CVE-2021-27670

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...

PT-2021-17595

Name of the Vulnerable Software and Affected Versions Appspace version 6.2.4 Description The issue allows for Server-Side Request Forgery SSRF via the url parameter in the "api/v1/core/proxy/jsonprequest" API endpoint. This means an attacker could potentially force the server to make unintended...

CVE-2021-27670: Server-Side Request Forgery (SSRF)

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...

CVE-2021-27186

Fluent Bit 1.6.10 has a NULL pointer dereference when an flbmalloc return value is not validated by flbavro.c or httpserver/api/v1/metrics.c...

CVE-2021-27186: NULL Pointer Dereference

Fluent Bit 1.6.10 has a NULL pointer dereference when an flbmalloc return value is not validated by flbavro.c or httpserver/api/v1/metrics.c...

PT-2020-16809

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 20.10.1 Description The issue allows SQL injection, as demonstrated by the "/api/v1/containers" endpoint with the orderby parameter. The PaginatorOrdered classes used for paginating results of REST endpoints do not...

CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

CVE-2020-11576: Observable Discrepancy

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

PT-2020-5301

Name of the Vulnerable Software and Affected Versions D-Link DSL-2640B versions prior to EU 4.01B Description The issue is related to insufficient input validation, allowing a remote attacker to reset the device's configuration by accessing an unauthenticated URL, such as "/api/v1/reset" or...

CVE-2020-10591

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

PT-2020-12222

Name of the Vulnerable Software and Affected Versions Walmart Labs Concord versions prior to 1.44.0 Description An issue allows remote attackers to discover host information, nodes, API metadata, and references to usernames via the "api/v1/apikey" endpoint. This is due to CORS...

CVE-2020-10591: Undefined Security Weakness

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

CVE-2019-19250

OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js...

CVE-2019-19250: Improper Neutralization of Special Elements used in an SQL Command

OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js...

PT-2019-15794

Name of the Vulnerable Software and Affected Versions OpenTrade versions prior to 2019-11-23 Description The issue allows SQL injection, related to the files server/modules/api/v1.js and server/utils.js. Recommendations For versions prior to 2019-11-23, update to a version released after 2019-11-...

CVE-2019-14544

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...

CVE-2019-14544: Missing Authorization

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...

Cross site scripting

EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...

CVE-2019-14351

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...

CVE-2019-14350

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation...