What is OpenAPI ❓ Concept, Examples and Advantages

What is OpenAPI? If there is anything that is growing anything like leaps and bounds then it’s API development and awareness towards API’s security. Whether it’s web API or mobile API, growth is significant in each domain. While we discuss API development, OpenAPI deserves a mention for sure. Thi...

easy-mock 1.6.0 - Remote Code Execution (Authenticated) Exploit

Exploit Title: easy-mock 1.6.0 - Remote Code Execution RCE Authenticated Exploit Author: LionTree Vendor Homepage: https://github.com/easy-mock Software Link: https://github.com/easy-mock/easy-mock Version: 1.5.0-1.6.0 Tested on: windows 10node v8.17.0 import requests import json import random...

Easy-Mock 1.6.0 Remote Code Execution

Exploit Title: easy-mock 1.6.0 - Remote Code Execution RCE Authenticated Date: 12/08/2021 Exploit Author: LionTree Vendor Homepage: https://github.com/easy-mock Software Link: https://github.com/easy-mock/easy-mock Version: 1.5.0-1.6.0 Tested on: windows 10node v8.17.0 import requests import json...

easy-mock 1.6.0 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: easy-mock 1.6.0 - Remote Code Execution RCE Authenticated Date: 12/08/2021 Exploit Author: LionTree Vendor Homepage: https://github.com/easy-mock Software Link: https://github.com/easy-mock/easy-mock Version: 1.5.0-1.6.0 Tested on: windows 10node v8.17.0 import requests import json...

Yapi 远程命令执行漏洞

如何复现此问题 登录注册后，创建一个项目 然后选择设置全局的mock脚本，设置命令为远程访问我的服务器地址。 随后添加接口，访问接口的mock地址 服务器可看到响应如下，远程服务器接受到请求 poc: const sandbox = this const ObjectConstructor = this.constructor const FunctionConstructor = ObjectConstructor.constructor const myfun = FunctionConstructor'return process' const process = myfun...

ASB-A-177561690

In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privilege...

botbuilder (>=4.10.0-dev.20200805.aa06ea2, <=4.10.2-rc0), botbuilder-azure (>=4.10.0-dev.20200805.aa06ea2, <=4.10.2-rc0) +2 more potentially affected by CVE-2021-1725 via botframework-connector (>=4.10.0, <=4.10.2-rc0)

botframework-connector NPM version =4.10.0, =4.10.0-dev.20200805.aa06ea2, =4.10.0-dev.20200805.aa06ea2, =4.10.0-dev.20200805.aa06ea2, =4.10.2-rc0-preview - botkit-mock 4.10.0 Source cves: CVE-2021-1725 Source advisory: OSV:GHSA-FVCJ-HVFW-7F2V...

skia:api_mock_gpu_canvas: Heap-buffer-overflow in make_unnormalized_half_kernel

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5412276593098752 Project: skia Fuzzing Engine: afl Fuzz Target: apimockgpucanvas Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x619000011280 Crash...

CVE-2020-26811

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Reque...

CVE-2020-26810

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerc...

CVE-2020-26810

CVE-2020-26810 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, 2005. An unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL that is processed with no further interaction, causing the SAP Commerce service to become unavailabl...

CVE-2020-26811

CVE-2020-26811 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, and 2005. The cited issue is a Server-Side Request Forgery (SSRF) where an unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL, which is processed without furthe...

CVE-2020-26810: Undefined Security Weakness

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerc...

CVE-2020-26811: Server-Side Request Forgery (SSRF)

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Reque...

PT-2020-16497

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud Accelerator Payment Mock versions 1808, 1811, 1905, 2005 Description The issue allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL, which will be processed...

PT-2020-16498

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud Accelerator Payment Mock versions 1808, 1811, 1905, 2005 Description The issue allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL, which will be processed...

GHSA-2H3X-95C6-885R Malicious Package in river-mock

All versions of river-mock contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comput...

Malicious Package in river-mock

All versions of river-mock contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comput...

Malicious Package in luna-mock

All versions of luna-mock contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that compute...

GHSA-QM4Q-F956-FG64 Malicious Package in luna-mock

All versions of luna-mock contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that compute...