Cisco Data Center Network Manager getDeployerTaskDetails SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Data Center Network Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

keycloak: cross-realm user access auth bypass

A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks...

CVE-2019-1010250

The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator or attacker can install unintended flow rules in the switch by mistake. The component is: createFlow and createFlows functions in FlowWebResource.java RESTful service. The...

Advantech WebAccess 8.3 - SQL Injection

Advantech WebAccess 8.3 - SQL Injection !/usr/bin/python2.7 Exploit Title: Advantech WebAccess BWSCADARest Login Method SQL Injection Authentication Bypass Vulnerability Date: 01-13-2018 Exploit Author: Chris Lyne @lynerc Vendor Homepage: www.advantech.com Software Link:...

UBUNTU-CVE-2017-7557

dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack...

CVE-2017-5657

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

Cross site request forgery (csrf)

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

CVE-2016-5021

The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0...

Design/Logic Flaw

The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0...

CVE-2016-5021

The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0...

CVE-2016-5021

CVE-2016-5021 affects F5 BIG-IP/iControl REST across multiple product families (e.g., BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, PEM; Big-IP DNS; GTM; BIG-IQ variants). An authenticated administrator with access to iControl REST can cause information disclosure by crafting malici...

ESA-2013-080: RSA Security Analytics Multiple Vulnerabilities

ESA-2013-080.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-080: RSA Security Analytics Multiple Vulnerabilities EMC Identifier: ESA-2013-080 CVE Identifier: CVE-2013-6180 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: RSA Security Analytics 10...

Sybase EAServer XML External Entity (XXE) Arbitrary File Disclosure

The remote Sybase EAServer install is affected by an arbitrary file disclosure vulnerability. It is possible to view any file on the system by utilizing XML external entity injection in specially crafted XML data sent to the REST service on the remote host. Note that hosts that are affected by th...

Sql injection

SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...

CVE-2012-4949

SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...

PT-2012-5683 · Esri · Esri Arcgis

Name of the Vulnerable Software and Affected Versions: ESRI ArcGIS version 10.1 Description: The issue allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service. This can be achieved by accessing specific API endpoints, such as a...