PT-2017-13736

Name of the Vulnerable Software and Affected Versions Restlet Framework versions prior to 2.3.11 Description The issue allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request, specifically when using SimpleXMLProvider with the Jax-rs extension. Recommendatio...

CVE-2017-1628

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

Authorization

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

CVE-2017-1628

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

CVE-2017-1628

Summary (CVE-2017-1628 / IBM BPM 8.6.0.0): IBM Business Process Manager exposes an incorrect authorization check on the Event Manager REST API, allowing authenticated users to stop and resume the Event Manager. The root cause is improper access controls for the stop/resume API. Impact is limited ...

PT-2017-14366

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager version 8.6.0.0 Description The issue allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks. Recommendations For IBM Business Process Manager...

CVE-2017-1628: Incorrect Authorization

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

CVE-2017-1000226

Stop User Enumeration 1.3.8 allows user enumeration via the REST API...

CVE-2017-1000226

Stop User Enumeration 1.3.8 allows user enumeration via the REST API...

CVE-2017-1000226

The Stop User Enumeration plugin for WordPress version 1.3.8 contains a logic flaw that allows user enumeration via the REST API . This vulnerability enables unauthorized actors to perform enumeration operations, potentially exposing sensitive information. As a remediation, it is recommended to d...

CVE-2017-1000226

Stop User Enumeration 1.3.8 allows user enumeration via the REST API...

PT-2017-10922

Name of the Vulnerable Software and Affected Versions Stop User Enumeration version 1.3.8 Description The issue allows user enumeration via the REST API. Recommendations For version 1.3.8, consider disabling the REST API until a patch is available to prevent user enumeration...

CVE-2017-1000226: Exposure of Sensitive Information to an Unauthorized Actor

Stop User Enumeration 1.3.8 allows user enumeration via the REST API...

CVE-2017-7411

An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements method is using the unserialize function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be...

Remote code execution

An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements method is using the unserialize function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be...

CVE-2017-7411

An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements method is using the unserialize function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be...

CVE-2017-7411

Summary (CVE-2017-7411): Enalean Tuleap ≤ 9.6 is vulnerable due to User::getRecentElements() using unserialize() with data manipulable via the REST API, enabling injection of arbitrary PHP objects into the app scope and potential Remote Code Execution. Public material describes a second-order PHP...

CVE-2017-7411: Improper Control of Generation of Code

An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements method is using the unserialize function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be...

PT-2017-17719

Name of the Vulnerable Software and Affected Versions Enalean Tuleap versions 9.6 and prior Description The issue exists due to the User::getRecentElements method using the unserialize function with a preference value that can be manipulated by malicious users through the REST API interface. This...

Access Bypass

Drupal is vulnerable to access bypass. Malicious users are able to leverage the REST API to post approved comments regardless of their permission level. This only affects applications which have the RESTful web services enabled...