140 matches found
CVE-2024-2667
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...
VulnCheck KEV: CVE-2024-2667
The InstaWP Connect -- 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...
CVE-2024-29192
gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...
PT-2024-23636 · Netentsec · Netentsec Ns-Asg
Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue concerns a SQL injection vulnerability. It can be exploited via the "/admin/config ISCGroupSSLCert.php" API endpoint. This could potentially allow for remote attacks. Recommendations: For...
PT-2024-1049 · Cassia · Cassia Gateway Firmware Xc2000 +1
Name of the Vulnerable Software and Affected Versions: Cassia Gateway firmware XC1000 2.1.1.2303082218 Cassia Gateway firmware XC2000 2.1.1.2303090947 Description: The issue is related to the queueUrl parameter in the "/bypass/config" API endpoint, which is not properly sanitized. This allows for...
Exploit for Improper Access Control in Joomla Joomla\!
CVE-2023-23752 Joomla Unauthorized Access Vulnerability CVE...
PT-2023-29641 · Frigate · Frigate
Name of the Vulnerable Software and Affected Versions: Frigate versions prior to 0.13.0 Beta 3 Description: Frigate is an open source network video recorder. An unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate, which can lead to...
Information Disclosure
apache-airflow is vulnerable to Information Disclosure. The vulnerability is found in the configendpoint.py due to the fact that conf.getboolean"webserver", "exposeconfig" handles only the boolean cases and does not properly handle the case of non-sensitive-only. This oversight enables an...
PT-2023-29858
Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1 Description The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before ...
PT-2023-4951 · Triangle Microworks · Scada Data Gateway
Name of the Vulnerable Software and Affected Versions: Triangle MicroWorks SCADA Data Gateway affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations due to missing authentication. The specific flaw exists within...
CVE-2020-18416
An cross site request forgery CSRF vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin.php?s=/addons/config.html&id=6 to modify payment information...
EdgeX Foundry 信息泄露漏洞
EdgeX Foundry is an open source project to build a common open framework for IoT edge computing. An information disclosure vulnerability exists in EdgeX Foundry versions prior to 2.1.1, which stems from the /api/v2/config endpoint exposing message bus credentials to a local, unauthenticated user...
PT-2022-3231 · Unknown · Edgexfoundry
Name of the Vulnerable Software and Affected Versions: EdgeXFoundry versions prior to 2.1.1 Description: The /api/v2/config endpoint exposes message bus credentials to local unauthenticated users, bypassing access controls on message bus credentials when running in security-enabled mode. This...
CVE-2021-38615
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user guest, standard, or admin to view and modify information...
CVE-2021-38615
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user guest, standard, or admin to view and modify information...
The vulnerability of the “/api/v2/config” component in the Red Hat Ansible Tower management console allows a malicious individual to gain unauthorized access to application user passwords.
The vulnerability of the “/api/v2/config” component in the Red Hat Ansible Tower management console is related to the unencrypted storage of confidential information. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the application user passwords...
CVE-2019-14890
A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license...
CVE-2019-9597
Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint...
