Authorization

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software...

Authentication flaw

On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints...

CVE-2021-23015

CVE-2021-23015 affects F5 BIG-IP when running in Appliance Mode. An authenticated user with the Administrator role may bypass Appliance Mode restrictions via undisclosed iControl REST endpoints. Impact is a control-plane bypass with no data-plane exposure; the vulnerability is mitigated by upgrad...

CVE-2021-23014

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software...

Sifchain: Information disclosure on Sifchain

Summary: Hello Team, I have found user/admin usernames disclosed. Using REST API, we can see all the WordPress users/authors with some of their information. such as id, name, login name, etc. and employees of Sifchain without authentication on https://sifchain.finance/ Steps To Reproduce: You can...

@instacarro/ic-model-admin (>=2.0.5 <=2.0.8), grommet-toolbox (>=0.1.3 <=0.2.12) +4 more potentially affected by CVE-2020-7605 via gulp-tape (>=0.0.10 <=1.0.0)

gulp-tape NPM version =0.0.10, =2.0.5, =0.1.3, =0.1.1, =0.1.5, =0.43.2 - sp-router-js =1.0.1 Source cves: CVE-2020-7605 Source advisory: OSV:GHSA-X67X-98X7-WV26...

WordPress BuddyPress Elevation of Privilege Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. BuddyPress has a security vulnerability prior to 5.0.0 and 7.2.1 that can be exploited by an attacke...

CVE-2021-1369

A vulnerability in the REST API of Cisco Firepower Device Manager FDM On-Box Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected device. This vulnerability is due to the improper handling of XML External Entity XXE...

CVE-2021-1369 Cisco Firepower Device Manager On-Box Software XML External Entity Vulnerability

A vulnerability in the REST API of Cisco Firepower Device Manager FDM On-Box Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected device. This vulnerability is due to the improper handling of XML External Entity XXE...

CVE-2021-1369

The CVE-2021-1369 entry concerns Cisco Firepower Device Manager (FDM) On-Box Software. The vulnerability arises from improper handling of XML External Entity (XXE) references when parsing certain XML files in the REST API, enabling an authenticated, remote attacker to read and write information s...

CVE-2021-1369 Cisco Firepower Device Manager On-Box Software XML External Entity Vulnerability

A vulnerability in the REST API of Cisco Firepower Device Manager FDM On-Box Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected device. This vulnerability is due to the improper handling of XML External Entity XXE...

CVE-2020-21990

Emmanuel MyDomoAtHome MDAH REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this, via a specially crafted request to gain access to sensitive information...

CVE-2020-21990

Emmanuel MyDomoAtHome MDAH REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this, via a specially crafted request to gain access to sensitive information...

CVE-2020-21990

Emmanuel MyDomoAtHome MDAH REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this, via a specially crafted request to gain access to sensitive information...

F5 Networks BIG-IP : BIG-IP Advanced WAF and ASM REST API vulnerability (K23203045)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4 / 15.1.3 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K23203045 advisory. - On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP...

Cisco Firepower Device Manager On-Box Software XML External Entity Vulnerability

A vulnerability in the REST API of Cisco Firepower Device Manager FDM On-Box Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected device. This vulnerability is due to the improper handling of XML External Entity XXE...

CVE-2021-31856

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint order parameter in GetMesheryPatterns in models/mesherypatternpersister.go...

CVE-2021-31856

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint order parameter in GetMesheryPatterns in models/mesherypatternpersister.go...

Sql injection

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint order parameter in GetMesheryPatterns in models/mesherypatternpersister.go...

CVE-2021-31856

Layer5 Meshery 0.5.2 contains a SQL injection in the REST API exposed via the /api/experimental/patternfile (also described as /experimental/patternfiles) endpoint. The vulnerability stems from the GetMesheryPatterns function, where the order parameter from user input is directly concatenated int...