CVE-2022-3798: Improper Neutralization

A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-2126...

CVE-2022-3798

A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-2126...

CVE-2022-3802

A vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public a...

PT-2022-24168

Name of the Vulnerable Software and Affected Versions IBAX go-ibax affected versions not specified Description A critical vulnerability has been found in IBAX go-ibax, affecting an unknown function of the file "/api/v2/open/tablesInfo". The manipulation leads to SQL injection, and it is possible ...

PT-2022-24172

Name of the Vulnerable Software and Affected Versions go-ibax versions starting from commits on Jul 18, 2020 Description A critical issue has been found in go-ibax, allowing for SQL injection. This is due to the manipulation of the where argument in the /api/v2/open/rowsInfo endpoint, which can b...

PT-2022-24171

Name of the Vulnerable Software and Affected Versions IBAX go-ibax affected versions not specified Description A critical issue was found in IBAX go-ibax, affecting the /api/v2/open/rowsInfo endpoint. The manipulation of the order argument leads to SQL injection. This issue can be exploited...

PT-2022-24169

Name of the Vulnerable Software and Affected Versions IBAX go-ibax affected versions not specified Description A critical issue was found in IBAX go-ibax, affecting an unknown functionality of the file "/api/v2/open/tablesInfo". This issue leads to sql injection and can be exploited remotely. The...

PT-2022-24170

Name of the Vulnerable Software and Affected Versions IBAX go-ibax affected versions not specified Description A critical issue has been found in IBAX go-ibax, affecting some unknown functionality of the file "/api/v2/open/rowsInfo". The manipulation of the table name argument leads to SQL...

CVE-2022-3799: Improper Neutralization

A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2022-3800

IBAX go-ibax is affected by a SQL injection in /api/v2/open/rowsInfo (parameter: table_name). The issue is exploitable remotely and is supported by multiple sources (e.g., NVD entry for CVE-2022-3800 and nuclei-templates). Impact per the CVE entry is high/critical with potential data disclosure, ...

CVE-2022-3802: Improper Neutralization

A vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public a...

CVE-2022-3801: Improper Neutralization

A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

CVE-2022-3799

A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2022-31066

EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config endpoint exposes message bus credentials to local unauthenticated users. In security-enabled mode, message bus credentials are supposed to...

Improper Privilege Management API V2

Description There are some api v2 doesn't check permission allow attackers to retrieve/edit information ticket,account,group,department,team,ElasticSearch Proof of Concept Get users list 1. Login. 2. Go to /api/v2/accounts?type=all. 3. Users list return. Create user with admin role 1. Get the adm...

PT-2022-11436

Name of the Vulnerable Software and Affected Versions RSA Archer version 6.9.SP1 P3 Description The issue allows an attacker to bypass precluded application functions by intercepting the API request at the "/api/V2/internal/TaskPermissions/CheckTaskAccess" endpoint. If the parameters of this...

PT-2021-9716

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.7.2 Description A data exposure flaw was found in Ansible Tower, where sensitive data can be exposed from the "/api/v2/labels/" endpoint. This flaw allows users from other organizations in the system to retrie...

CVE-2020-14329: Exposure of Sensitive Information to an Unauthorized Actor

A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The...

CVE-2020-26223

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Ord...

GHSA-M2JR-HMC3-QMPR Authorization bypass in Spree

Impact The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree 3.7 are not affected. References Pull request with a fix and in-depth explanati...