CVE-2014-8682: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to 1 api/v1/repos/search, which is not properly handled in models/repo.go, or 2 api/v1/users/search, which is...

PT-2014-2903

Name of the Vulnerable Software and Affected Versions The Square Squash affected versions not specified Description The issue allows remote attackers to execute arbitrary code. This can be achieved via a YAML document in two parameters: the namespace parameter to the deobfuscation function or the...

PT-2014-2430

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.1 Description The issue allows remote authenticated users to gain privileges. This can be achieved via a XMLHttpRequest or an AJAX request, such as '/api/v1/requests'. The username and password variables may be...

PT-2014-2483

Name of the Vulnerable Software and Affected Versions MayGion IP Cameras versions prior to 2013.04.22 05.53 Description The issue allows remote attackers to execute arbitrary code via a long filename in a GET request to a vulnerable API endpoint, such as "/api/v1/download" or similar, by exploiti...

PT-2013-4746

Name of the Vulnerable Software and Affected Versions SavySoda WiFi HD Free versions prior to 7.0 Description A directory traversal issue allows remote attackers to read arbitrary files by including a ..%2f encoded dot dot slash in a GET request to specific API endpoints, such as "/api/v1/files"...

PT-2013-4745

Name of the Vulnerable Software and Affected Versions Gummy Bear Studios FTP Drive + HTTP Server versions 1.0.4 and earlier Description A directory traversal issue allows remote attackers to read arbitrary files by including a ..%2f encoded dot dot slash in a GET request to the "/api/v1/files" AP...