CVE-2018-1000823

exist version = 5.0.0-RC4 contains a XML External Entity XXE vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning...

CVE-2018-1000823

Affected software: exist-db (XML Parser for REST Server)

CVE-2018-1000823: Improper Restriction of XML External Entity Reference

exist version = 5.0.0-RC4 contains a XML External Entity XXE vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning...

PT-2018-9547

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 5.0.0-RC4 Description The issue is related to a XML External Entity XXE vulnerability in the XML Parser for the REST Server. This can lead to the disclosure of confidential data, denial of service, Server-Side Reque...

Universally Unique IDentifier - Moderately critical - Arbitrary file upload - SA-CONTRIB-2018-045

This module provides an API for adding universally unique identifiers UUID to Drupal objects, most notably entities. The module module has an arbitrary file upload vulnerability when it's used in combination with the services REST server. This vulnerability is mitigated by the fact that an attack...

CVE-2017-16208

dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

Directory traversal

dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16208

dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16208

dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16208

Affected software: dmmcquay.lab6 (REST server). Vulnerability: Directory traversal via crafted URLs (e.g., using ../) allows access to files outside the intended directory. Impact (as documented): Potential disclosure of private files on the vulnerable system. Evidence from connected docs: GHSA a...

CVE-2016-8629: Improper Access Control

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

eu.seaclouds-project:seaclouds-qa (1.0.0), io.brooklyn.ambari:brooklyn-ambari (>=0.2.0, <=0.5.0-20160803.1156) +19 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-rest-server (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-rest-server MAVEN version =0.7.0-incubating, =0.2.0, =0.2.0, =0.3.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.9.0 and more Source cves: CVE-2016-8737 Source advisory:...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

Cross site request forgery (csrf)

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery CSRF, which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is...

CVE-2016-8737

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery CSRF, which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is...

CVE-2016-8737

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery CSRF, which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is...

Cross site scripting

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to ...

CVE-2017-3165

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to ...

CVE-2017-3165

CVE-2017-3165 affects Apache Brooklyn before 0.10.0. The REST server is vulnerable to cross-site scripting due to improper escaping of server-side content, allowing an authenticated user to inject scripts that run in other authorized users’ browsers. PoC exploitation is noted. Public sources (inc...