PT-2014-8892

Name of the Vulnerable Software and Affected Versions Proticaret E-Commerce version 3.0 Description The issue allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request, specifically through "API Endpoints" that accept SOAP requests. This can lead to...

PT-2014-5437 · Red Hat · Spacewalk-Java +1

Name of the Vulnerable Software and Affected Versions: spacewalk-java version 2.0.2 Red Hat Network RHN Satellite versions 5.5 through 5.6 Description: The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to API endpoints such as...

PT-2014-6415

Name of the Vulnerable Software and Affected Versions innovaphone PBX versions 10.00 sr11 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts. This can be achieved through crafted request...

PT-2014-6284

Name of the Vulnerable Software and Affected Versions concrete5 versions prior to 5.6.3 Description The issue allows remote attackers to obtain the installation path via a direct request to various API endpoints, including "system/basics/editor.php", "system/view.php", "system/environment/file...

PT-2014-6085

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions 5.0.x through 5.2.x before 5.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to API endpoints such as "user/ldap user/check dlg" or "user/radius...

PT-2014-5512

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM versions prior to 4.7.0 Description The issue allows remote attackers to execute arbitrary commands via crafted requests to specific API endpoints, including update system info debian package, ossec task, set ossim setup admin...

PT-2014-5516

Name of the Vulnerable Software and Affected Versions BarracudaDrive versions prior to 6.7.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in various API endpoints, including the role parameter to "roles.lsp", the name parameter to...

PT-2014-3587

Name of the Vulnerable Software and Affected Versions Xangati XSR versions prior to 11 Xangati XNR versions prior to 7 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in various parameters. This can be achieved through several API endpoints, including:...

PT-2014-4762

Name of the Vulnerable Software and Affected Versions BarracudaDrive versions prior to 6.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different API endpoints, including "/Forum/manage/ForumManager.lsp" with sForumName or...

PT-2014-2677

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-812DRU router affected versions not specified Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in various parameters, including wan network prefix, remote port, pptp...

Cross site request forgery (csrf)

1 ApiBlock.php, 2 ApiCreateAccount.php, 3 ApiLogin.php, 4 ApiMain.php, 5 ApiQueryDeletedrevs.php, 6 ApiTokens.php, and 7 ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the...

PT-2013-5891

Name of the Vulnerable Software and Affected Versions AlienVault Open Source Security Information Management OSSIM versions 4.3 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the date from parameter to several API endpoints,...

PT-2013-5260

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator versions 4.6.6 and earlier McAfee ePO Extension for the McAfee Agent versions 4.5 through 4.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including...

PT-2013-4747 · Atlassian · Crowd

Name of the Vulnerable Software and Affected Versions: Atlassian Crowd versions 2.3.8 Atlassian Crowd versions 2.4.9 Atlassian Crowd versions 2.5.x through 2.5.3 Atlassian Crowd versions 2.6.x through 2.6.2 Description: The issue allows remote attackers to read arbitrary files and send HTTP...

PT-2012-2191

Name of the Vulnerable Software and Affected Versions BrowserCRM versions 5.100.01 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the PATH INFO to several API endpoints, such as "index.php", "modules/admin/admin module...

PT-2012-2167

Name of the Vulnerable Software and Affected Versions Social Book Facebook Clone 2010 Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO parameter to several API endpoints, including "/signup.php", "/lostpass.php", "/login.php", "/index.php",...

PT-2012-1322

Name of the Vulnerable Software and Affected Versions SilverStripe versions 2.3.x through 2.3.9 SilverStripe versions 2.4.x through 2.4.3 Description The issue allows remote attackers to obtain version information due to insufficient access control. This is achieved via a direct request to API...

PT-2012-2088

Name of the Vulnerable Software and Affected Versions Blogs Manager versions 1.101 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to various API endpoints, including " authors list.php", " blogs list.php...

PT-2012-2068 · Gr Board · Gboard

Name of the Vulnerable Software and Affected Versions: GR Board aka grboard version 1.8.6.5 Community Edition Description: The issue allows remote attackers to modify or delete data without requiring authentication for certain database actions. This can be achieved by sending a request to specifi...

PT-2012-2996

Name of the Vulnerable Software and Affected Versions OpenEMR version 4.1.0 Description The issue allows remote authenticated users to read arbitrary files due to multiple directory traversal vulnerabilities. This is achieved by including a .. dot dot in the formname parameter to various API...