python-podman bug fix and enhancement update

An update is available for python-podman. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The python-podman package is a library of bindings to use the RESTful A...

CVE-2022-31571

The CVE-2022-31571 entry concerns the akashtalole/python-flask-restful-api repository (GitHub) where an absolute path traversal is possible due to unsafe use of Flask send_file. This vulnerability is documented across multiple sources (NVD, Red Hat, CVE List, PRION, CNVD, etc.), with the core iss...

python-flask-restful-api 路径遍历漏洞

python-flask-restful-api is a python interface repository by the individual developer Akash Talole in India. A security vulnerability exists in python-flask-restful-api, which stems from insecure use of the Flask sendfile function...

CVE-2022-24863

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down...

Design/Logic Flaw

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down...

CVE-2022-24863 Denial of service in http-swagger

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down...

CVE-2022-24863 Denial of service in http-swagger

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down...

CVE-2022-24863

CVE-2022-24863 affects the http-swagger package (wrapper for Swagger 2.0 docs). Versions prior to 1.2.6 are vulnerable due to improper handling of HTTP methods, enabling a denial-of-service via memory exhaustion on the host. The issue is mitigated by upgrading to 1.2.6 or by restricting the path ...

GHSA-2HPG-VWQJ-6H6W Authentication bypass in Apache Kylin

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

Clash - A Rule-Based Tunnel In Go

A rule-based tunnel in Go. Features Local HTTP/HTTPS/SOCKS server with authentication support VMess, Shadowsocks, Trojan, Snell protocol support for remote connections Built-in DNS server that aims to minimize DNS pollution attack impact, supports DoH/DoT upstream and fake IP. Rules based off...

CVE-2021-32835

CVE-2021-32835 affects Eclipse Keti, a service that enforces ABAC for REST APIs. The connected records identify a Groovy Sandbox escape vulnerability in Keti, which could allow post-authentication Remote Code Execution (RCE). The issue is linked to a commit (a1c8dbe) and is discussed in GHSL-2021...

CVE-2021-32834 Arbitrary Groovy script evaluation in Eclipse Keti

Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control ABAC. In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist...

Design/Logic Flaw

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if...

Default credentials

An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW017 Camera 2.9.6 devices. A vulnerability exists in the RESTful Services API that allows a remote attacker to take full control of the camera with a...

CVE-2020-29001

The CVE-2020-29001 issue affects Geeni GNC-CW028 Camera (2.7.2), Geeni GNC-CW025 Doorbell (2.9.5), Merkury MI-CW024 Doorbell (2.9.6), and Merkury MI-CW017 Camera (2.9.6). The root cause is a static username and password embedded in the ppsapp RESTful API, enabling a remote attacker with a high-pr...

Exploit for Files or Directories Accessible to External Parties in Apache Flink

CVE-2020-17519 Apache Flink RESTful API Arbitrary File Read -...

Exploit for Path Traversal in Apache Flink

CVE-2020-17518 Apache Flink RESTful API Arbitrary File Upload...

Exposed API

kylin uses an exposed API. An unauthenticated user is able to access Kylin's configuration information due to an unprotected restful API...

CVE-2020-13937

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

CVE-2020-13937

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...