PT-2019-4198

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.6.1 Description A vulnerability allows an attacker with low privilege to retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database. This issue is related to the...

PT-2019-2871

Name of the Vulnerable Software and Affected Versions FortiOS affected versions not specified Description The issue is related to a lack of authentication check in the web interface of the FortiOS operating system. This can be exploited by a remote attacker to perform a cross-site request forgery...

CVE-2018-1999019: Improper Control of Generation of Code

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This...

PT-2018-15198

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to the version containing commit 0de84700648f098c1fbf6b807dee28ec640efe62 Description The issue concerns an Unserialization vulnerability in the hash GET parameter for the API endpoint located at...

Semmle: Docker Registry HTTP API v2 exposed in HTTP without authentication leads to docker images dumping and poisoning

Summary: Docker Registry HTTP API v2 is exposed in HTTP without authentication. An attacker can use it to dump your docker images and poison them. Description: While digging into the environment that hosts the sandboxed build container, I came across the port 5000 open on another machine probably...

CVE-2016-5390

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the viewhosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces...

PT-2016-6404

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.11.4 Foreman versions 1.12.x prior to 1.12.1 Description The issue allows remote authenticated users with specific permissions to obtain sensitive network interface information. This can be achieved via a request to...

CVE-2016-5390: Exposure of Sensitive Information to an Unauthorized Actor

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the viewhosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces...

PT-2014-2259

Name of the Vulnerable Software and Affected Versions SpiceWorks version 5.3.75941 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the id parameter to the "api v2.json" API endpoint. Recommendations For SpiceWorks version 5.3.75941,...