PT-2022-24168

Name of the Vulnerable Software and Affected Versions IBAX go-ibax affected versions not specified Description A critical vulnerability has been found in IBAX go-ibax, affecting an unknown function of the file "/api/v2/open/tablesInfo". The manipulation leads to SQL injection, and it is possible ...

PT-2022-24172

Name of the Vulnerable Software and Affected Versions go-ibax versions starting from commits on Jul 18, 2020 Description A critical issue has been found in go-ibax, allowing for SQL injection. This is due to the manipulation of the where argument in the /api/v2/open/rowsInfo endpoint, which can b...

PT-2022-24171

Name of the Vulnerable Software and Affected Versions IBAX go-ibax affected versions not specified Description A critical issue was found in IBAX go-ibax, affecting the /api/v2/open/rowsInfo endpoint. The manipulation of the order argument leads to SQL injection. This issue can be exploited...

PT-2022-24169

Name of the Vulnerable Software and Affected Versions IBAX go-ibax affected versions not specified Description A critical issue was found in IBAX go-ibax, affecting an unknown functionality of the file "/api/v2/open/tablesInfo". This issue leads to sql injection and can be exploited remotely. The...

PT-2022-24170

Name of the Vulnerable Software and Affected Versions IBAX go-ibax affected versions not specified Description A critical issue has been found in IBAX go-ibax, affecting some unknown functionality of the file "/api/v2/open/rowsInfo". The manipulation of the table name argument leads to SQL...

CVE-2022-3799: Improper Neutralization

A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2022-31066

EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config endpoint exposes message bus credentials to local unauthenticated users. In security-enabled mode, message bus credentials are supposed to...

Improper Privilege Management API V2

Description There are some api v2 doesn't check permission allow attackers to retrieve/edit information ticket,account,group,department,team,ElasticSearch Proof of Concept Get users list 1. Login. 2. Go to /api/v2/accounts?type=all. 3. Users list return. Create user with admin role 1. Get the adm...

PT-2022-11436

Name of the Vulnerable Software and Affected Versions RSA Archer version 6.9.SP1 P3 Description The issue allows an attacker to bypass precluded application functions by intercepting the API request at the "/api/V2/internal/TaskPermissions/CheckTaskAccess" endpoint. If the parameters of this...

CVE-2020-14329: Exposure of Sensitive Information to an Unauthorized Actor

A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The...

PT-2021-9716

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.7.2 Description A data exposure flaw was found in Ansible Tower, where sensitive data can be exposed from the "/api/v2/labels/" endpoint. This flaw allows users from other organizations in the system to retrie...

CVE-2020-26223

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Ord...

GHSA-M2JR-HMC3-QMPR Authorization bypass in Spree

Impact The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree 3.7 are not affected. References Pull request with a fix and in-depth explanati...

CVE-2020-26223: Incorrect Authorization

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Ord...

PT-2020-16352

Name of the Vulnerable Software and Affected Versions Spree versions prior to 3.7.11 Spree versions 3.7.11 through 3.7.12 are not affected, but versions prior to 3.7.11 are. However, considering the broader range, we can simplify to: Spree versions prior to 3.7.11 Spree versions 4.0.0 through 4.0...

CVE-2020-15269

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory...

Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

Impact The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Workarounds In your project directory create a decorator file...

GHSA-F8CM-364F-Q9QH Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

Impact The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Workarounds In your project directory create a decorator file...

CVE-2020-15269: Improper Authentication

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory...

PT-2020-14327

Name of the Vulnerable Software and Affected Versions Spree versions prior to 3.7.11 Spree versions prior to 4.0.4 Spree versions prior to 4.1.11 Description The issue allows expired user tokens to be used for accessing Storefront API v2 endpoints. This could be exploited by a perpetrator who...