GHSA-HF4P-MHC8-X2GP Apache Archiva vulnerable to Cross Site Request Forgery

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

Improper Access Control

Keycloak REST Services is vulnerable to improper access control. The vulnerability exists in exchangeClientToClient function in DefaultTokenExchangeProvider because the clients can exchange the tokens issued to other clients by passing the clientid which allows an attacker to gain unauthorized...

Security Bulletin: Vulnerability in WebSphere Commerce REST services (CVE-2012-3298) *|* -9958B33F7781FF2C85257A77006ED4

Question Security Bulletin: Vulnerability in WebSphere Commerce REST services CVE-2012-3298 | -9958B33F7781FF2C85257A77006ED44E- | Answer Technote troubleshooting ProblemAbstract WebSphere Commerce REST services framework contains security vulnerability. Resolving the problem VULNERABILITY DETAIL...

CVE-2020-10372: Improper Neutralization of Input During Web Page Generation

Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/datastore/createOrEditValueForKey URI...

Drupal 8.6.9 - REST Module Remote Code Execution

Drupal 8.6.9 - REST Module Remote Code Execution !/usr/bin/env python3 CVE-2019-6340 Drupal = 8.6.9 REST services RCE PoC 2019 @leonjza Technical details for this exploit is available at: https://www.drupal.org/sa-core-2019-003 https://www.ambionics.io/blog/drupal8-rce...

Drupal < 8.6.9 - REST Module Remote Code Execution Exploit

Exploit for php platform in category web applications !/usr/bin/env python3 CVE-2019-6340 Drupal = 8.6.9 REST services RCE PoC 2019 @leonjza Technical details for this exploit is available at: https://www.drupal.org/sa-core-2019-003 https://www.ambionics.io/blog/drupal8-rce...

Oracle E-Business Multiple Vulnerabilities (Oct 2018 CPU)

The version of Oracle E-Business installed on the remote host is missing the October 2018 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory : - An unspecified vulnerability in the Oracle Trade...

CVE-2018-2971

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite subcomponent: REST Services. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via...

Code injection

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite subcomponent: REST Services. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via...

CVE-2018-2971

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite subcomponent: REST Services. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via...

CVE-2018-2971: Undefined Security Weakness

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite subcomponent: REST Services. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via...

Apache CXF Denial of Service Vulnerability (CNVD-2017-34229)

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. Apache CXF versions prior to 3.2.1 and 3.1.14 prior to the JAX-WS and JAX-RS services i...

EMC AppSync Apollo REST Services SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of EMC Appsync. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed. The specific flaw exists within Apollo REST...

Cross-Site Request Forgery (CSRF)

Apache Archiva and redback-rest-services are vulnerable to cross-site request forgery CSRF attacks.The library does not protect against CSRF attacks at several REST endpoints. This allows a malicious user to send HTML responses that can perform arbitrary actions on the archiva services via a...

Extract Metadata From Files: ImageCat

Extract Metadata From Files This is an OODT RADIX application that uses Apache Solr , Apache Tika and Apache OODT to ingest 10s of millions of files images,but could be extended to other files in place, and to extract metadata and OCR information from those files/images using Tika and Tesseract O...

CVE-2013-2994

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 are affected by a vulnerability where a valid session is not properly controlled after unspecified interaction with REST services. This could allow a remote attacker to issue REST requests in the context of an arbitrary user’s active se...

CVE-2013-2994: Improper Input Validation

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors...

IBM WebSphere Commerce Enterprise REST服务安全限制绕过漏洞

BUGTRAQ ID: 55684 CVE ID: CVE-2012-3298,CVE-2012-3300 IBM WebSphere Commerce Enterprise 是业界领先的电子商务解决方案。 IBM WebSphere Commerce v7.0.0.0 - 7.0.0.5存在安全漏洞，成功利用后可允许远程攻击者绕过某些安全限制并执行未授权操作。 1 REST服务框架内存在错误，可被利用非法访问资源。 2）处理持久会话和个性化ID时存在错误，可被利用消耗系统资源并显示服务不可用。 0 IBM WebSphere Commerce Enterprise 7.0.0.0 -...

Design/Logic Flaw

Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors...

CVE-2012-3298

Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors...