CVE-2024-7404

Removed by vendor...

CVE-2024-7404: Improper Restriction of Rendered UI Layers or Frames

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow...

PT-2024-8697

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.2 through 17.3.7 GitLab CE/EE versions 17.4 through 17.4.4 GitLab CE/EE versions 17.5 through 17.5.2 Description The issue is related to the incorrect limitation of visible layers in the user interface of the GitLab...

CVE-2024-43430 Moodle: lack of access control when using external methods for quiz overrides

A flaw was found in moodle. External API access to Quiz can override contained insufficient access control...

CVE-2024-43430 Moodle: lack of access control when using external methods for quiz overrides

A flaw was found in moodle. External API access to Quiz can override contained insufficient access control...

PT-2024-30580 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: moodle affected versions not specified Description: A flaw was found in moodle, where external API access to Quiz can override contained insufficient access control. Recommendations: At the moment, there is no information about a newer versio...

PT-2024-8175 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.3.0 through 10.0.16 Description: The issue is related to incorrect access control in the GLPI system, which can be exploited by a remote attacker to gain unauthorized access to an account through the API. An authenticated user...

WS-2022-0111

Opened exploitable ports in default docker-compose.yaml in go-ipfs 0.11.0 and before 0.12.1 can allows admin API access to the IPFS node...

Century Systems FutureNet NXR security vulnerabilities

Century Systems FutureNet NXR is a series of routers from Century Systems, Japan. A security vulnerability exists in Century Systems FutureNet NXR, which arises from an initial configuration where REST-APIs are accidentally enabled during device startup, which could allow an attacker to gain acce...

Adobe FrameMaker Publishing Server 2022 < 17.0.1 (2022.0.1) Security Feature Bypass (APSB23-58)

The version of Adobe FrameMaker Publishing Server installed on the remote Windows host is prior to Adobe FrameMaker Publishing Server 2022 17.0.1. It is, therefore, affected by a vulnerability as referenced in the apsb23-58 advisory. - Adobe FrameMaker Publishing Server versions 2022 and earlier...

CVE-2023-32188

A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...

NeuVector security vulnerabilities

NeuVector is an end-to-end container security platform from US-based NeuVector. The platform includes features such as image vulnerability management, access control and container process/filesystem protection. A security vulnerability exists in previous versions of NeuVector...

PT-2024-39480 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server versions 2024.1.0 through 2024.1.13038 Octopus Server versions 2024.2.0 through 2024.2.9482 Octopus Server versions 2024.3.0 through 2024.3.12766 Description: This issue is related to an SQL Injection vulnerability due to...

Versa Networks Releases Advisory for a Vulnerability in Versa Director, CVE-2024-45229

Versa Networks has released an advisory for a vulnerability CVE-2024-45229link is external affecting Versa Director. A cyber threat actor could exploit this vulnerability to exercise unauthorized REST APIs. CISA urges organizations to apply necessary updates, hunt for any malicious activity, repo...

CVE-2024-8601

This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to unauthorized acce...

CVE-2024-39715

CVE-2024-39715 describes a code injection vulnerability in Veeam Service Provider Console (VSPC) where a low-privileged user with REST API access can remotely upload arbitrary files to the VSPC server, leading to remote code execution. The description is consistent across multiple sources (NVD, R...

CVE-2024-39715

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server...

Veeam Service Provider Console security vulnerabilities

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.0.0.19552 and previous versions 8, which stems from the inclusion of a code injection vulnerability that allows a low privileged user with REST AP...

Cisco Smart License Utility Static Credentials Unauthorized Access

The vulnerability of the Cisco Smart License Utility software management system is related to undocumented static account data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to confidential information and unauthorized access to the API...

CVE-2024-5957: Authentication Bypass by Primary Weakness

This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager...