CVE-2024-24823: Session Fixation

Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain...

PT-2024-20590

Name of the Vulnerable Software and Affected Versions Graylog versions 2.0.0 through 5.1.10 Graylog versions 5.2.0 through 5.2.3 Description The issue allows arbitrary classes to be loaded and instantiated using a HTTP PUT request to the "/api/system/cluster config/" endpoint. Graylog's cluster...

GHSA-2P89-5F22-8QVF Exposure of Sensitive Information to an Unauthorized Actor

Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We...

CVE-2021-22029: Allocation of Resources Without Limits or Throttling

VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API denial of service due to improper rate limiting...

PT-2021-4672

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE UEM affected versions not specified Description The issue is related to a denial of service vulnerability in the VMware Workspace ONE UEM REST API, caused by improper rate limiting in the endpoint. This could allow a remot...

CVE-2021-32711

Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We...

PT-2020-15836

Name of the Vulnerable Software and Affected Versions InterMind iMind Server versions prior to 3.13.66 Description The issue allows remote unauthenticated attackers to read the self-diagnostic archive. This can be achieved via a direct request to the...

CVE-2020-24765: Direct Request

InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request...

Design/Logic Flaw

There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher privilege. The following are affected products and versions: Legion Y520TZ370 6.0.1.8642, AIO310-20IAP 6.0.1.8642, AIO510-22ISH 6.0.1.8642...

CVE-2019-10724

There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher privilege. The following are affected products and versions: Legion Y520TZ370 6.0.1.8642, AIO310-20IAP 6.0.1.8642, AIO510-22ISH 6.0.1.8642...

CVE-2018-19911: Improper Neutralization of Special Elements used in a Command

FreeSWITCH through 1.8.2, when modxmlrpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system or api/bgsystem or txtapi/bgsystem query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF...

PT-2018-15159

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.8.3 Description The issue allows remote attackers to execute arbitrary commands when mod xml rpc is enabled. This can be achieved via the api/system or txtapi/system or api/bg system or txtapi/bg system query...