...
PT-2022-13857
Name of the Vulnerable Software and Affected Versions easyappointments versions prior to 1.5.0 Description The issue concerns an API privilege escalation in the easyappointments GitHub repository. It allows a low-privileged user, such as a provider, to create a new admin user via the...
CVE-2022-24730
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository acces...
PT-2021-23151
Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.6.3 Description A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint, such as "/api/v1/auth/logout". This requires a...
CVE-2021-27561: Improper Neutralization of Special Elements used in an OS Command
Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication...
PT-2021-21949
Name of the Vulnerable Software and Affected Versions: Planview Spigit version 4.5.3 Description: The issue allows remote unauthenticated attackers to query sensitive user accounts data. This is demonstrated by a request to the "api/v1/users/1" endpoint. Recommendations: For Planview Spigit versi...
CVE-2021-38095: Undefined Security Weakness
The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request...
