CVE-2021-27186: NULL Pointer Dereference

Fluent Bit 1.6.10 has a NULL pointer dereference when an flbmalloc return value is not validated by flbavro.c or httpserver/api/v1/metrics.c...

PT-2020-16809

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 20.10.1 Description The issue allows SQL injection, as demonstrated by the "/api/v1/containers" endpoint with the orderby parameter. The PaginatorOrdered classes used for paginating results of REST endpoints do not...

CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

CVE-2020-11576: Observable Discrepancy

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

PT-2020-5301

Name of the Vulnerable Software and Affected Versions D-Link DSL-2640B versions prior to EU 4.01B Description The issue is related to insufficient input validation, allowing a remote attacker to reset the device's configuration by accessing an unauthenticated URL, such as "/api/v1/reset" or...

CVE-2020-10591

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

CVE-2020-10591: Undefined Security Weakness

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

PT-2020-12222

Name of the Vulnerable Software and Affected Versions Walmart Labs Concord versions prior to 1.44.0 Description An issue allows remote attackers to discover host information, nodes, API metadata, and references to usernames via the "api/v1/apikey" endpoint. This is due to CORS...

CVE-2019-19250

OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js...

PT-2019-15794

Name of the Vulnerable Software and Affected Versions OpenTrade versions prior to 2019-11-23 Description The issue allows SQL injection, related to the files server/modules/api/v1.js and server/utils.js. Recommendations For versions prior to 2019-11-23, update to a version released after 2019-11-...

CVE-2019-19250: Improper Neutralization of Special Elements used in an SQL Command

OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js...

CVE-2019-14544

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...

CVE-2019-14544: Missing Authorization

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...

Cross site scripting

EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...

CVE-2019-14351

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...

CVE-2019-14350

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation...

CVE-2019-14349

EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...

CVE-2019-14350: Improper Neutralization of Input During Web Page Generation

EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation...

CVE-2019-14351: Improper Restriction of Excessive Authentication Attempts

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...

PT-2019-13628

Name of the Vulnerable Software and Affected Versions EspoCRM version 5.6.4 Description The issue is related to stored XSS due to the lack of filtration of user-supplied data in the "api/v1/Document" functionality for storing documents in the account tab. An attacker can upload a crafted file tha...