1375 matches found
PT-2022-14929
Name of the Vulnerable Software and Affected Versions Mimosa MMP versions prior to v1.0.3 PTP C-series versions prior to v2.8.6.1 PTMP C-series and A5x versions prior to v2.5.4.1 Description This issue could allow an attacker to force the server to create and execute a web request, granting acces...
CVE-2022-21215: Server-Side Request Forgery (SSRF)
This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing...
The vulnerability of the software component responsible for creating, monitoring, and orchestrating data processing scripts in Airflow allows attackers to circumvent existing access restrictions and execute API requests without authentication.
The vulnerability of the software component responsible for creating, monitoring, and orchestrating data processing scripts in Airflow is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and execut...
GHSA-F4CJ-3Q3H-884R Partial authorization bypass on document save in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with SCRIPT right EDIT right before XWiki 7.4 can save a document with the right of the current user which allow accessing API requiring programming right if the current user has...
Partial authorization bypass on document save in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with SCRIPT right EDIT right before XWiki 7.4 can save a document with the right of the current user which allow accessing API requiring programming right if the current user has...
Design/Logic Flaw
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming...
CVE-2022-23615 Partial authorization bypass on document save in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming...
PT-2022-4092 · Siemens · Simatic Pcs 7 +1
Name of the Vulnerable Software and Affected Versions: SIMATIC PCS 7 versions V8.2 through V9.1 SIMATIC PCS 7 version V9.1 prior to V9.1 SP1 SIMATIC WinCC versions V7.4 through V7.4 prior to V7.4 SP1 Update 19 SIMATIC WinCC versions V7.5 through V7.5 prior to V7.5 SP2 Update 6 SIMATIC WinCC...
CVE-2022-23615: Incorrect Authorization
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming...
PT-2022-6562
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.5.2 Description The issue is related to a Cross Site Request Forgery CSRF vulnerability in the Gitea Git repository management system interface. This vulnerability can be exploited by a remote attacker to perform a CS...
PT-2022-9593 · WordPress · All In One Seo
Name of the Vulnerable Software and Affected Versions: All in One SEO WordPress plugin versions prior to 4.1.5.3 Description: The issue allows bad actors to access protected REST API endpoints, potentially enabling users with low-privileged accounts to perform remote code execution on affected...
SEGA’s Sloppy Security Confession: Exposed AWS S3 Bucket Offers Up Steam API Access & More
Gaming giant SEGA Europe recently discovered that its sensitive data was being stored in an unsecured Amazon Web Services AWS S3 bucket during a cloud-security audit, and it’s sharing the story to inspire other organizations to double-check their own systems. Researcher Aaron Phillips with VPN...
CVE-2021-41090
Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defin...
CVE-2021-38147
Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...
Design/Logic Flaw
Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...
NodeBB 授权问题漏洞
NodeBB is a forum system built by the Design Create Play team using Node.js, a web application platform built on top of Google's V8 JavaScript engine. an authorization issue vulnerability exists in Nodebb, which stems from a faulty token authentication logic in the product, and could be exploited...
Dell Networking OS10 Elevation of Privilege Vulnerability
Dell Networking OS10 is a Linux-based network switch operating system from Dell DELL U.S.A. An elevation of privilege vulnerability exists in Dell Networking OS10, which could be exploited by an attacker with specific API access to gain administrator privileges on the affected system...
Improper Access Control in bookstackapp/bookstack
Description A user with API access can view any attachment which they do not have read access to because read permissions are not being checked at the API attachments read controller. Proof of Concept 1: From default installation give the "Public" role access to system API 2: Upload attachment...
CVE-2021-43563
An issue was discovered in the pixxio aka pixx.io integration or DAM extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to...
