ArticaTech Artica Web Proxy SQL Injection Vulnerability

ArticaTech Artica Proxy is an open source Artica proxy solution from the French company ArticaTech. An SQL injection vulnerability exists in the 'apikey' parameter of the fw.login.php file in Artica Web Proxy version 4.30.00000000. A remote attacker can exploit this vulnerability to bypass...

CVE-2020-17506

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php...

CVE-2020-17506: Improper Neutralization of Special Elements used in an SQL Command

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php...

CVE-2020-10591

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

PT-2020-12222

Name of the Vulnerable Software and Affected Versions Walmart Labs Concord versions prior to 1.44.0 Description An issue allows remote attackers to discover host information, nodes, API metadata, and references to usernames via the "api/v1/apikey" endpoint. This is due to CORS...

CVE-2020-10591: Undefined Security Weakness

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

ZOHO ManageEngine OpManager SQL Injection Vulnerability (CNVD-2019-24541)

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A SQL injection vulnerability exists in the 'apiKey' parameter in ZOHO ManageEngine OpManager version 12.2. The vulnerability stems from a lack of validation of externally entered SQL...

Sql injection

An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack...

PT-2019-7894

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager version 12.2 Description An issue was discovered in the software, where the apiKey parameter of the API endpoints "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a...

CVE-2017-11559: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack...

PT-2019-9152

Name of the Vulnerable Software and Affected Versions 42Gears SureMDM versions prior to 2018-11-27 Description An issue was discovered in the registration API endpoint. An attacker can submit a GET request to "/api/register/:email", where :email is a base64 encoded e-mail address, to receive...

CVE-2018-15656: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email, where :email is a base64 encoded e-mail address, to receive confirmation as to whether a user account exists in the system with the specifie...

TestLink SQL Injection Vulnerability (CNVD-2017-32128)

Testlink is TestLink team developed a PHP-based open source test management tool . The tool provides test requirements management , test case management and test data statistics and other functions . SQL injection vulnerability exists in versions of TestLink before 1.9.14. A remote attacker can...

Sql injection

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...

CVE-2015-7390

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...

CVE-2015-7390: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...

PT-2017-7202

Name of the Vulnerable Software and Affected Versions TestLink versions prior to 1.9.14 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the apikey parameter to the "lnl.php" endpoint. Recommendations For versions prior to 1.9.14, update to...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

PT-2017-18053

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.4.1 and earlier Description The issue concerns a SQL injection vulnerability. It occurs via a base64 serialized API key in the apikey parameter within the api function of...

CVE-2017-7991: Improper Neutralization of Special Elements used in an SQL Command

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...