CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client

The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors...

XSRF Protection Disables Basic URL Rest Authorization

According to this REST page: https://developer.atlassian.com/display/BAMBOODEV/Using+the+Bamboo+REST+APIs You should be able to login to REST via a URL request by using the following scheme: "http://host:8085/rest/api/latest/plan?osauthType=basic&osusername=&ospassword=" This worked fine for us...

XSRF Protection Disables Basic URL Rest Authorization

According to this REST page: https://developer.atlassian.com/display/BAMBOODEV/Using+the+Bamboo+REST+APIs You should be able to login to REST via a URL request by using the following scheme: "http://host:8085/rest/api/latest/plan?osauthType=basic&osusername=&ospassword=" This worked fine for us...

SA-CONTRIB-2014-007 - Services - Multiple access bypass vulnerabilities

This module enables you to expose an API to third party systems using REST, XML-RPC or other protocols. The form API provides a method for developers to submit forms programmatically using the function drupalformsubmit. During programmatic form submissions, all access checks are deliberately...

ESA-2013-080: RSA Security Analytics Multiple Vulnerabilities

ESA-2013-080.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-080: RSA Security Analytics Multiple Vulnerabilities EMC Identifier: ESA-2013-080 CVE Identifier: CVE-2013-6180 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: RSA Security Analytics 10...

MongoDB 2.x REST Interface RCE Vulnerability (Nov 2012) - Active Check

MongoDB is prone to a remote code execution RCE vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

IBM Lotus Notes Sametime Room Name Bruteforce

This module bruteforces Sametime meeting room names via the IBM Lotus Notes Sametime web interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'enumerable' class MetasploitModule 'IBM Lotus Notes Sametime...

OpenStack Heat ReST API校验特权提升漏洞

Bugtraq ID:64257 CVE ID:CVE-2013-6428 OpenStack Heat类似于亚马逊的CloudFormation,它可以基于政策对可能发生的情况定义一个模板。 OpenStack Heat应用没有正确校验通过"tenantid" ReST API参数传递的租户ID，允许远程攻击者可以利用该漏洞伪造其他租户，提升权限。需要知道目标租户ID来利用该漏洞。 0 OpenStack Heat 2013.x 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.openstack.org/...

DEBIAN-CVE-2013-6428

The ReST API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenantid in the request path...

CVE-2013-6428

The ReST API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenantid in the request path...

Path traversal

The ReST API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenantid in the request path...

CVE-2013-6428

The ReST API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenantid in the request path...

CVE-2013-6428

OpenStack Heat vulnerability (CVE-2013-6428) affects the Heat REST API in OpenStack Orchestration. The issue allows an authenticated remote user to bypass tenant scoping by modifying the tenant_id in the request path, potentially enabling privilege escalation. Public vendor advisories confirm the...

[SECURITY] Fedora 19 Update: openstack-glance-2013.1.4-2.fc19

OpenStack Image Service code-named Glance provides discovery, registratio n, and delivery services for virtual disk images. The Image Service API server provides a standard REST interface for querying information about virtual d isk images stored in a variety of back-end stores, including OpenSta...

[SECURITY] Fedora 20 Update: openstack-glance-2013.2-1.fc20

OpenStack Image Service code-named Glance provides discovery, registratio n, and delivery services for virtual disk images. The Image Service API server provides a standard REST interface for querying information about virtual d isk images stored in a variety of back-end stores, including OpenSta...

Fedora 18 : ReviewBoard-1.7.16-2.fc18 / python-djblets-0.7.21-1.fc18 (2013-18911)

Review Board 1.6.19 and 1.7.15 fix a few issues in the API where users could access certain data they should not have been able to access, if using the Local Sites feature, invite-only groups, or private repositories. It also fixes cases with invite-only groups where the group name and list of...

Fedora 19 : ReviewBoard-1.7.16-2.fc19 / python-djblets-0.7.21-1.fc19 (2013-18931)

Review Board 1.6.19 and 1.7.15 fix a few issues in the API where users could access certain data they should not have been able to access, if using the Local Sites feature, invite-only groups, or private repositories. It also fixes cases with invite-only groups where the group name and list of...

Top 3 Focus Areas that can help you in Data Loss Prevention

One of the most intimidating issues that gives nightmares to IT teams across organizations is data breaches or data loss. Typically, data loss happens when security is compromised and corporate sensitive data is accessed. It might fall under any of these categories: Unauthorized, intentional or...

Top 3 Focus Areas that can help you in Data Loss Prevention

One of the most intimidating issues that gives nightmares to IT teams across organizations is data breaches or data loss. Typically, data loss happens when security is compromised and corporate sensitive data is accessed. It might fall under any of these categories: Unauthorized, intentional or...

Amun CMS 1.0.1 REST API Access Bypass

Amun CMS 1.0.1 REST API No Access Restriction Author : syst3mf4ult Homepage : http://amun-project.org Vendor : Amun CMS Version : 1.0.1 probably all versions Tested on : ubuntu 12.04 Date : 2013-10-11 ----------------------------------------------------------------------- I. POC & Exploit...