Improper Access Control

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository acces...

Mobile device monitoring services do not authenticate API requests

Overview The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability. These services and their associated apps can be used to perform non-consensual,...

CVE-2021-34774

The CVE-2021-34774 entry concerns Cisco Common Services Platform Collector (CSPC) Web Management interface. Affected: CSPC Web UI. Vulnerable component: API response handling that fails to sufficiently protect sensitive data. Root cause: information disclosure when responding to a crafted HTTP re...

Improper access control

A vulnerability in the API endpoints for Cisco DNA Center could allow an authenticated, remote attacker to gain access to sensitive information that should be restricted. The attacker must have valid device credentials. This vulnerability is due to improper access controls on API endpoints. An...

Cisco Connected Mobile Experiences Password Change Bypass

The vulnerability of the Cisco Connected Mobile Experiences CMX password change interface is related to deficiencies in the management of registration data. Exploiting this vulnerability could allow a malicious actor to bypass security measures through a specially created API request...

CVE-2021-39169

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...

CVE-2021-39169

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...

Cross site scripting

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...

CVE-2021-39169

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...

PT-2021-22426

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 12.51.0 Description Misskey is a decentralized microblogging platform. In versions prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripti...

CVE-2021-39169: Improper Neutralization of Input During Web Page Generation

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...

CVE-2021-1579

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system...

CVE-2021-1579: Execution with Unnecessary Privileges

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system...

Vulnerability fixed in Dell EMC NetWorker

A vulnerability has been fixed in Dell EMC NetWorker. A authenticated malicious party could potentially exploit it to cause a Denial-of-Service through a rogue API request. Dell EMC has released updates to fix the vulnerability. For more information, see:...

CVE-2021-34707

A vulnerability in the REST API of Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when responding to an API...

PT-2021-3743

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.5.9 Rancher versions prior to 2.4.16 Description A vulnerability in Rancher allows users in the cluster to act as other users by forging the Impersonate-User or Impersonate-Group headers. This issue is related to...

Cisco Advanced Malware Protection 信任管理问题漏洞

Cisco Advanced Malware Protection AMP for Endpoints for Windows is a Windows-based endpoint security solution from Cisco. The product mainly features advanced threat prevention, monitoring and response. Cisco Advanced Malware Protection has a security vulnerability that allows an unauthenticated,...

Improper Privilege Management in cortezaproject/corteza-server

💥 BUG unprivileged user can dismiss other user reminders 💥 IMPACT lower level user can dismiss other user reminders 💥 STEP TO REPRODUCE 1. First from admin goto http://localhost:18080/admin/system/user and add a new user called user B .\ Now give this user crm permission so that user B can create...

CVE-2021-29460

Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that link in a browser where they are logged in to Kirby...

CVE-2021-1385

A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated, remote attacker to conduct directory traversal attacks and read and write files on the underlying operating system or host system. This vulnerability occurs because the devic...