1658 matches found
PT-2024-13410 · N Able · N-Able N-Central
Name of the Vulnerable Software and Affected Versions: N-able N-central versions prior to 2023.6 Description: An issue in N-able N-central allows attackers to gain escalated privileges via API calls. Recommendations: For versions prior to 2023.6, update to version 2023.6 or later to resolve the...
N-able N-central Security Vulnerabilities
N-able N-central is an RMM platform from N-able, Inc. providing large-scale management, automation and orchestration capabilities for sophisticated MSPs and IT professionals. A security vulnerability exists in N-able N-central version 2023.6 and prior versions, which stems from a vulnerability th...
Superwebmailer Cross-Site Scripting Vulnerability
Superwebmailer is a web-based PHP newsletter software for newsletter recipient management, sending HTML newsletters, birthday emails. A cross-site scripting vulnerability exists in Superwebmailer version v9.31.0.01799, which stems from a cross-site scripting vulnerability in the component api.php...
Open Forms Security Vulnerability
Open Forms is Open Formulieren open source an intelligent dynamic form . Used to quickly create a powerful and intelligent forms exposed through the API . A security vulnerability exists in Open Forms versions prior to 2.2.8, 2.3.6, 2.4.4, 2.5.1, which stems from an authentication bypass...
Elastic Security Breach
Elastic is the Netherlands Elastic company's set of open source distributed RESTful search engine built on Lucene . The product is primarily used in cloud computing and supports data indexing using JSON over HTTP. A security vulnerability exists in Elastic that stems from the possibility that a...
The vulnerability of the API PUT Request Handler component of the software platform based on Git, which is used for collaborative code development in GitLab, allows a malicious actor to execute arbitrary API PUT requests.
The vulnerability of the API PUT Request Handler component of the software platform based on Git for collaborative code development on GitLab exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary API PUT...
PYSEC-2024-261
A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request...
PYSEC-2024-261
A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request...
CVE-2024-1210
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it possible for unauthenticated attackers to obtain access to quizzes...
CVE-2024-23109
An improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests...
WordPress Plugin LearnDash LMS Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
PT-2024-16192 · Openbi · Openbi
Name of the Vulnerable Software and Affected Versions: openBI versions up to 1.0.8 Description: A problematic issue has been found, affecting the function agent of the file /application/index/controller/Datament.php. The manipulation of the api argument leads to information disclosure. This issue...
The vulnerability of the application programming interface of the Splunk Enterprise platform for operational analysis allows a perpetrator to delete data from the KV Store.
The vulnerability of the application programming interface of the Splunk Enterprise platform for operational analysis is related to deficiencies in access control to the KV Store. Exploiting this vulnerability could allow a malicious actor to delete data from the KV Store...
VulnCheck KEV: CVE-2021-42567
Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...
QSIGE Security Vulnerabilities
QSIGE is an intelligent waiting management system from QSIGE, Inc. A security vulnerability exists in QSIGE that stems from omitting key control authorization, allowing an attacker to extract sensitive information from the API...
Plotly.js Security Vulnerability
Plotly.js is Plotly open source an independent Javascript data visualization library . Plotly.js version before 2.25.2 has a security vulnerability , the vulnerability stems from a prototype contamination problem in the API call...
PT-2023-32722 · WordPress · Essential Blocks
Name of the Vulnerable Software and Affected Versions: The Essential Blocks WordPress plugin versions prior to 4.4.3 Description: The issue allows unauthenticated attackers to overwrite local variables when rendering templates over the REST API, potentially leading to Local File Inclusion attacks...
PT-2023-9808
Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment versions 8.2.2 and earlier Description The issue is related to insufficient safeguards against malicious API response values in Proxmox Virtual Environment, allowing authenticated attackers with 'Sys.Audit' or...
Nextcloud Access Control Error Vulnerability
Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. An Access Control Error vulnerability exists in Nextcloud Server, which stems from the ability to delete and modify workflows by bypassing calls sent direct...