377 matches found
CVE-2022-3732: Improper Neutralization
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to...
CVE-2022-36304: Improper Neutralization of Input During Web Page Generation
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the generateresponse function at /web/api/v1/upload/UploadHandler.php...
CVE-2022-34025: Improper Neutralization of Input During Web Page Generation
Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...
MAL-2022-3147 Malicious code in free-fortnite-skins-api-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84adc7f3e89bcdaf2440857943395002466913468cf0aed35f78e5879eaf84d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2021-27561: Improper Neutralization of Special Elements used in an OS Command
Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication...
CVE-2021-38095: Undefined Security Weakness
The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request...
Server side request forgery (ssrf)
Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...
CVE-2021-27670
Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...
CVE-2021-27670: Server-Side Request Forgery (SSRF)
Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...
CVE-2021-27186: NULL Pointer Dereference
Fluent Bit 1.6.10 has a NULL pointer dereference when an flbmalloc return value is not validated by flbavro.c or httpserver/api/v1/metrics.c...
CVE-2020-11576: Observable Discrepancy
Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...
CVE-2020-10591: Undefined Security Weakness
An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...
CVE-2019-19250: Improper Neutralization of Special Elements used in an SQL Command
OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js...
CVE-2019-14544: Missing Authorization
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...
Cross site scripting
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
CVE-2019-14351: Improper Restriction of Excessive Authentication Attempts
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...
CVE-2019-14349: Improper Neutralization of Input During Web Page Generation
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
CVE-2019-14350: Improper Neutralization of Input During Web Page Generation
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation...
