3801 matches found
Code injection
Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...
CVE-2021-37867
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure...
PT-2022-10684
Name of the Vulnerable Software and Affected Versions Mattermost Boards plugin versions prior to 0.10.0 Description The issue allows authenticated and unauthorized users to access sensitive information, specifically email addresses of all users, via one of the Boards APIs. This results in the...
CVE-2021-28506
An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device...
Authentication flaw
An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device...
CVE-2021-28506
CVE-2021-28506 affects Arista EOS via gNOI APIs (OpenConfig gNMI/gNOI and TerminAttr) where authentication/authorization can be skipped, potentially allowing a device factory reset. The Arista advisory lists affected software trains and versions, with remediation by upgrading to remediated releas...
CVE-2021-28506: Improper Authorization
An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device...
PT-2022-9898
Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description An issue has been discovered where certain gNOI APIs in Arista EOS incorrectly skip authorization and authentication, potentially allowing a factory reset of the device. Recommendations At...
CVE-2021-34086
In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests...
Cross site request forgery (csrf)
In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests...
CVE-2021-34086: Cross-Site Request Forgery (CSRF)
In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests...
Google Chrome Memory Use After Free
The vulnerability of Google Chrome’s web APIs is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by using a specially created HTML page...
CVE-2021-39998
CVE-2021-39998 affects Huawei HarmonyOS HwConnectivityExService in smartphones. The vulnerability arises from APIs being concurrently called multiple times, which can cause the system to crash and restart. NVD notes a HIGH severity (CVSSv3.1: 7.5) with network attack vector, low authentication/co...
SQL Injection
codeigniter4/framework is vulnerable to SQL injection. The old function in system/Common.php does not properly sanitize the user input, which allows a remote attacker to inject arbitrary SQL commands to the APIs...
CVE-2021-37134
Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface of location-related components...
Race condition
Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface of location-related components...
CVE-2021-37134
CVE-2021-37134 affects HarmonyOS where a race condition in location-related APIs could allow a process to invoke interfaces with higher permissions. The available descriptions identify the vulnerability as a race condition in location components, enabling elevated access, but do not provide produ...
PT-2022-10634
Name of the Vulnerable Software and Affected Versions Location-related APIs affected versions not specified Description A race condition issue exists in location-related APIs, which could allow successful exploitation to invoke the interface of location-related components with higher permissions...
SQLite report about CVE-2022-35737
This bug is an array-bounds overflow. The bug is only accessible when using some of the C-language APIs provided by SQLite. The bug cannot be reached using SQL nor can it be reached by providing SQLite with a corrupt database file. The bug only comes up when very long string inputs greater than 2...