CVE-2023-27742

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login...

CVE-2022-3880: Cross-Site Request Forgery (CSRF)

The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins fro...

App Layering - (400) Bad Request with ImportOsLayer.ps1

ImportOsLayer.ps1 script PS C:\windows\Setup\Scripts .\ImportOsLayer.ps1 -ElmAddress -IgnoreCertError ModuleType Version Name ExportedCommands ---------- ------- ---- ---------------- Script 0.0 DynamicModule1cbe0359-cdf4-45... New-CALOperatingSystem, New-CALSession Failed to call API at and Meth...

PT-2021-22719 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.1 and later Description: An improper access control issue allows users with expired passwords to continue accessing GitLab through git and API endpoints, such as "/api/v1/login", using access tokens acquired before...

GHSA-FQRR-RRWG-69PV Local API Login Credentials Disclosure in paratrooper-pingdom

The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process. Vulnerable Code: From: paratrooper-pingdom-1.0.0/lib/paratrooper-pingdom.rb ruby def setupoptions = %xcurl https://api.pingdom.com/api/2.0/checks -X PUT ...

Local API Login Credentials Disclosure in paratrooper-pingdom

The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process. Vulnerable Code: From: paratrooper-pingdom-1.0.0/lib/paratrooper-pingdom.rb ruby def setupoptions = %xcurl https://api.pingdom.com/api/2.0/checks -X PUT ...

CVE-2016-5681: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 1.11 before 1.11WWb04, DIR-890L A1 1.09 before 1.09b14, DIR-885L A1 1.11 before...

CVE-2014-0644: Exposure of Sensitive Information to an Unauthorized Actor

EMC Cloud Tiering Appliance CTA 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, as demonstrated by reading the /etc/shadow fi...

paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb API Login Credentials Local Disclosure

paratrooper-pingdom Gem for Ruby contains a flaw in /lib/paratrooper-pingdom.rb. The issue is triggered when the script exposes API login credentials, allowing a local attacker to gain access to the API key, username, and password for the API login by monitoring the process tree...

Fedora 12 : mediawiki-1.15.3-53.fc12 (2010-6335)

This is a security and bugfix release of MediaWiki 1.15.3. Three security issues are fixed in this update: A CSS validation issue was discovered which allows editors to display external images in wiki pages. A data leakage vulnerability was discovered in thumb.php which affects wikis which restri...