CVE-2017-9514

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on...

CVE-2017-9514: Incorrect Permission Assignment for Critical Resource

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on...

PT-2017-18982

Name of the Vulnerable Software and Affected Versions Bamboo versions prior to 6.0.5 Bamboo versions 6.1.x prior to 6.1.4 Bamboo versions 6.2.x prior to 6.2.1 Description The issue concerns a REST endpoint that parses a YAML file but does not sufficiently restrict which classes can be loaded. An...

Information Disclosure

console-common is susceptible to information disclosure. The vulnerability exists because detailed error messages reveal a REST Endpoint to the user...

CVE-2016-6068

IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties...

Denial of Service and Content Injection

Overview Versions of i18n-node-angular prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was created for development purposes, but was not disabled in production in affected versions. Recommendation Update ...

Xxe

XML external entity XXE vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint...

CVE-2014-0171

XML external entity XXE vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint...

CVE-2014-0171

XML external entity XXE vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint...

Odata4j: XML eXternal Entity (XXE) flaw

It was found that Odata4j permitted XML eXternal Entity XXE attacks. If a REST endpoint was deployed, a remote attacker could submit a request containing an external XML entity that, when resolved, allowed that attacker to read files on the application server in the context of the user running th...

Xxe

Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity XXE issue...

PT-2014-3514

Name of the Vulnerable Software and Affected Versions Teiid versions prior to 8.4.3 Teiid versions prior to 8.7 Red Hat JBoss Data Virtualization 6.0.0 before patch 3 Description The issue allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML...

Teiid: XML eXternal Entity (XXE) flaw in SQL/XML parsing

It was found that Teiid SQL/XML permitted XML eXternal Entity XXE attacks. If a REST endpoint was deployed, a remote attacker could submit a request containing an external XML entity that, when resolved, allowed that attacker to read files on the application server in the context of the user...

Inaccessible page titles leaked by Share Page API

The Share Page API exposes a REST endpoint that is available to authenticated users of Confluence. It is possible for any user to share any page simply by specifying the corresponding numeric id and the resulting notification includes the title of the shared page. In particular, a user may obtain...

Inaccessible page titles leaked by Share Page API

The Share Page API exposes a REST endpoint that is available to authenticated users of Confluence. It is possible for any user to share any page simply by specifying the corresponding numeric id and the resulting notification includes the title of the shared page. In particular, a user may obtain...

PT-2013-1228

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.6.18 Puppet versions 2.7.x prior to 2.7.21 Puppet versions 3.1.x prior to 3.1.1 Puppet Enterprise versions prior to 1.2.7 Puppet Enterprise versions 2.7.x prior to 2.7.2 Description The issue allows remote...

CVE-2013-1653: Undefined Security Weakness

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code v...