663 matches found
CVE-2023-27755
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...
PT-2023-21323
Name of the Vulnerable Software and Affected Versions go-bbs version 1 Description The issue is related to an arbitrary file download vulnerability. It can be exploited via the /api/v1/download API endpoint. Recommendations For go-bbs version 1, as a temporary workaround, consider disabling the...
CVE-2023-27755: Unrestricted Upload of File with Dangerous Type
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...
CVE-2022-45180: Undefined Security Weakness
An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskDOMAIN/export endpoint. A malicious user, authenticated to the product without any specific privilege, can use the API for exporting information about all users of the system a...
CVE-2022-45173: Improper Authentication
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challenge endpoint. Because only the client-side verifies whether a check was successful, an attacker can modify the response, and fool the...
CVE-2022-45170: Use of a Broken or Risky Cryptographic Algorithm
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without knowing the key set by the user...
CVE-2022-48022
An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see...
CVE-2022-48022: Undefined Security Weakness
An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see...
PT-2023-15553
Name of the Vulnerable Software and Affected Versions Zammad version 5.3.0 Description An issue in the component "/api/v1/mentions" allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see. Recommendations For Zammad version 5.3.0,...
CVE-2022-45172: Incorrect Authorization
An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected ...
CVE-2022-3731
A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launched remotely. The identifier VDB-212413...
Sql injection
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to...
CVE-2022-3729
A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely. The associated identifier of this...
CVE-2022-3729: Improper Neutralization
A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely. The associated identifier of this...
CVE-2022-3732: Improper Neutralization
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to...
CVE-2022-3731: Improper Neutralization
A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launched remotely. The identifier VDB-212413...
CVE-2022-3730: Improper Neutralization
A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the file /api/v1/attack/falco. The manipulation of the argument Payload leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is...
CVE-2022-32229
A information disclosure vulnerability exists in Rockert.Chat v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection...