111 matches found
Drupal-cve-2019-6340
Pesquisa CVE 2019-6340 root@kitploit: The site as Drupal 8 core RESTful API Services module gets enabled and allows the user to send GET, PATCH or POST Request to the server. GET request is enough to trigger the code execution vulnerability even though PATCH method is disabled The site has any...
xxl-job
xxl-job executor RCE por acesso não autorizado à API RESTful Usando o Console de log de execução é possível obter o resultado da execução bem-sucedida do comando: Exemplo: /joblog/logDetailPage?id=xxxx Ver variáveis de ambiente do JDK root@kitploit: String var3 = System.getProperties.toString;...
CVE-2020-13937
CVE-2020-13937 1. भेद्यता विवरण: Apache Kylin में एक RESTful API है जो बिना किसी प्रमाणीकरण के कॉन्फ़िगरेशन जानकारी को उजागर करता है। 2. पुनरुत्पादन भेद्यता के साथ तुलना बिना भेद्यता के तुलना PoC लिखना एकल URL का सत्यापन सही: pocsuite -r CVE-2022-26134.py -u url एकल URL का सत्यापन गलत: pocsuite...
hackazon
Hackazon Hackazon एक मुफ़्त, कमज़ोर परीक्षण साइट है जो एक ऑनलाइन स्टोरफ्रंट है, जो आज के रिच क्लाइंट और मोबाइल एप्लिकेशन में उपयोग की जाने वाली समान तकनीकों के साथ बनाया गया है। Hackazon में एक AJAX इंटरफ़ेस, सख्त वर्कफ़्लो और RESTful API हैं जो एक सहयोगी मोबाइल ऐप द्वारा उपयोग की जाती हैं, जो IT...
CVE-2020-17519
CVE-2020-17519 Lecture arbitraire de fichiers via l'API RESTful d'Apache Flink Apache Flink est un framework et un moteur de traitement distribué pour des calculs avec état sur des flux de données non bornés et bornés, développé en Java et Scala. Un changement introduit dans Apache Flink 1.11.0 e...
hackazon
Hackazon Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective...
BreakEscape
محرك BreakEscape لـ Rails لعبة غرفة هروب للتدريب على الأمن السيبراني كمحرك Rails قابل للتركيب. الميزات أكثر من 24 سيناريو لغرفة هروب للأمن السيبراني تتبع التقدم من جانب الخادم بمخطط جدولين كلمات مرور عشوائية لكل مثيل لعبة عبر ERB تجميع نصوص Ink في الوقت المناسب لحوار الشخصيات غير اللاعبة دعم لاعب...
syft
Syft A CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. Exceptional for vulnerability detection when used with a scanner likeGrype...
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
GO-2026-5515 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base...
CVE-2026-56248 Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy
Cap-go capgo capgo-backend before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the auditlogs table's Row-Level Security RLS policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection,...
SUSE CVE-2026-33065
Free5GC is an open-source Linux Foundation project for 5th generation 5G mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request from UDR into a 500 Internal Server Error when handling DELETE requests with an empty supi path parameter. This leak...
CVE-2025-32991
In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution...
GO-2026-4481 Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise in github.com/milvus-io/milvus
Milvus: Unauthenticated Access to Restful API on Metrics Port 9091 Leads to Critical System Compromise in github.com/milvus-io/milvus. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
CVE-2023-31585
Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php...
EUVD-2019-0308
Malware in sbrugna...