CVE-2023-23445: Improper Access Control

Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the REST interface...

CVE-2023-23449: Observable Response Discrepancy

Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usernames by analyzing challenge responses from the server via the REST interface...

CVE-2023-23447: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to influence the availability of the webserver by invocing several open file requests via the REST interface...

CVE-2023-23450: Use of Password Hash Instead of Password for Authentication

Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to use a password hash instead of an actual password to login to a valid user account via...

CVE-2023-23446: Improper Access Control

Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface...

PT-2023-18954 · Sick · Sick Ftmg Air Flow Sensor

Name of the Vulnerable Software and Affected Versions: SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 Description: The issue is related to improper access control, allowing an unprivileged remote attacker to gain unauthorized access to dat...

PT-2023-18955 · Sick · Sick Ftmg Air Flow Sensor

Name of the Vulnerable Software and Affected Versions: SICK FTMg AIR FLOW SENSOR versions with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 Description: The issue allows an unprivileged remote attacker to download files by using an unprivileged account via the "REST...

PT-2023-18960

Name of the Vulnerable Software and Affected Versions SICK FTMg AIR FLOW SENSOR versions affected versions not specified Description The issue allows an unprivileged remote attacker to use a password hash instead of an actual password to login to a valid user account via the REST interface...

Important: Red Hat Security Advisory: Synopsis: Red Hat OpenStack Platform (openstack-glance) security update

An update for openstack-glance is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect

A flaw was found in Apache Kafka Connect's REST API that permits configuration of SASL property by an authenticated operator, which could allow connection to a malicious LDAP server and subsequent deserialization of malicious content. This issue could allow an authenticated attacker to cause a...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-glance) security update

An update for openstack-glance is now available for Red Hat OpenStack Platform 17.0 Wallaby. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

UBUNTU-CVE-2022-48318

No authorisation controls in the RestAPI documentation for Tribe29's Checkmk = 2.1.0p13 and Checkmk = 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation...

SUSE CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

CVE-2021-36225

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

CVE-2022-42290

NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering...

CVE-2022-41617

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface...

CVE-2022-41617: Improper Neutralization of Special Elements used in a Command

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface...

The vulnerability of the REST API interface of the Apache Geode data management platform allows a hacker to execute arbitrary code.

The vulnerability of the REST API interface of the Apache Geode data management platform involves the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Apache Geode 代码问题漏洞

Apache Geode is the Apache Foundation's suite of management platforms for providing real-time and consistent access to data for data-intensive applications in distributed cloud architectures. A security vulnerability exists in Apache Geode versions prior to 1.15.0 that stems from the vulnerabilit...

CVE-2021-46687

JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versio...