CVE-2021-43679: Improper Neutralization of Special Elements used in an SQL Command

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

PT-2021-23907

Name of the Vulnerable Software and Affected Versions: ecshop version 2.7.3 Description: The issue is a SQL injection vulnerability located in the shopexecshopuploadapiclientapi.php file. This vulnerability can be exploited through the API endpoint /api/client/api.php, although the specific...

inmation-api-client (>=0.2.0, <=0.2.1), purly (>=0.2.0, <=0.2.1.dev4) potentially affected by CVE-2021-33880 via websockets (5.0.0)

websockets PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - inmation-api-client =0.2.0, =0.2.0, =0.2.1.dev4 Source cves: CVE-2021-33880 Source advisory: OSV:GHSA-8CH4-58QP-G3MP...

directory-api-client (9.15.2), simpl-modelservice (>=0.7.7, <=0.7.9) potentially affected by CVE-2021-33203 via django (1.11.11)

django PYPI version 1.11.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - directory-api-client 9.15.2 - simpl-modelservice =0.7.7, =0.7.9 Source cves: CVE-2021-33203 Source advisory: OSV:GHSA-68W8-QJQ3-2GFM...

directory-api-client (9.15.2), simpl-modelservice (>=0.7.7, <=0.7.9) potentially affected by CVE-2021-33203 via django (1.11.11)

django PYPI version 1.11.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - directory-api-client 9.15.2 - simpl-modelservice =0.7.7, =0.7.9 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

inmation-api-client (>=0.2.0, <=0.2.1), purly (>=0.2.0, <=0.2.1.dev4) potentially affected by CVE-2021-33880 via websockets (5.0.0)

websockets PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - inmation-api-client =0.2.0, =0.2.0, =0.2.1.dev4 Source cves: CVE-2021-33880 Source advisory: OSV:PYSEC-2021-95...

CVE-2021-21430

OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data...

Design/Logic Flaw

OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data...

CVE-2021-21430

OpenAPI Generator contains a vulnerability where code generated for Java/Scala performs insecure temporary file creation via File.createTempFile, risking exposure of application/data when handling binary uploads/downloads. Affected generators include Java (jersey2, okhttp-gson default) and scala-...

CVE-2021-21428

Openapi generator is a java tool which allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation...

CVE-2021-21428

CVE-2021-21428 affects the OpenAPI Generator project. The issue originates in the openapi-generator-online component, where temporary folders/files were created using File.createTempFile, allowing other users on the same system to read and potentially modify the auto-generated files. Root cause d...

Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain

Impact Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery SSRF. Resolution Validate the provided Zendesk subdomain to be a valid subdomain in: getAuthUrl getAccessToken...

CVE-2021-21429

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to...

CVE-2021-21421: Exposure of Sensitive Information to an Unauthorized Actor

node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later...

Security Bulletin: Google-api-client as used by IBM QRadar SIEM is vulnerable to authorization bypass (CVE-2020-7692)

Summary Google-api-client as used by IBM QRadar SIEM is vulnerable to authorization bypass, caused by no PKCE support implemented. Vulnerability Details CVEID: CVE-2020-7692 DESCRIPTION: Google APIs google-oauth-java-client could allow a remote attacker to bypass security restrictions, caused by ...

Information Disclosure

datadog-api-client is vulnerable to information disclosure. The vulnerability exists through the function prepareDownloadFile creating a temporary file with the permissions bits of -rw-r--r-- and the function downloadFileFromResponse method downloading sensitive files into temporary directory...

CVE-2021-21331

The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive...

GHSA-2CXF-6567-7PP6 Local Information Disclosure Vulnerability

Impact Local information disclosure of sensitive information downloaded via the API using the API Client. Finding The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed local...

Local Information Disclosure Vulnerability

Impact Local information disclosure of sensitive information downloaded via the API using the API Client. Finding The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed local...

CVE-2021-21331 DataDog API Client contains a Local Information Disclosure Vulnerability

The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive...