PT-2019-12300

Name of the Vulnerable Software and Affected Versions Intelbras IWR 3000N version 1.5.0 Description An issue allows remote attackers to cause a denial of service, resulting in a device reboot. This can be achieved by sending a malformed login request, specifically by misparsing the " string to th...

PT-2019-9762

Name of the Vulnerable Software and Affected Versions Stripe API v1 Description The issue allows remote attackers to bypass intended access restrictions. This is achieved by replaying XMLHttpRequest data to the API endpoint "/v1/tokens" on api.stripe.com, then parsing the response under the objec...

PT-2018-10552

Name of the Vulnerable Software and Affected Versions Splunk versions prior to 7.0.1 Description The issue allows information disclosure by appending "/api/v1/server/info/server-info?output mode=json" to a query. This can be used to discover sensitive information, such as a license key...

PT-2018-4708

Name of the Vulnerable Software and Affected Versions restafary versions prior to 1.6.1 Description The issue concerns a directory traversal vulnerability. When a root path is specified in the configuration, the vulnerability allows access beyond the intended directory. This can be exploited by...

Server side request forgery (ssrf)

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

CVE-2017-7200: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in OpenStack Glance before Newton. The 'copyfrom' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to...

CVE-2016-6270: Improper Neutralization of Special Elements used in a Command

The handlecertificate function in /vmi/manager/engine/management/commands/apnsworker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to api/v1/cfg/oauth/saveidentifypfx/...

PT-2017-8952

Name of the Vulnerable Software and Affected Versions Trend Micro Virtual Mobile Infrastructure versions prior to 5.1 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to "api/v1/cfg/oauth/save identify pfx/"...

PT-2017-3093

Name of the Vulnerable Software and Affected Versions Schneider Electric homeLYnk Controller versions prior to 1.5.0 Description The issue is related to a Command Injection vulnerability. It is associated with the failure to sanitize data at the management level, which could allow a remote attack...

CVE-2015-1775

Server-side request forgery SSRF vulnerability in the proxy endpoint api/v1/proxy in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call...

CVE-2015-1775: Undefined Security Weakness

Server-side request forgery SSRF vulnerability in the proxy endpoint api/v1/proxy in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call...

PT-2015-5439

Name of the Vulnerable Software and Affected Versions Apache Ambari versions prior to 2.1.0 Description A server-side request forgery SSRF issue exists in the proxy endpoint "api/v1/proxy" that allows remote authenticated users to conduct port scans and access unsecured services via a crafted RES...

PT-2015-6355

Name of the Vulnerable Software and Affected Versions XZERES 442SR OS version not specified Description A cross-site request forgery issue allows remote attackers to hijack admin authentication for requests, specifically those that change the default admin user, via a GET request to a vulnerable...

CVE-2015-1368: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...

PT-2015-5243

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 2.0.5 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the order by parameter to various endpoints such as "credentials/", "inventories/", "projects/...

CVE-2014-8682

Multiple SQL injection vulnerabilities in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to 1 api/v1/repos/search, which is not properly handled in models/repo.go, or 2 api/v1/users/search, which is...

CVE-2014-8683

Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...

CVE-2014-8683: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...

CVE-2014-8682: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to 1 api/v1/repos/search, which is not properly handled in models/repo.go, or 2 api/v1/users/search, which is...

PT-2014-2903

Name of the Vulnerable Software and Affected Versions The Square Squash affected versions not specified Description The issue allows remote attackers to execute arbitrary code. This can be achieved via a YAML document in two parameters: the namespace parameter to the deobfuscation function or the...