165 matches found
KB API Authentication Bypass on Sentry Administrator Interface - CVE-2023-38035
A vulnerability has been discovered in Ivanti Sentry, formerly MobileIron Sentry. This vulnerability impacts all supported versions – 9.18, 9.17, and 9.16. Older versions/releases are also at risk. This vulnerability does not affect other Ivanti products or solutions, such as Ivanti EPMM,...
CVE-2023-38035 – API Authentication Bypass on Sentry Administrator Interface
A vulnerability has been discovered in Ivanti Sentry, formerly known as MobileIron Sentry. This vulnerability impacts versions 9.18 and prior. The vulnerability does not impact other Ivanti products, such as Ivanti EPMM or Ivanti Neurons for MDM. If exploited, this vulnerability enables an...
CVE-2023-31411
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App...
CVE-2023-31411
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App...
CVE-2023-31411
CVE-2023-31411 affects the SICK EventCam App. The root cause is lack of API authentication, enabling a remote unprivileged attacker to modify and access configuration settings, potentially impacting confidentiality, integrity, and availability. Public sources consistently describe the issue and i...
CVE-2023-31411
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App...
PT-2023-23305 · Unknown · Eventcam App
Name of the Vulnerable Software and Affected Versions: EventCam App affected versions not specified Description: A remote unprivileged attacker can modify and access configuration settings due to the absence of API authentication in the EventCam App. This lack of authentication allows the attacke...
CVE-2023-33236
MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs...
Hardcoded credentials
MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs...
CVE-2023-33236
CVE-2023-33236 affects Moxa MXsecurity Series software v1.0, where a vulnerability involving hard-coded credentials could be exploited to craft arbitrary JWT tokens and bypass authentication for web-based APIs. The issue enables remote exploitation with low attack complexity and no user interacti...
GHSA-J5FJ-RFH6-QJ85 Planet's secret file is created with excessive permissions
Impact The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but its permissions allowed the user's group and non-group to read the file as well. Validation Check the permissions on the secret file with ls -l /.planet.json and ensure th...
PT-2023-23714 · Planet · Planet
Name of the Vulnerable Software and Affected Versions: Planet versions prior to 2.0.1 Description: The issue concerns the permissions of a secret file that stores the user's Planet API authentication information. This file should only be accessible by the user, but due to incorrect permissions, i...
CVE-2023-30394
The MoveIt framework 1.1.11 for ROS allows cross-site scripting XSS via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."...
Cross site scripting
Progress Ipswitch MoveIT 1.1.11 was discovered to contain a cross-site scripting XSS vulenrability via the API authentication function...
PT-2023-22669 · Unknown · Moveit Framework
Name of the Vulnerable Software and Affected Versions: MoveIt framework version 1.1.11 Description: The issue concerns a cross-site scripting XSS flaw via the API authentication function. This allows for potential malicious script execution. No information is provided about the estimated number o...
CVE-2023-30394
The MoveIt framework 1.1.11 for ROS allows cross-site scripting XSS via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."...
CVE-2023-30394
The MoveIt framework 1.1.11 for ROS allows cross-site scripting XSS via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."...
SUSE CVE-2023-22644
A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...
U.S. Dept Of Defense: [U.S. Air Force] Information disclosure due unauthenticated access to APIs and system browser functions
Multiple information exposure vulnerabilities were found in a Jira Server instance, allowing unauthenticated attackers to access APIs and system browser functions, leading to unauthorized access to sensitive data. The vulnerability was registered as CVE-2020-14179...