978 matches found
CVE-2020-26525
Damstra Smart Asset 2020.7 is affected by a SQL injection in the API endpoint API/Asset originator parameter. The root cause is an SQL injection vulnerability that can cause the database and server to initiate remote connections to third‑party DNS servers. This CVE (CVE-2020-26525) is documented ...
Cross-Site Request Forgery (CSRF)
cfme-gemset is vulnerable to cross-site request forgery CSRF. Lack of authenticity verification of requests in the API notifications allows an attacker to submit requests on behalf of an authenticated user...
Cloud-y, with a chance of hacking all the wireless things
Grandstream are a provider of IP video and voice services, as well as Wi-Fi and other related services and equipment. Their products are sold in over 150 countries and they have offices around the globe. We were having a look at their GWN.Cloud management platform, used for remote device and...
api.skiline.cc Cross Site Scripting vulnerability OBB-1370051
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
api.chemchart.com Cross Site Scripting vulnerability OBB-1369645
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-15374
CVE-2020-15374 affects Brocade Fabric OS Rest API implementations. The REST API in Brocade Fabric OS versions 8.2.1 through 8.2.1d and 8.2.2 before 8.2.2c is vulnerable to multiple instances of reflected input, as described in advisory material. Impact is indicated as high/critical in related CVS...
api.iternio.com Improper Access Control vulnerability OBB-1350126
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-10718
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader TCCL. This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is ...
api.m2msuite.com Cross Site Scripting vulnerability OBB-1318098
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
api.shoyo.io Cross Site Scripting vulnerability OBB-1307692
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
api.awarego.com Cross Site Scripting vulnerability OBB-1285487
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-3519
Cisco Data Center Network Manager (DCNM) is affected by a REST API path-traversal vulnerability due to insufficient input validation. An authenticated, remote attacker could craft requests to the API and overwrite arbitrary files on affected devices. Public documentation references guidance that ...
APIs Are the Next Frontier in Cybercrime
Application Programming Interface API usage has exploded, and cybercriminals are increasingly taking advantage of API security flaws to commit fraud and steal data. APIs, which are used to create connections between software programs and perform integrations, make everything a bit easier — from...
CVE-2020-14325
CVE-2020-14325 describes a vulnerability in Red Hat CloudForms prior to 5.11.7.0 where a User Impersonation/authorization flaw could let an attacker create or use an RBAC user (with groups/roles such as EvmGroup-super_administrator) and perform API requests as a super administrator. The related R...
Exposed API
foreman does not properly restrict access to APIs. A remote attacker is able to access arbitrary hosts via an API request...
api.rebirth.ro Improper Access Control vulnerability OBB-1246813
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-15341
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated updateallrealmlicense API...
Information disclosure
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API...
Attack Analytics Multi-Sensor Integrations Provide Unmatched Visibility
Since debuting Attack Analytics back in 2018, this groundbreaking security analytics functionality has come a long way. Time and again our customers have told us how powerful they find the tool and how much time it saves them. Attack Analytics better positions Imperva’s customers to focus on what...
h1-ctf: [H1-2006 2020] CTF Writeup
Summary: The CTF's objective could be found in the following Twitter post: F858468 As outlined on https://hackerone.com/h1-ctf, all subdomains of bountypay.h1ctf.com are in scope. Doing subdomain enumeration revealed the following subdomains: api.bountypay.h1ctf.com app.bountypay.h1ctf.com...