CVE-2016-6335

CVE-2016-6335 affects MediaWiki: versions prior to 1.23.15, 1.26.x prior to 1.26.4, and 1.27.x prior to 1.27.1. The vulnerability allows remote attackers to obtain sensitive information via a parse action to api.php due to failure to generate head items in the context of a given title. Impact is ...

CVE-2017-7283

CVE-2017-7283 affects Unitrends Enterprise Backup prior to 9.1.2. An authenticated user can trigger arbitrary OS command execution by supplying a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php. The NVD data...

Kong and Wallarm Partner Up to Boost Microservices API Security

Wallarm has partnered with Mashape to provide the microservices community with API security. Mashape enterprise customers who use Kong API gateway can now quickly add API security protection without change in Kong user’s deployment. Read more about Kong and Wallarm partnership in this blog. Today...

math.js remote code execution vulnerability

This article explains in short how we found, exploited and reported a remote code execution RCE vulnerability. It is meant to be a guide to finding vulnerabilities, as well as reporting them in a responsible manner. Step one: discovery While playing around with a wrapper of the math.js API...

shellcode programming: in memory in the parsing API to address-vulnerability warning-the black bar safety net

For Windows all with position-independent code, PIC core feature is based on a real-time analysis the API function address. It is a very important task. Here I introduce two popular methods, the use of the import address table IAT, and export address table to EAT is by far the most stable method...

Showmax: Changing details of other users profile using UUID (IDOR)

Access token uniquely maps to particular user record, which is then the only one accessible to user when doing API calls. Issue arise when intermediate service had used service token to update the user record. That allowed accessing user details of other user that the current access token belongs...

api.boomtrain.com Open Redirect vulnerability

Vulnerable URL: https://api.boomtrain.com/ct?url=https://www.openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status...

api.successfn.com XSS vulnerability

Vulnerable URL: http://api.successfn.com/getDjNews.php?jsoncallback=prompt/OPENBUGBOUNTY/...

api.skiline.cc XSS vulnerability

Vulnerable URL: http://api.skiline.cc/widgets/index.php?lang=no" Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:38 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

Fedora 22 : mediawiki (2015-122a831a05)

T94116 SECURITY: Compare API watchlist token in constant time - T97391 SECURITY: Escape error message strings in thumb.php - T106893 SECURITY: Don't leak autoblocked IP addresses on Special:DeletedContributions - T102562 Fix InstantCommons parameters to handle the new HTTPS-only policy of...

Swagger 通过参数注入远程代码执行漏洞

详情来源： R7-2016-06 This disclosure will address a class of vulnerabilities in a Swagger Code Generator in which injectable parameters in a Swagger JSON or YAML file facilitate remote code execution. This vulnerability applies to NodeJS, PHP, Ruby, and Java and probably other languages as well. Othe...

CVE-2016-3072

CVE-2016-3072 is evidenced by multiple sources describing SQL injection in Katello’s API (scoped_search in app/controllers/katello/api/v2/api_controller.rb) allowing authenticated remote users to inject SQL via sort_by or sort_order. Connected advisories (GHSA-527R-MFMJ-PRQF, GHSA-JX5V-788G-QW58)...

api.smule.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-157445 Description| Value ---|--- Affected Website:| api.smule.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Protecting Cloud APIs Critical to Mitigating Total Compromise

When it comes to cloud computing, APIs more or less drive everything, but in the eyes of some researchers, existing security controls around them haven’t kept pace. While individual components of a system can be secure, when that system gets deployed in the cloud it can often become insecure – an...

api.gruvvin.com XSS vulnerability

Vulnerable URL: http://api.gruvvin.com/showpage.php?showinfoid=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Bumble: Password modification without knowing actual password & httpOnly bypass

Two issues: Session cookie is returned in HTML source code of /encounters page, which would allow an XSS attacker to steal it, even if httpOnly is activated. A secret value, present in HTML source code of some api.phtml pages, can be used to modify user's password without knowing actual one...

VK.com: Дорк

Привет команда ВК вводим в гугл site:api.vk.com получаем список ссылок сужаем запрос site:api.vk.com accesstoken Получаем ссылки с accesstoken...

api.forismatic.com XSS vulnerability

Vulnerable URL: http://api.forismatic.com/api/1.0/?method=getQuote=jsonp〈=en=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown /...

phpyun v4.0 api/locoy/model/news.class.php SQL注入漏洞

No description provided by source...

api.txtlocal.com XSS vulnerability

Open Bug Bounty ID: OBB-104968 Description| Value ---|--- Affected Website:| api.txtlocal.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...