CVE-2020-26033

An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...

Design/Logic Flaw

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

Cross site request forgery (csrf)

An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...

CVE-2020-26033

CVE-2020-26033 affects Zammad prior to version 3.4.1, where the Tag and Link REST API endpoints (add and delete) do not perform CSRF token validation. Connected sources corroborate a CSRF vulnerability in the labeling/linking REST paths, with broader references noting fixes in newer releases (e.g...

CVE-2020-26033

An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...

CVE-2020-29160

CVE-2020-29160 affects Zammad before 3.5.1. A REST API call can modify Ticket Article data and defeat auditing via an access-control flaw, with no authentication required in CVSS terms. Impact is integrity loss (high) and auditing bypass. Remediation stated across sources is to upgrade to Zammad ...

CVE-2020-29160

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

ledger-rest-api-dev (>=0.1.9 <=0.1.10) potentially affected by CVE-2020-11093 via indy-node (=1.0.28)

indy-node PYPI version =1.0.28 is affected by a known vulnerability. The following packages have a transitive dependency on indy-node and may be impacted: - ledger-rest-api-dev =0.1.9, =0.1.10 Source cves: CVE-2020-11093 Source advisory: OSV:PYSEC-2020-48...

CVE-2020-27727

On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem...

The vulnerability of the REST API implementation of the network management system’s data center management module allows a attacker to re-record any files on the device.

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system is related to errors in processing input data. Exploiting this vulnerability allows an attacker to re-record any files on the device remotely...

PYSEC-2020-50

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

CVE-2020-26275

The CVE-2020-26275 entry concerns Jupyter Server before version 1.1.1, where an open redirect vulnerability could cause the server to redirect a user’s browser to a malicious site. Affected instances include servers running without a base_url prefix; while the broad condition is noted, practical ...

Privilege Escalation

keycloak is vulnerable to privilege escalation. The Account REST API can update user metadata attributes...

Bilanc Shpk Programi Bilanc build Encryption Issues Vulnerabilities

Bilanc Shpk Programi Bilanc is a software for generating balance sheets from Bilanc Shpk, Alphania. An encryption issue vulnerability exists in Programi Bilanc build 007 release 014 31.01.2020 and below. The vulnerability stems from the fact that it relies on encryption with weak, breakable...

F5 BIG-IP Information Disclosure Vulnerability (CNVD-2020-74865)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP, which can be exploited by an attacker who can read files via F5...

F5 BIG-IP 输入验证错误漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP, which can be exploited by an attacker who can read files via F5...

F5 Networks BIG-IP : iAppsLX REST vulnerability (K50343630)

When an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem.CVE-2020-27727 Impact An attacker can exploit this vulnerability as an authenticated administrativ...

Freki - Malware Analysis Platform

Freki is a free and open-source malware analysis platform. Goals 1. Facilitate malware analysis and reverse engineering; 2. Provide an easy-to-use REST API for different projects; 3. Easy deployment via Docker; 4. Allow the addition of new features by the community. Current features Hash...

Information Disclosure

gitlab is vulnerable to information disclosure. The vulnerability is possible via the REST API via the GraphQL...

CVE-2020-27147

The REST API component of TIBCO Software Inc.'s TIBCO PartnerExpress contains a vulnerability that theoretically allows an unauthenticated attacker with network access to obtain an authenticated login URL for the affected system via a REST API. Affected releases are TIBCO Software Inc.'s TIBCO...