8635 matches found
com.a9ski.brooklyn:apache-brooklyn-ldap-provider (1.0.0), eu.seaclouds-project:seaclouds-qa (1.0.0) +24 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-rest-api (>=0.7.0-incubating, <=0.9.0)
org.apache.brooklyn:brooklyn-rest-api MAVEN version =0.7.0-incubating, =0.2.0, =0.2.0, =0.3.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =0.7.0-incubating, =0.7.0-incubating, =0.9.0 and more Source cves: CVE-2016-8737 Source advisory: SNYK:JAVA-ORGAPACHEBROOKLYN-9962107...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...
CVE-2017-14337
When MISP before 2.4.80 is configured with X.509 certificate authentication CertAuth in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access ...
CVE-2017-14337: Improper Authentication
When MISP before 2.4.80 is configured with X.509 certificate authentication CertAuth in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access ...
PT-2017-13399
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.80 Description The issue arises when MISP is configured with X.509 certificate authentication in conjunction with an external user management ReST API. If this API returns an empty value for an external user providin...
Caldera Forms <= 1.5.4 - Authenticated Cross-Site Scripting (XSS)
Version 1.5.4 and earlier of Caldera Forms is vulnerable to a reflected cross-site scripting vulnerability in the "edit" parameter, which is not properly escaped before being printed in an HTML attribute. An attacker can use this to craft URLs that, when clicked, result in malicious JavaScript...
HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation
This module exploits an authentication bypass in HP iLO 4 1.00 to 2.50, triggered by a buffer overflow in the Connection HTTP header handling by the web server. Exploiting this vulnerability gives full access to the REST API, allowing arbitrary accounts creation. Module Options msf use...
Drupal 8.x < 8.3.7 Multiple Vulnerabilities (SA-CORE-2017-004)
According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured ...
DEBIAN-CVE-2017-7557
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
CVE-2017-7557
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
CVE-2017-7557
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
Cross site request forgery (csrf)
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
CVE-2017-7557
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
CVE-2017-7557
CVE-2017-7557 affects dnsdist 1.1.0, where an authentication flaw in the REST API potentially enables CSRF. Evidence across multiple advisories shows this vulnerability alongside other issues (CVE-2016-7069, CVE-2018-14663) and that fixes exist in later dnsdist releases. Upgrading to at least 1.2...
CVE-2017-7557
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
CVE-2017-7557: Improper Authentication
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...
FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)
Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...
Drupal Patches Critical Access Bypass Bug
Website management platform Drupal released several patches that address access bypass vulnerabilities in its Drupal 8 Core engine Wednesday, fixing one critical and two moderately critical security bugs. The most serious of the vulnerabilities is the access bypass vulnerability CVE-2017-6925 in...
