107 matches found
CVE-2024-47189
The API Interface of the AWV (Audio, Web and Video Conferencing) component in Mitel MiCollab (versions through 9.8 SP1 FP2 (9.8.1.201) ) is vulnerable to SQL injection due to insufficient sanitization of user input. An unauthenticated attacker with specific knowledge could exploit this to access ...
PT-2024-32470 · Mitel · Mitel Micollab
Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.8 SP1 FP2 9.8.1.201 Description: The issue concerns the API Interface of the AWV component, where insufficient sanitization of user input could allow an unauthenticated attacker to conduct SQL injection. This...
CVE-2024-5291
CVE-2024-5291 affects D-Link DIR-2150. The vulnerability resides in the SOAP API interface listening on TCP port 80, where insufficient validation of a user-supplied string before executing a system call allows network-adjacent attackers to achieve remote code execution in the router context (roo...
ROS-20240521-08
A vulnerability in the API interface of the Grafana web-based data representation tool is related to insecure privilege management. privilege management. Exploitation of the vulnerability could allow an attacker acting remotely, gain unauthorized access to restricted functions A vulnerability in...
CVE-2023-34282
D-Link DIR-2150 HNAP Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this...
CVE-2023-34275
D-Link DIR-2150 SetNTPServerSettings Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the...
CVE-2024-3720
A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects unknown code of the file /mfsNotice/page of the component API Interface. The manipulation of the argument gsdwid leads to sql injection. The attack can be...
CVE-2024-3720 Tianwell Fire Intelligent Command Platform API Interface page sql injection
A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects unknown code of the file /mfsNotice/page of the component API Interface. The manipulation of the argument gsdwid leads to sql injection. The attack can be...
CVE-2024-3720
The CVE-2024-3720 entry details a SQL injection in Tianwell Fire Intelligent Command Platform (version 1.1.1.1) affecting the API Interface component via the /mfsNotice/page path. The root cause is manipulation of the gsdwid parameter, enabling remote exploitation and data exposure/impact as desc...
CVE-2024-3720: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects unknown code of the file /mfsNotice/page of the component API Interface. The manipulation of the argument gsdwid leads to sql injection. The attack can be...
GHSA-85CF-GJ29-F555 1Panel Arbitrary File Download vulnerability
Summary Any file downloading vulnerability exists in 1Panel backend. Details Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. PoC payload: POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json...
CVE-2023-39965
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may caus...
Code injection
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may caus...
CVE-2023-39965 1Panel Unauthorized access in Backend
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may caus...
CVE-2023-39965 1Panel Unauthorized access in Backend
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may caus...
CVE-2023-39965: Incorrect Authorization
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may caus...
CVE-2023-36663
it-novum openITCOCKPIT aka open IT COCKPIT 4.6.4 before 4.6.5 allows SQL Injection by authenticated users via the sort parameter of the API interface...
Sql injection
it-novum openITCOCKPIT aka open IT COCKPIT 4.6.4 before 4.6.5 allows SQL Injection by authenticated users via the sort parameter of the API interface...
CVE-2023-36663
OpenITCOCKPIT (It-novum) 4.6.4 is vulnerable to SQL injection via the API interface’s sort parameter when accessed by authenticated users, due to a flaw in the input handling. Affects versions 4.6.4 prior to 4.6.5. Mitigation: upgrade to 4.6.5 or apply vendor-provided security update; as a tempor...
