Epam Systems Report Portal 代码问题漏洞

Epam Systems Report Portal is a suite of open source automated testing tools from Epam Systems, Inc. that support capturing, summarizing, and analyzing test results and reports. service-api is one of the APIs Application Programming Interfaces. A security vulnerability exists in Report Portal...

CVE-2020-25634

A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected...

ceph: specially crafted XML payload on POST requests leads to DoS by crashing RGW

A flaw was found in the Ceph Object Gateway S3 API, where it did not properly validate the POST requests. This flaw allows an attacker to perform a denial of service attack using a malicious POST request with specially crafted XML payload, leading to a crash of the RGW process...

CVE-2020-26879

Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validatetoken.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header...

UBUNTU-CVE-2020-12692

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...

CVE-2020-12642

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import...

CVE-2020-12642

A vulnerability (CVE-2020-12642) affects Report Portal’s service-api prior to 4.3.12 and 5.x prior to 5.1.1. The issue is an XML External Entity (XXE) vulnerability in the JUnit XML launch import feature, enabling secrets disclosure and server-side request forgery (SSRF). Impact details are that ...

NewStart CGSL CORE 5.05 / MAIN 5.05 : samba Vulnerability (NS-SA-2019-0244)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has samba packages installed that are affected by a vulnerability: - A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to crea...

Amazon Linux AMI : samba (ALAS-2019-1329)

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. CVE-2019-388...

Amazon Linux 2 : samba (ALAS-2019-1351)

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share.CVE-2019-3880...

EulerOS 2.0 SP3 : samba (EulerOS-SA-2019-2018)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS...

CVE-2019-2742

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Whil...

CVE-2019-2742

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Whil...

Design/Logic Flaw

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Whil...

CVE-2019-11119

Insufficient session validation in the service API for IntelR RWC3 version 4.186 and before may allow an unauthenticated user to potentially enable escalation of privilege via network access...

PT-2019-2395 · Intel · Intel Raid Web Console 3

Name of the Vulnerable Software and Affected Versions: Intel RAID Web Console 3 RWC3 versions 4.186 and before Description: The issue is related to insufficient session validation in the service API, which may allow an unauthenticated user to potentially enable escalation of privilege via network...

CVE-2019-3880

CVE-2019-3880 affects Samba where an RPC endpoint emulating Windows registry API can be abused by an unprivileged user to save a registry hive file outside the share, potentially creating a new file in the Samba share. Affected versions are pre-4.8.11, pre-4.9.6 and pre-4.10.2. Red Hat/CentOS and...

CVE-2018-19358

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

GNOME Keyring Information Disclosure Vulnerability

GNOME Keyring is a software application that stores security credentials such as usernames, passwords and keys, and a small amount of related metadata. An information disclosure vulnerability exists in GNOME Keyring 3.28.2 and earlier versions, which stems from the program's failure to use the...

CVE-2018-19358

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...