Fortinet FortiDeceptor Privilege Bypass

The vulnerability of the Fortinet FortiDeceptor system, which is used for detecting and responding to external and internal security threats, is related to improper privilege management. Exploiting this vulnerability allows an attacker, operating locally, to execute unauthorized API calls using...

Incognito Service Activation Center security vulnerability

Incognito Service Activation Center Incognito SAC is a cloud-native solution from Incognito that automates the delivery of intent-based IP services through any access technology and simplifies back-end processes to reduce operational expenses. A security vulnerability exists in Incognito Service...

CVE-2024-20527

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

PYSEC-2024-238

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints includ...

SUSE CVE-2024-39719

An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the...

PT-2024-8001 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.1.0 through 10.0.16 Description: The issue is related to incorrect access control in the GLPI system, which can allow a remote attacker to exploit the vulnerability and potentially disclose confidential information. A technici...

PYSEC-2024-202

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user...

CVE-2024-51559

This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts...

Brokerage Wave security vulnerabilities

Brokerage Wave is a frontend product from Brokerage, Inc. A security vulnerability exists in Brokerage Wave version 2.0, which stems from a lack of limitations on too many failed authentication attempts for API-based logins, which could allow an attacker to cause unauthorized access by brute-forc...

PT-2024-34699 · Wave · Wave

Name of the Vulnerable Software and Affected Versions: Wave version 2.0 Description: The issue arises from insufficient encryption of sensitive data received at the API response, allowing an authenticated remote attacker to exploit it by manipulating API input parameters. This could lead to...

PT-2024-34701 · Wave · Wave

Name of the Vulnerable Software and Affected Versions: Wave 2.0 Description: This issue is due to missing restrictions for excessive failed authentication attempts on the API-based login. A remote attacker could exploit this by conducting a brute force attack against legitimate user OTP, MPIN, or...

TrueConf Server Information Disclosure

The vulnerability of the TrueConf Server software is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to obtain information about system users by sending a specially crafted API request...

JetBrains YouTrack Plugin XSS

The vulnerability of the iframe plugin in the JetBrains YouTrack software environment relates to insufficient verification of the connection source. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code and make unauthorized API requests...

PT-2024-33280 · Zimaos · Zimaos

Name of the Vulnerable Software and Affected Versions: ZimaOS versions 1.2.4 and earlier Description: The issue allows unauthenticated users to access sensitive information, such as usernames, through the API endpoint http:///v1/users/name without any authorization. This could be exploited by an...

Windows API Code Execution

The vulnerability of the Application Programming Interface API of Windows operating systems relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab version 11.4 up to and including...

JetBrains YouTrack security vulnerabilities

JetBrains YouTrack is a project management tool that supports cloud hosting and local deployment, and is primarily geared towards team collaboration management, especially suitable for software development, human resources, marketing, and other scenarios. JetBrains YouTrack suffers from an improp...

PT-2024-6798

Name of the Vulnerable Software and Affected Versions Microsoft Speech Application Programming Interface SAPI affected versions not specified Description The issue is related to a remote code execution vulnerability in the Microsoft Speech Application Programming Interface SAPI. It is caused by t...

CVE-2024-43574: Use After Free

Microsoft Speech Application Programming Interface SAPI Remote Code Execution Vulnerability...

VegaBird Vooki security vulnerabilities

VegaBird Vooki is a free web application vulnerability scanning tool from VegaBird Open Source that helps users to scan any web application and find vulnerabilities.Vooki consists of three main parts: a web application scanner, a Rest API scanner, and a reporting feature. VegaBird Vooki version...