73 matches found
CVE-2024-42179
HCL MyXalytics is affected by sensitive information disclosure vulnerability. The HTTP response header exposes the Microsoft-HTTP API∕2.0 as the server's name & version...
GHSA-VXCF-C7MX-PG53 Build corruption when using `PYO3_CONFIG_FILE` environment variable
In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...
CVE-2023-42284
Blind SQL injection in apiversion parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query...
CVE-2023-42284
Blind SQL injection in apiversion parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query...
Sql injection
Blind SQL injection in apiversion parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query...
CVE-2023-42284
CVE-2023-42284 concerns Tyk Gateway 5.0.3. The vulnerability is a blind SQL injection in the API parameter api_version , enabling an attacker to access and dump the database via a crafted query. Reported impact is high (database exposure/compromise) with CVSS 3.1 base score 9.8 (CRITICAL) from NV...
PT-2023-7385 · Tyk · Tyk Gateway
Name of the Vulnerable Software and Affected Versions: Tyk Gateway version 5.0.3 Description: The issue is related to a lack of protection against SQL query structure exploitation in the Tyk Gateway API implementation. This allows a remote attacker to execute arbitrary SQL queries. Specifically, ...
CVE-2023-42284
Blind SQL injection in apiversion parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query...
CVE-2023-2907
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Marksoft allows SQL Injection. This issue affects Marksoft: through Mobile:v.7.1.7 ; Login:1.4 ; API:20230605...
CVE-2023-2907 SQLi in Marksoft
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Marksoft allows SQL Injection. This issue affects Marksoft: through Mobile:v.7.1.7 ; Login:1.4 ; API:20230605...
SUSE-SU-2023:2445-1 Security update for google-cloud-sap-agent
This update of google-cloud-sap-agent fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441. - Update to version 1.5.1 bsc1210464 - Raise golang API version to 1.20...
SUSE-SU-2023:0602-1 Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issues: Updated to version 20230222.00 and bumped go API version to 1.18 to address the following bsc1208723: - CVE-2021-38297: Fixed data overwrite when passing large arguments to GOARCH=wasm GOOS=js bsc1191468. - CVE-2022-23806: Fixed...
SUSE CVE-2010-0629
Use-after-free vulnerability in kadmin/server/serverstubs.c in kadmind in MIT Kerberos 5 aka krb5 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service daemon crash via a request from a kadmin client that sends an invalid API version number...
U.S. Dept Of Defense: XSS on ( █████████.gov ) Via URL path
An XSS vulnerability was discovered on a government website, allowing an attacker to execute malicious code on the victim's browser and steal their cookies, potentially leading to account takeover. The vulnerability was exploited by injecting a script into the URL path. The suggested mitigation i...
Shenzhen Fujia Technology OurPhoto 安全漏洞
Shenzhen Fujia Technology OurPhoto is a cloud photo frame software from Shenzhen Fujia Technology, China. It allows you to share photos and video files directly on your cell phone. A security vulnerability exists in Shenzhen Fujia Technology OurPhoto version 1.4.1 that stems from the usertoken...
CVE-2022-37144
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user...
Malicious Package
Overview @epc-apps/api-version-test is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information user statuses via a REST API version 4 endpoint...
CVE-2021-43350
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...