PT-2022-25982 · Etic Telecom · Etic Telecom Remote Access Server

Name of the Vulnerable Software and Affected Versions: ETIC Telecom Remote Access Server RAS versions 4.5.0 and prior Description: The application programmable interface API of the affected software is vulnerable to directory traversal through several different methods. This could allow an attack...

CVE-2022-45130

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...

GHSA-RWCF-GQ22-PH83 IBAX go-ibax vulnerable to SQL injection

A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument tablename leads to sql injection. The attack may be launched remotely. The exploit has been...

IBAX go-ibax SQL注入漏洞

IBAX go-ibax is a blockchain system platform from IBAX Corporation. IBAX go-ibax suffers from a SQL injection vulnerability that stems from unknown functionality in file/api/v2/open/tablesInfo, where manipulation of parameter callbacks leads to SQL injection...

CVE-2022-3800 IBAX go-ibax rowsInfo sql injection

A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument tablename leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2022-3729

A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely. The associated identifier of this...

Cross site scripting

The affected product DIAEnergie versions prior to v1.9.01.002 is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API...

PT-2022-26004 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.01.002 Description: The issue concerns a stored cross-site scripting vulnerability. This vulnerability can be exploited through the SetPF API. Recommendations: For versions prior to v1.9.01.002, update to...

PT-2022-7016 · Cisco · Cisco Unified Communications Products

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Products affected versions not specified Description: A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU...

Denial of service

A denial of service vulnerability exists in the webserver hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the...

CVE-2022-35265

A denial of service vulnerability exists in the webserver hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the...

CVE-2022-35262

A denial of service vulnerability exists in the webserver hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the...

Heimdal GSSAPI 安全漏洞

Heimdal GSSAPI is the General Security Service Application Program Interface for Heimdal Individual Developers. A security vulnerability exists in Heimdal GSSAPI that stems from a possible buffer overflow on malloc allocated memory by the DES and 3-DES decoding methods...

CVE-2022-31366

An arbitrary file upload vulnerability in the apiImportLabs function in apilabs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code via a crafted UNL file...

PT-2022-26712 · Tenda · Tenda Tx3

Name of the Vulnerable Software and Affected Versions: Tenda TX3 version US TX3V1.0br V16.03.13.11 multi TDE01 Description: A stack overflow issue was discovered via the timeZone parameter at the "/goform/SetSysTimeCfg" API endpoint. Recommendations: For Tenda TX3 version US TX3V1.0br V16.03.13.1...

PT-2022-26709 · Tenda · Tenda Tx3

Name of the Vulnerable Software and Affected Versions: Tenda TX3 US TX3V1.0br V16.03.13.11 multi TDE01 Description: A stack overflow issue was discovered via the startIp parameter at the "/goform/SetPptpServerCfg" API endpoint. Recommendations: For Tenda TX3 US TX3V1.0br V16.03.13.11 multi TDE01,...

PT-2022-25895 · Unknown · Billing System Project

Name of the Vulnerable Software and Affected Versions: Billing System Project version 1.0 Description: A SQL injection issue was found in the Billing System Project. The vulnerability can be exploited via the id parameter at the "/phpinventory/editbrand.php" API endpoint. Recommendations: For...

PT-2022-26292 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.23 Description: The issue is related to a stack overflow vulnerability. This vulnerability can be exploited via the API endpoint "/goform/formSetSpeedWan". Recommendations: For Tenda AC10 version 15.03.06.23, as a...

MTN Group: Wordpress users Disclosure [ /wp-json/wp/v2/users/ ]

Summary: Using REST API, we can see all the WordPress users/author with some of their information. Which can even be Personal information of employees/author. The file v2/users at: https://www.mtn.com/wp-json/wp/v2/users/ is enabled and this give the attacker many users names like: Amogelang...

PT-2022-18934 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows revealing information about teams via the API due to an Insecure Direct Object Reference IDOR vulnerability. Recommendations: At the moment, there is no information...