34 matches found
CVE-2020-37281
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2020-37281
Gravitee API Management versions through 4.12.22 are vulnerable to an authentication bypass caused by the use of a default JWT secret (CWE-1394). An unauthenticated remote attacker who knows an existing user ID can forge an HS256 token signed with the shipped default secret. By presenting this fo...
EUVD-2020-31280
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2022-38723
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...
EUVD-2023-0563
Malicious code in bioql PyPI...
EUVD-2022-6644
Malicious code in bioql PyPI...
CVE-2019-25075
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request...
Directory Traversal
Gravitee API Management is vulnerable to path traversal. The vulnerability exists in the Email service due to an html injection which allows an attacker to read arbitrary files via a /management/users/register request...
GHSA-VP62-M958-QJ8C Gravitee API Management contains Path Traversal
This CVE addresses the partial fix for CVE-2019-25075 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary...
Gravitee API Management contains Path Traversal
This CVE addresses the partial fix for CVE-2019-25075 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary...
CVE-2022-38723
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...
Path traversal
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...
Gravitee API Management 路径遍历漏洞
Gravitee API Management is an open source Gravitee API management tool. A path traversal vulnerability exists in Gravitee API Management versions prior to 3.15.13, which stems from a vulnerability that allows an attacker to implement path traversal via HTML injection...
PT-2023-13640 · Unknown · Gravitee Api Management
Name of the Vulnerable Software and Affected Versions: Gravitee API Management versions prior to 3.15.13 Description: The issue allows path traversal through HTML injection, potentially enabling anonymous users to read arbitrary files. This is achieved by combining HTML injection with path...
CVE-2022-38723
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...
CVE-2022-38723
CVE-2022-38723 affects Gravitee API Management prior to version 3.15.13, where an HTML-injection flaw enables path traversal. Multiple connected sources confirm the vulnerability exists in Gravitee API Management before 3.15.13 and describe the underlying issue as HTML injection that allows path ...
CVE-2022-38723
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...
