Authentication flaw

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

CVE-2016-9880

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

CVE-2016-9880: Improper Authentication

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

PT-2018-5118

Name of the Vulnerable Software and Affected Versions GemFire broker for Cloud Foundry versions 1.6.x through 1.6.4 GemFire broker for Cloud Foundry versions 1.7.x through 1.7.0 Description The issue concerns multiple API endpoints that do not require authentication, potentially allowing...

PT-2018-5332

Name of the Vulnerable Software and Affected Versions Wireless IP Camera 360 affected versions not specified Description An issue allows attackers to read recordings by navigating to API Endpoints: "/mnt/idea0" or "/mnt/idea1" on the SD memory card. Recommendations At the moment, there is no...

PT-2018-18068 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows remote attackers to discover the full path via a direct request to "3/qq connect2.0/API/class/ErrorCase.class.php" or "3/ucenter api/code/friend.php". Recommendations: For zzcms version 8.2, as ...

PT-2017-13235

Name of the Vulnerable Software and Affected Versions Trend Micro Mobile Security Enterprise versions before 9.7 Patch 3 Description The issue allows remote attackers to execute arbitrary code on vulnerable installations. Multiple API endpoints are vulnerable to SQL Injection, including query...

JetBrains IntelliJ-based IDEs <= 2016.1 Multiple Vulnerabilities - Active Check

JetbBains IntelliJ-based IDEs are prone to a remote code execution RCE and a local file disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2016-3723

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints...

CVE-2016-3723

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints...

Updated jenkins-remoting packages fix CVE-2016-0792

Updated jenkins-remoting packages fix security vulnerability: Jenkins has several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. SECURITY-247 ...

CVE-2016-0792

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

Design/Logic Flaw

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

CVE-2016-0792

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

CVE-2016-0792

CVE-2016-0792 affects Jenkins, including the core up to 1.650 and LTS up to 1.642.2, via a deserialization flaw in XML data using XStream and groovy.util.Expando. The vulnerability allows remote authenticated users to execute arbitrary code by crafting a serialized payload in an XML file. Public ...

PT-2016-4418 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 1.650 Jenkins LTS versions prior to 1.642.2 Description: The issue allows remote authenticated users to execute arbitrary code via serialized data in an XML file. This is related to XStream and the groovy.util.Expand...

PT-2015-7410

Name of the Vulnerable Software and Affected Versions Nokia Networks @vantage Commander affected versions not specified Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different API endpoints, including /cftraces/filter/fl copy.jsp,...

PT-2014-6491

Name of the Vulnerable Software and Affected Versions OpenEMR versions 4.1.2 Patch 7 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved through various parameters in different API endpoints, including layout id to...

PT-2014-8892

Name of the Vulnerable Software and Affected Versions Proticaret E-Commerce version 3.0 Description The issue allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request, specifically through "API Endpoints" that accept SOAP requests. This can lead to...

PT-2014-5437 · Red Hat · Spacewalk-Java +1

Name of the Vulnerable Software and Affected Versions: spacewalk-java version 2.0.2 Red Hat Network RHN Satellite versions 5.5 through 5.6 Description: The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to API endpoints such as...