PT-2015-7205

Name of the Vulnerable Software and Affected Versions Cisco Content Delivery System Manager Software version 3.2 Description The issue allows remote attackers to obtain sensitive information via crafted URLs in REST API requests. Recommendations For Cisco Content Delivery System Manager Software...

Cisco Videoscape Distribution Suite Service Manager Information Disclosure Vulnerability

A vulnerability in the Representational State Transfer REST Application Programming Interface API that is used by Cisco Videoscape Distribution Suite Service Manager could allow an unauthenticated, remote attacker to cause an affected device to disclose sensitive information. The vulnerability is...

Rest API XSS

An unauthenticated XSS vulnerability has been confirmed in confluence 5.8.15 and 5.8.14. The vulnerability is located at /rest/prototype/1/session/check/something POC URL: http:///confpath/rest/prototype/1/session/check/something%3Cimg%20src%3da%20onerror%3dalert%280%29%3E This was confirmed in t...

CVE-2015-4929

IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request...

Cross site request forgery (csrf)

IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request...

PT-2015-6725

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions prior to 9.2.1.0 IBM Endpoint Manager for Software Use Analysis versions prior to 9.2.1.0 Description The issue allows remote authenticated users to bypass intended access restrictions and obtain sensitive...

CVE-2015-4929: Exposure of Sensitive Information to an Unauthorized Actor

IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request...

OrientDB < 2.0.15 / 2.1.1 XSRF

The version of OrientDB running on the remote host is prior to 2.0.15 or 2.1.1. It is, therefore, affected by a cross-site request forgery XSRF vulnerability due to the server allowing JSONP callbacks within the REST API. An unauthenticated, remote attacker can exploit this, via a crafted web pag...

Cisco Unified Communications Manager IM and Presence Service REST API Denial of Service Vulnerability

A vulnerability in the Representational State Transfer REST interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to cause a partial denial of service DoS condition because the Cisco Session Initiation Protocol SIP proxy...

F5 Networks BIG-IQ REST API Authentication Bypass (SOL16861)

According to its version number, the remote F5 Networks BIG-IQ device is affected by an authentication bypass vulnerability due to a flaw in the REST API. An unauthenticated, remote attacker can exploit this to obtain an authentication token for arbitrary LDAP user accounts when the device is...

CVE-2015-1844

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API...

CVE-2015-1844

CVE-2015-1844 corresponds to a Foreman/Satellite API authorization flaw: remote authenticated users could bypass organization/location restrictions via the REST API. Connected advisories (RHSA-2015:1591/1592) indicate affected Foreman components and that remediation is provided through Red Hat Sa...

CVE-2015-1844

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API...

CVE-2015-1844

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API...

WordPress WP REST API Plugin <= 1.2.2 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WP REST API (WP API) <= 1.2.2 - Cross-Site Scripting (XSS)

Requests from other origins could potentially run code on the API domain, allowing cross-origin access to authentication cookies or similar...

PT-2015-5467

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.7.5 Description The issue allows remote authenticated users to bypass organization and location restrictions. This is achieved by connecting through the REST API. Recommendations For versions prior to 1.7.5, update ...

CVE-2015-1844: Undefined Security Weakness

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API...

CVE-2015-1905

The REST API in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors...

CVE-2015-1906

Cross-site scripting XSS vulnerability in the REST API in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted U...