321 matches found
PT-2024-29965 · Openhab +1 · Openhab +1
Name of the Vulnerable Software and Affected Versions: openHAB versions prior to 4.2.1 Description: The issue concerns the CometVisu add-on of openHAB, which has file system endpoints that do not require authentication. Additionally, the endpoint to update an existing file is susceptible to path...
CVE-2024-38856
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...
CVE-2024-38856 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...
CVE-2024-38856
CVE-2024-38856 is a pre-authentication remote code execution vulnerability in Apache OFBiz (affected: versions before 18.12.15). The issue arises from an Incorrect Authorization flaw where unauthenticated endpoints can render screens or run code, depending on endpoint configuration and missing ex...
CVE-2024-38856
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...
PT-2024-5362 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions through 18.12.14 Description: This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not...
PT-2024-22801
Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 1.6.16 Nautobot versions prior to 2.1.9 Description A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated users. These endpoints include "/api/graphql/",...
CVE-2023-26301
Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authentication with certain endpoints...
CVE-2023-3271
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints...
CVE-2023-35696
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...
CVE-2023-35696
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...
Information disclosure
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...
CVE-2023-35696
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...
CVE-2023-35696
CVE-2023-35696 affects the SICK ICR890-4 through unauthenticated HTTP endpoints that can disclose sensitive device information to an unauthenticated remote attacker. The vulnerability is documented across multiple sources (NVD, Red Hat, CVE list, SICK PSIRT) with CVSSv3.1 metrics indicating Netwo...
Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata
Summary Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. This vulnerabilit...
UBUNTU-CVE-2022-24829
Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api...
CVE-2021-25087
The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords fixed in 3.2.24 and files Master Keys fixed ...
Grafana信息泄露漏洞
Grafana is a set of open source monitoring tools from Grafana Labs that provides a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, etc. An information disclosure vulnerability exists in Grafana Agent versions 0.20.1 and earlier an...
