1653 matches found
Information Exposure
Overview spreeapi is a Spree Api module Affected versions of this package are vulnerable to Information Exposure. An attacker can query the API v2 Order Status endpoint with an empty string passed as an Order token. Remediation Upgrade spreeapi to version 3.7.13, 4.0.5, 4.1.12 or higher. Referenc...
Authorization bypass in Spree
Impact The perpetrator could query the API v2 Order Status https://guides.spreecommerce.org/api/v2/storefronttag/Order-Status endpoint with an empty string passed as an Order token Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree 3.7 are not...
Design/Logic Flaw
A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper storage of sensitive information on an affected...
CVE-2020-27128 Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by...
PT-2020-4645 · Cisco · Cisco Sd-Wan Vmanage
Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: The issue is related to improper validation of directory traversal character sequences within requests to application programmatic interfaces APIs. This could allow an...
CVE-2020-16256
The API on Winston 1.5.4 devices is vulnerable to CSRF...
Cross site request forgery (csrf)
The API on Winston 1.5.4 devices is vulnerable to CSRF...
api.stream-radio.com Cross Site Scripting vulnerability OBB-1421523
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Cisco Industrial Network Director Denial of Service Vulnerability
Cisco Industrial Network Director IND is an industrial automation management system from Cisco. The system achieves automation management by visualizing the industrial Ethernet infrastructure. A denial of service vulnerability exists in the management REST API in Cisco Industrial Network Director...
The vulnerability of the API subsystem of the Cisco Meeting Server platform allows a hacker to obtain server credentials for conducting audio/video calls and packet forwarding.
The vulnerability of the API subsystem of the Cisco Meeting Server platform relates to insufficient mechanisms for protecting the server’s credentials. This vulnerability allows a malicious actor to obtain the server’s credentials, enabling them to conduct audio/video calls and packet forwarding...
Code injection
u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...
api.news18.com Cross Site Scripting vulnerability OBB-1311076
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Shopify: User sensitive information disclosure
1、open shopify指南 Applets 2、click 个人中心 3、click 编辑资料 微信图片20200905123248.png 4、https://api-wechat.shopify.cn/api/sp/customer/id 1.png 5、Modify the ID value to traverse the user information Impact User sensitive information disclosur...
Cloud firewall management API SNAFU put 500k SonicWall customers at risk
TL;DR I found an IDOR in SonicWalls cloud management platform API Any user could add themselves to any account at any organisation using it Anyone could create a user account to exploit the issue, from the public internet Can be used to change firewall rules, or add rogue VPN users, for example...
CVE-2020-19007
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser...
Insecure Direct Object Reference vulnerability in the mysonicwall.com add-user API
An insecure direct object reference vulnerability has been identified in the users/add-user API endpoint of mysonicwall.com. This could allow a normal authenticated mysonicwall user to manipulate API parameter and gain access to user group of tenant of any other mysonicwall user account. CVE: N/A...
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.48 and prior 5.7.30 and prior and 8.0.20 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
...
Grandstream GWN7000 Arbitrary OS Command Execution Vulnerability
The Grandstream GWN7000 is an enterprise-class multi-WAN Gigabit VPN router. An arbitrary OS command execution vulnerability exists in the Grandstream GWN7000 version 1.0.9.4 and earlier. The vulnerability stems from the fact that the product allows an authenticated remote user to modify the...
ActiveMQ Artemis management API Password Disclosure Vulnerability
Apache ActiveMQ Artemis is the United States Apache Apache Software Foundation, a project to provide embedded messaging services for Java applications. A password disclosure vulnerability exists in the ActiveMQ Artemis management API product, which stems from the program storing passwords in...
