api-scanner-docker

API Scanner - Despliegue Autogestionado API Scanner es una herramienta automatizada de pruebas de seguridad de APIs que escanea APIs REST y SOAP en busca de vulnerabilidades utilizando especificaciones OpenAPI/Swagger y archivos WSDL. Prerrequisitos Docker Engine 20.10+ Docker Compose v2 Python...

kyocera-cve-2022-1026

kyocera-cve-2022-1026 क्योसेरा प्रिंटर में एक अनधिकृत डेटा निष्कर्षण भेद्यता, जो क्लियरटेक्स्ट एड्रेस बुक और डोमेन से जुड़े पासवर्ड को पुनर्प्राप्त करने की अनुमति देती है। भेद्यता अवलोकन 2021 में एक पेन टेस्ट के दौरान, मैं क्योसेरा के थिक क्लाइंट एप्लिकेशन के साथ छेड़छाड़ कर रहा था जिसका उपयोग...

CVE-2020-0618_DETECTION

CVE-2020-0618 - إثبات مفهوم للكشف عن RCE في Microsoft SQL Server Reporting Services SSRS 📜 الوصف هذا إثبات مفهوم بسيط لكشف CVE-2020-0618 ، وهي ثغرة تنفيذ تعليمات برمجية عن بُعد تؤثر على Microsoft SQL Server Reporting Services SSRS. توجد الثغرة بسبب التحقق غير السليم من المسار في واجهة برمجة...

Go365

Go365 v2.0 AWS-Gateway-Probleme behoben Dank an h0useh3ad! Stirbt nicht mehr, wenn Proxy-Server-Verbindungen fehlschlagen Graph-Endpunkt hinzugefügt Bitte lies die gesamte README, bevor du Go365 verwendest! Go365 ist ein Tool, das entwickelt wurde, um User-Enumeration und Passwort-Angriffe auf...

Chamilo Command Injection

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11. up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. id: CVE-2023-34960 info: name: Chamilo Command Injection author: DhiyaneshDK severity: critical...

cve-2023-34960

cve-2023-34960 chamilo soap api rce /webservices/additionalwebservices.php...

CVE-2026-8339

The CVE-2026-8339 issue affects Coverity Connect SOAP API, with SQL injection identified in versions 2024.6.0 through 2026.3.0 (inclusive). An authenticated attacker can send a crafted payload to achieve full read access to database contents and perform other unauthorized commands. The vulnerabil...

GHSA-M7PH-9558-MRX3 MantisBT: REST API unauthorized Issue status change

A MantisBT user having $gupdatebugthreshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $gsetstatusthreshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...

CVE-2026-42071

Summary: CVE-2026-42071 affects MantisBT, specifically versions 2.23.0 through 2.28.1, where a missing authorization check in the file visibility function allows any authenticated user (REPORTER+) to download attachments from private bugnotes via REST API GET /api/rest/issues/{id}/files and SOAP ...

MantisBT has a Private Bugnote Attachment Content Leak via REST API

A missing authorization check in MantisBT's file visibility function allows any authenticated user REPORTER+ to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/id/files and SOAP API mcissueattachmentget endpoint. Impact -...

Missing Authorization

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Missing Authorization in the file visibility process. An attacker can access unauthorized file attachments by sending requests to the REST API or SOAP API endpoints. Remediation Upgrade...

GHSA-PW5X-2MF9-3XC8 MantisBT has a Private Bugnote Attachment Content Leak via REST API

A missing authorization check in MantisBT's file visibility function allows any authenticated user REPORTER+ to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/id/files and SOAP API mcissueattachmentget endpoint. Impact -...

Authentication Bypass by Primary Weakness

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the SOAP API due to improper type checking on the password parameter. An attacker can gain unauthorized access to user accounts by sending a crafted...

EUVD-2026-14516

MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL...

GHSA-PHRQ-PC6R-F6GH MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

Mantis Bug Tracker instances running on MySQL and compatible databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion...

CVE-2026-30849

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...

CVE-2026-30849 MantisBT SOAP API has an authentication bypass vulnerability on MySQL

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...

CVE-2026-30849 MantisBT SOAP API has an authentication bypass vulnerability on MySQL

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...

CVE-2026-30849

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...

CVE-2026-30849

The CVE affects MantisBT (open source issue tracker) prior to version 2.28.1 when run on MySQL databases. It enables an authentication bypass via the SOAP API due to improper type checking on the password parameter, allowing an attacker who knows a victim’s username to log in without the password...