CVE-2018-18838

An issue was discovered in Netdata 1.10.0. Log Injection or Log Forgery exists via a %0a sequence in the url parameter to api/v1/registry...

CVE-2018-18839

An issue was discovered in Netdata 1.10.0. Full Path Disclosure FPD exists via api/v1/alarms. NOTE: the vendor says "is intentional...

CVE-2018-18839

CVE-2018-18839 affects Netdata 1.10.0 and is described as Full Path Disclosure via api/v1/alarms. The vendor states this behavior is intentional. OpenSUSE advisories mark CVE-2018-18839 as disputed/not fixed in some Nessus entries, while later advisories describe the update as addressing other is...

CVE-2018-18836: Improper Control of Generation of Code

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data in web/api/webapiv1.c...

CVE-2018-18838: Improper Encoding or Escaping of Output

An issue was discovered in Netdata 1.10.0. Log Injection or Log Forgery exists via a %0a sequence in the url parameter to api/v1/registry...

CVE-2018-18839: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Netdata 1.10.0. Full Path Disclosure FPD exists via api/v1/alarms. NOTE: the vendor says "is intentional...

CVE-2018-18837: Improper Neutralization of CRLF Sequences in HTTP Headers

An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of webclientapirequestv1data in web/api/webapiv1.c...

PT-2019-12300

Name of the Vulnerable Software and Affected Versions Intelbras IWR 3000N version 1.5.0 Description An issue allows remote attackers to cause a denial of service, resulting in a device reboot. This can be achieved by sending a malformed login request, specifically by misparsing the " string to th...

PT-2019-9762

Name of the Vulnerable Software and Affected Versions Stripe API v1 Description The issue allows remote attackers to bypass intended access restrictions. This is achieved by replaying XMLHttpRequest data to the API endpoint "/v1/tokens" on api.stripe.com, then parsing the response under the objec...

PT-2018-10552

Name of the Vulnerable Software and Affected Versions Splunk versions prior to 7.0.1 Description The issue allows information disclosure by appending "/api/v1/server/info/server-info?output mode=json" to a query. This can be used to discover sensitive information, such as a license key...

PT-2018-4708

Name of the Vulnerable Software and Affected Versions restafary versions prior to 1.6.1 Description The issue concerns a directory traversal vulnerability. When a root path is specified in the configuration, the vulnerability allows access beyond the intended directory. This can be exploited by...

Server side request forgery (ssrf)

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

CVE-2017-7200: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

PT-2017-8952

Name of the Vulnerable Software and Affected Versions Trend Micro Virtual Mobile Infrastructure versions prior to 5.1 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to "api/v1/cfg/oauth/save identify pfx/"...

CVE-2016-6270: Improper Neutralization of Special Elements used in a Command

The handlecertificate function in /vmi/manager/engine/management/commands/apnsworker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to api/v1/cfg/oauth/saveidentifypfx/...

PT-2017-3093

Name of the Vulnerable Software and Affected Versions Schneider Electric homeLYnk Controller versions prior to 1.5.0 Description The issue is related to a Command Injection vulnerability. It is associated with the failure to sanitize data at the management level, which could allow a remote attack...

CVE-2015-1775

Server-side request forgery SSRF vulnerability in the proxy endpoint api/v1/proxy in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call...

PT-2015-5439

Name of the Vulnerable Software and Affected Versions Apache Ambari versions prior to 2.1.0 Description A server-side request forgery SSRF issue exists in the proxy endpoint "api/v1/proxy" that allows remote authenticated users to conduct port scans and access unsecured services via a crafted RES...

CVE-2015-1775: Undefined Security Weakness

Server-side request forgery SSRF vulnerability in the proxy endpoint api/v1/proxy in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call...

PT-2015-6355

Name of the Vulnerable Software and Affected Versions XZERES 442SR OS version not specified Description A cross-site request forgery issue allows remote attackers to hijack admin authentication for requests, specifically those that change the default admin user, via a GET request to a vulnerable...