156 matches found
Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulner...
CVE-2024-24554
Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API...
CVE-2024-0681
The Page Restriction WordPress WP – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.3.4. This is due to the plugin not properly restricting access to pages via the REST API when a page has been made private. This makes it...
CVE-2023-41314 Apache Doris: Missing API authentication allowed DoS
The api /api/snapshot and /api/getlogfile would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues...
CVE-2023-41314 Apache Doris: Missing API authentication allowed DoS
The api /api/snapshot and /api/getlogfile would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues...
CVE-2023-6595
CVE-2023-6595 affects Progress WhatsUp Gold versions released before 2023.1. The issue is an API endpoint that lacks authentication, allowing an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold. Red Hat and Nessus/NASL reports corroborate the core ...
Cisco Unified Communications Manager DoS (cisco-sa-cucm-apidos-PGsDcdNF)
According to its self-reported version, Cisco Unified Communications Manager running on the remote host is affected by a denial of service DoS vulnerability. Due to improper API authentication and incomplete verification of the API request, an unauthenticated, remote attacker can send a specially...
Cisco Unified Communications Manager IM & Presence DoS (cisco-sa-cucm-apidos-PGsDcdNF)
According to its self-reported version, Cisco Unified Communications Manager IM & Presence running on the remote host is affected by a denial of service DoS vulnerability. Due to improper API authentication and incomplete verification of the API request, an unauthenticated, remote attacker can se...
CVE-2023-43652 Non-MFA account takeover via using only SSH public key to login in jumpserver
JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used ...
CVE-2023-5183 Authenticated RCE due to unsafe JSON deserialization
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the networktraffic API endpoint. An attacker can leverage this vulnerability to execute...
Nagios XI < 5.9.3 Multiple Vulnerabilities
According to the self-reported version of Nagios XI, the remote host is affected by multiple vulnerabilities, including the following: - The session ID for API Authentication is generated using uniqid, which is based on the current time. An attacker can brute-force a valid session ID by guessing...
KB API Authentication Bypass on Sentry Administrator Interface - CVE-2023-38035
A vulnerability has been discovered in Ivanti Sentry, formerly MobileIron Sentry. This vulnerability impacts all supported versions – 9.18, 9.17, and 9.16. Older versions/releases are also at risk. This vulnerability does not affect other Ivanti products or solutions, such as Ivanti EPMM,...
CVE-2023-38035 – API Authentication Bypass on Sentry Administrator Interface
A vulnerability has been discovered in Ivanti Sentry, formerly known as MobileIron Sentry. This vulnerability impacts versions 9.18 and prior. The vulnerability does not impact other Ivanti products, such as Ivanti EPMM or Ivanti Neurons for MDM. If exploited, this vulnerability enables an...
CVE-2023-31411
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App...
CVE-2023-31411
CVE-2023-31411 affects the SICK EventCam App. The root cause is lack of API authentication, enabling a remote unprivileged attacker to modify and access configuration settings, potentially impacting confidentiality, integrity, and availability. Public sources consistently describe the issue and i...
CVE-2023-31411
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App...
CVE-2023-31411
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App...
PT-2023-23305 · Unknown · Eventcam App
Name of the Vulnerable Software and Affected Versions: EventCam App affected versions not specified Description: A remote unprivileged attacker can modify and access configuration settings due to the absence of API authentication in the EventCam App. This lack of authentication allows the attacke...
CVE-2023-33236
MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs...
Hardcoded credentials
MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs...