CVE-2024-55585

In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword...

PT-2025-24348 · Mops App +1 · Mops App +1

Name of the Vulnerable Software and Affected Versions: moPS App versions 1.8.618 and earlier moPS App Engine version 1.8.618 Description: The issue allows all users to access administrative API endpoints, such as "/api/admin", without requiring additional authentication. This results in...

CVE-2024-55585: Missing Authentication for Critical Function

In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword...

Inproper Authorization

Ant Media Server Community Edition is vulnerable to Improper Authorization. The vulnerability is due to improper HTTP header based authorization which allows unauthorized users to potentially access non-administrative API calls reserved for authorized users...

CVE-2024-3462

Ant Media Server Community Edition is vulnerable to an improper HTTP header-based authorization in its default configuration. This flaw allows unauthorized users to potentially access non-administrative API calls that are reserved exclusively for authorized users. The vulnerability affects versio...

CVE-2024-3462 Authorization bypass in Ant Media Server

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

CVE-2023-49231

An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token...

CVE-2023-49231

An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token...

CVE-2023-49231

An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token...

CVE-2023-49231

An authentication bypass vulnerability exists in Stilog Visual Planning 8 (all versions prior to Build 240207 ) by STILOG I.S.T. The root cause is a wildcard injection within a prepared SQL statement on an undocumented REST API route. By exploiting the combination of user-controlled input and the...

CVE-2023-49231: Authentication Bypass by Capture-replay

An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token...

Exploit for CVE-2023-31711

CVE-2023-31711 Incorrect Access Control in ZKTECO allows...

OpenStack Keystone Allows Remote User Account Creation

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex 2012.1, allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly...

CVE-2021-4133

Keycloak vulnerability CVE-2021-4133 affects versions 12.0.0 up to, but not including, 15.1.1. An attacker with an existing user account can create new default user accounts via the administrative REST API even when new user registration is disabled, due to improper authorization validation in th...

PT-2020-16976

Name of the Vulnerable Software and Affected Versions Barco wePresent WiPG-1600W versions 2.4.1.19, 2.5.0.24, 2.5.0.25, 2.5.1.8 Description The firmware of the Barco wePresent WiPG-1600W includes a hardcoded API account and password that can be discovered by inspecting the firmware image. This...

CVE-2019-12182

Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API...

Directory traversal

Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API...

CVE-2019-12182

Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API...

CVE-2019-12182

CVE-2019-12182 describes a Directory Traversal vulnerability in Safescan Timemoto and TA-8000 series (version 1.0) that allows unauthenticated remote code execution via the administrative API. Affected product family is Safescan Timemoto/TA-8000, with identifiers appearing across NVD, Red Hat, CN...

CVE-2019-12182: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API...