CVE-2023-47132

An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...

CVE-2023-47132

CVE-2023-47132 pertains to N-able N-central (pre-2023.6) where an API-call related flaw allows privilege escalation. Affected software: N-able N-central before 2023.6; impact is elevated privileges via API calls (no user interaction required). Mitigation: upgrade to version 2023.6 or later (per v...

CVE-2023-47132

An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...

Medium: nss-softokn

Issue Overview: It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the...

PYSEC-2024-17

pyLoad is a free and open-source Download Manager written in pure Python. The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery CSRF attac...

PT-2024-1295 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 Description: The issue is related to a cross-server request forgery CSRF attack. An attacker can trick an authenticated Argo CD user into loading a web page that contains code to ca...

CVE-2023-46308

In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty...

Insufficient Verification Of Data Authenticity

gitlab is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to there is no checking for owner or administrator privileges while creating fork relationships between existing projects contrary to the documentation using API calls...

CVE-2023-47316

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls...

CVE-2023-47316

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls...

Improper access control

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls...

CVE-2023-47316

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls...

CVE-2023-47316

Headwind MDM Web panel 5.22.1 is affected by CVE-2023-47316 due to Incorrect Access Control. The vulnerability enables access to sensitive API calls (e.g., listing users and their data, file management APIs, audit-related APIs). Connected sources corroborate the affected product and issue type bu...

CVE-2023-30131

An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls...

Command injection

An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls...

CVE-2023-30131

CVE-2023-30131 affects IXP EasyInstall 6.6.14884.0. The issue allows attackers to run arbitrary commands and escalate privileges via unauthenticated API calls, with the NVD entry noting a high-impact remote code execution potential (CVSS v3.1: 9.8). Connected sources consistently describe command...

CVE-2023-30131

An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls...

CVE-2023-30684

Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without permission...

Sql injection

The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data. We have...

Sql injection

The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the inpu...