412 matches found
PT-2023-15553
Name of the Vulnerable Software and Affected Versions Zammad version 5.3.0 Description An issue in the component "/api/v1/mentions" allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see. Recommendations For Zammad version 5.3.0,...
CVE-2022-48022: Undefined Security Weakness
An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see...
CVE-2022-45172: Incorrect Authorization
An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected ...
CVE-2022-3731
A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launched remotely. The identifier VDB-212413...
Sql injection
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to...
CVE-2022-3731: Improper Neutralization
A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launched remotely. The identifier VDB-212413...
CVE-2022-3732: Improper Neutralization
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to...
CVE-2022-3729: Improper Neutralization
A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely. The associated identifier of this...
CVE-2022-3730: Improper Neutralization
A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the file /api/v1/attack/falco. The manipulation of the argument Payload leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is...
CVE-2022-36304: Improper Neutralization of Input During Web Page Generation
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the generateresponse function at /web/api/v1/upload/UploadHandler.php...
CVE-2022-34025: Improper Neutralization of Input During Web Page Generation
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...
PT-2022-23299
Name of the Vulnerable Software and Affected Versions Vesta versions 1.0.0 through 1.0.5 Description A cross-site scripting XSS issue was found in Vesta via the generate response function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation...
PT-2022-23298
Name of the Vulnerable Software and Affected Versions Vesta versions 1.0.0 through 1.0.5 Description A cross-site scripting XSS issue was found in the handle file upload function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation. No information is...
PT-2022-3648
Name of the Vulnerable Software and Affected Versions FortiDeceptor versions 1.0.0 through 4.0.1 Description The issue is related to relative path traversal errors in the management interface, allowing a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying...
PT-2022-3282
Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.8 Description The issue is related to the incorrect use of privileged APIs in the PingID multi-factor authentication MFA software for Windows. This could allow an attacker to elevate their privileges...
MAL-2022-3147 Malicious code in free-fortnite-skins-api-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84adc7f3e89bcdaf2440857943395002466913468cf0aed35f78e5879eaf84d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2021-27561: Improper Neutralization of Special Elements used in an OS Command
Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication...
CVE-2021-38095: Undefined Security Weakness
The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request...
