Remote Code Execution

lava is vulnerable to Remote Code Execution. The vulnerability exists in the REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template which allows an attacker to execute arbitrary codes...

CVE-2023-25557 Server-Side Request Forgery in DataHub

DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Store GMS. It has been discovered that the...

Malicious code in @superbet-group/web.lib.rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52048cd4263ed15792f49581fd01b450f4796af1f65b4e839951715b237d3fcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured

Summary A vulnerability in Boundary was identified such that when a Key Management Service KMS was defined in Boundary’s configuration file with the intent of using the KMS to encrypt the credentials stored on disk, new credentials created after an automatic rotation may not have been encrypted v...

CVE-2023-25194

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

Design/Logic Flaw

An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service...

CVE-2021-36225

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

CVE-2021-36225

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

Information disclosure

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

CVE-2021-36225

CVE-2021-36225 affects Western Digital My Cloud devices prior to OS5. The vulnerability allows REST API access by low-privileged accounts, demonstrated by commands for firmware uploads and installation. Documented CVSS: 3.1 base score 8.8 (High) with network attack vector, low complexity, require...

CVE-2021-36225

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

CVE-2021-36225

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

Security Bulletin: IBM MQ is affected by FasterXML jackson-databind vulnerabilities (CVE-2022-42003, CVE-2022-42004)

Summary Multiple issues were identified with the Jackson library that is used within the IBM MQ Console to provide REST API functionality. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in the...

CVE-2023-22326

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell tmsh dig command which...

CVE-2023-22326 iControl REST and tmsh vulnerability

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell tmsh dig command which...

CVE-2023-22326

Vulnerability CVE-2023-22326 affects BIG-IP iControl REST and tmsh dig command. An authenticated attacker with resource administrator or administrator privileges can view sensitive information due to incorrect permission assignments in versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1...

CVE-2023-22326 iControl REST and tmsh vulnerability

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell tmsh dig command which...

K83284425: iControl REST and tmsh vulnerability CVE-2023-22326

Security Advisory Description Incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell tmsh dig command which may allow an authenticated attacker with resource administrator role privilege to view sensitive information. CVE-2023-22326 Impact An authenticated...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. F5 iControl REST and TMSH have improper privilege management, and an authenticated attacker with resource administrator role...

@aaa-backend-stack/file-storage-local (>=1.16.0 <=2.4.4), @aaa-backend-stack/file-storage-s3 (>=1.16.0 <=2.4.4) +602 more potentially affected by unknown CVE via zxcvbn (>=2.0.1 <=4.4.2)

zxcvbn NPM version =2.0.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.1, =1.0.0, =0.0.9, =1.7.7, =2.0.6, =0.0.5, =2.0.10 - @abler/ats-front-resources-api =1.1.10 and more Source cves: unknown CVE Source advisory: SNYK:JS-ZXCVBN-3257741...