69 matches found
CVE-2024-55585
In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword...
CVE-2024-55585
In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword...
PT-2025-24348 · Mops App +1 · Mops App +1
Name of the Vulnerable Software and Affected Versions: moPS App versions 1.8.618 and earlier moPS App Engine version 1.8.618 Description: The issue allows all users to access administrative API endpoints, such as "/api/admin", without requiring additional authentication. This results in...
Inproper Authorization
Ant Media Server Community Edition is vulnerable to Improper Authorization. The vulnerability is due to improper HTTP header based authorization which allows unauthorized users to potentially access non-administrative API calls reserved for authorized users...
CVE-2024-3462
Ant Media Server Community Edition is vulnerable to improper HTTP header based authorization, allowing unauthorized users to access non-administrative API calls reserved for authorized users. Affected versions are prior to 2.9.0 (tested); vendor status on a patch is not confirmed. Multiple source...
CVE-2024-3462 Authorization bypass in Ant Media Server
Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...
CVE-2023-49231
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token...
CVE-2023-49231
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token...
CVE-2023-49231
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token...
CVE-2023-49231
An authentication bypass affecting Stilog Visual Planning 8 (pre-build 240207) is documented. A wildcard injection inside a prepared SQL statement in the REST API v2.0 enabled attackers to exfiltrate the REST API key and obtain an administrative API token, granting unauthenticated admin access. T...
Exploit for CVE-2023-31711
CVE-2023-31711 Incorrect Access Control in ZKTECO allows...
OpenStack Keystone Allows Remote User Account Creation
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex 2012.1, allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly...
CVE-2021-4133
Keycloak vulnerability CVE-2021-4133 affects versions 12.0.0 up to, but not including, 15.1.1. An attacker with an existing user account can create new default user accounts via the administrative REST API even when new user registration is disabled, due to improper authorization validation in th...
CVE-2019-12182
Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API...
Directory traversal
Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API...
CVE-2019-12182
CVE-2019-12182 describes a Directory Traversal vulnerability in Safescan Timemoto and TA-8000 series (version 1.0) that allows unauthenticated remote code execution via the administrative API. Affected product family is Safescan Timemoto/TA-8000, with identifiers appearing across NVD, Red Hat, CN...
CVE-2019-12182
Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API...
CVE-2019-12183
Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API...