M-Files Security Vulnerability

M-Files is an innovative metadata-driven document management platform from M-Files, Inc. A security vulnerability exists in M-Files server versions prior to 23.11.13156.0, which stems from a security flaw in the Rest API method. An attacker could exploit this vulnerability to conduct a denial of...

CVE-2023-34341

AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure, or data tampering...

WordPress Plugin MStore API 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

SICK FTMg 授权问题漏洞

SICK FTMg is a flow sensor from SICK, Germany. A security vulnerability exists in the SICK FTMg AIR FLOW SENSOR that stems from authentication using a password hash instead of a password, allowing an unprivileged remote attacker to log in to a valid user account via the REST interface using the...

PYSEC-2023-22

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attacke...

The vulnerability of the REST application programming interface of the Atlassian Crowd data processing software allows a perpetrator to enhance their privileges.

The vulnerability of the REST application interface of the Atlassian Crowd data processing software is related to errors during the authentication process. Exploiting this vulnerability can allow attackers to increase their privileges remotely...

The vulnerability of the Juniper Networks Contrail Service Orchestration software lies in a failure of the protection mechanism in the REST API, which allows an attacker to disclose protected information.

The vulnerability of the Juniper Networks Contrail Service Orchestration software is related to a failure in the protection mechanism of the REST API. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...

GLPI 注入漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

CVE-2021-40539

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution...

CVE-2020-4495

IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute...

Moderate: Red Hat Security Advisory: RHV-M (ovirt-engine) 4.4.z security, bug fix, enhancement upd[ovirt-4.4.4] 0-day

Updated ovirt-engine packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Low: Red Hat Security Advisory: RHV-M(ovirt-engine) 4.4.z security, bug fix, enhancement update [ovirt-4.4.4]

Updated ovirt-engine packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Cisco Data Center Network Manager SQL注入漏洞

Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. A SQL injection vulnerability exists in the REST API endpoint of Cisco Data Center...

WordPress 处理逻辑错误漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Advanced Access Manager plugin versions prior to 6.6.2,...

Cisco IoT Field Network Director SQL Injection Vulnerability

Cisco IoT Field Network Director IoT-FND is an end-to-end IoT management system from Cisco USA. The system features device management, asset tracking and smart metering. Cisco IoT Field Network Director suffers from a SQL injection vulnerability that results from insufficient input validation of...

The vulnerability of the REST API implementation of the Cisco Edge Fog Fabric data processing platform allows a attacker to re-write any files in the operating system of the vulnerable device.

The vulnerability of the REST API implementation of the Cisco Edge Fog Fabric data processing platform involves exposing resources to an unauthorized area. Exploiting this vulnerability could allow a malicious actor to rewrite any files in the operating system of the vulnerable device remotely...

Red Hat Infinispan Code Execution Vulnerability

Red Hat Infinispan is a distributed caching and key-value NoSQL data storage software from Red Hat Red Hat. A security vulnerability exists in Infinispan version 10 that stems from allowing local access to the control via REST and HotRod api. An attacker could exploit the vulnerability to perform...

PT-2020-4578 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to an incorrect permissions vulnerability in the Integrations component of Magento. This could allow authenticated users with permissions to the Resource Access...

CVE-2020-3478

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system...

CVE-2019-15978

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system OS. For more information about...