Authentication Bypass

quarkus is vulnerable to authentication bypass. The vulnerability allows unauthorized users to bypass authentication and gain access to REST end points to perform unauthorized actions...

CVE-2019-6637

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

CVE-2019-6637

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

Code injection

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

CVE-2019-6637

CVE-2019-6637 affects BIG-IP ASM: exploitation of REST endpoints by an authenticated user (role: Guest or higher) can trigger excessive memory consumption, causing the Linux kernel OOM killer and potential DoS. Affected: BIG-IP ASM versions 12.1.0–12.1.4, 13.0.0–13.1.1.4, 14.0.0–14.0.0.4, 14.1.0–...

PT-2019-18219

Name of the Vulnerable Software and Affected Versions BIG-IP ASM versions 12.1.0 through 12.1.4 BIG-IP ASM versions 13.0.0 through 13.1.1.4 BIG-IP ASM versions 14.0.0 through 14.0.0.4 BIG-IP ASM versions 14.1.0 through 14.1.0.5 Description The issue is related to the abuse of Application Security...

CVE-2019-6637: Undefined Security Weakness

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

DRUPAL-CORE-2019-003

Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services rest module enabled and allows GET, PAT...

Code injection

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119...

CVE-2016-0373

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119...

CVE-2016-0373: Improper Authorization

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119...

PT-2018-4623

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 6.0 through 6.2.2.1 Description The issue allows an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. Recommendations For...

Cross site request forgery (csrf)

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery CSRF vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flas...

CVE-2018-1000206

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery CSRF vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flas...

CVE-2018-1000206: Cross-Site Request Forgery (CSRF)

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery CSRF vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flas...

PT-2018-9374

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions 5.11 through 6.0 Description The issue is related to a Cross-site Request Forgery CSRF vulnerability in UI rest endpoints. This can lead to a Classic CSRF attack, allowing an attacker to perform actions as a logged-i...

Security Bulletin: API and CLI getResource expose secured role properties (CVE-2016-6068)

Summary IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties. Vulnerability Details CVEID: CVE-2016-6068 DESCRIPTION: IBM UrbanCode Deploy could allow an authenticated user with access to the REST...

Security Bulletin: REST endpoints do not properly authorize, allowing users to modify data with insufficient permissions (CVE-2016-0320)

Summary IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects. This could affect the behavior of legitimately triggered processes. Vulnerability Details CVEID: CVE-2016-0320 DESCRIPTION: IBM...

Security Bulletin: Multiple UCD REST endpoints allow unauthorized users to view data (CVE-2016-0373)

Summary IBM UrbanCode Deploy could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. Vulnerability Details CVEID: CVE-2016-0373 DESCRIPTION: IBM UrbanCode Deploy could allow an authenticated user ...

i18n-node-angular Multiple Vulnerabilities

i18n-node-angular is a tool that supports the use of i18n nodes in AngularJS applications. A denial of service and content injection vulnerability exists in REST endpoints in versions prior to i18n-node-angular 1.4.0. An attacker can exploit this vulnerability to cause a denial of service or...