MAL-2022-3147 Malicious code in free-fortnite-skins-api-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84adc7f3e89bcdaf2440857943395002466913468cf0aed35f78e5879eaf84d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-19343

Name of the Vulnerable Software and Affected Versions OrangeHRM version v4.10.1 Description A stored cross-site scripting XSS issue in the addNewPost component allows attackers to execute arbitrary web scripts or HTML via a crafted POST request to the /api/v1/addNewPost endpoint, using vulnerable...

PT-2022-13857

Name of the Vulnerable Software and Affected Versions easyappointments versions prior to 1.5.0 Description The issue concerns an API privilege escalation in the easyappointments GitHub repository. It allows a low-privileged user, such as a provider, to create a new admin user via the...

CVE-2022-24730

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository acces...

PT-2021-23151

Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.6.3 Description A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint, such as "/api/v1/auth/logout". This requires a...

CVE-2021-27561: Improper Neutralization of Special Elements used in an OS Command

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication...

PT-2021-21949

Name of the Vulnerable Software and Affected Versions: Planview Spigit version 4.5.3 Description: The issue allows remote unauthenticated attackers to query sensitive user accounts data. This is demonstrated by a request to the "api/v1/users/1" endpoint. Recommendations: For Planview Spigit versi...

CVE-2021-38095: Undefined Security Weakness

The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request...

CVE-2021-27670

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...

Server side request forgery (ssrf)

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...

PT-2021-17595

Name of the Vulnerable Software and Affected Versions Appspace version 6.2.4 Description The issue allows for Server-Side Request Forgery SSRF via the url parameter in the "api/v1/core/proxy/jsonprequest" API endpoint. This means an attacker could potentially force the server to make unintended...

CVE-2021-27670: Server-Side Request Forgery (SSRF)

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...

CVE-2021-27186

Fluent Bit 1.6.10 has a NULL pointer dereference when an flbmalloc return value is not validated by flbavro.c or httpserver/api/v1/metrics.c...

CVE-2021-27186: NULL Pointer Dereference

Fluent Bit 1.6.10 has a NULL pointer dereference when an flbmalloc return value is not validated by flbavro.c or httpserver/api/v1/metrics.c...

PT-2020-16809

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 20.10.1 Description The issue allows SQL injection, as demonstrated by the "/api/v1/containers" endpoint with the orderby parameter. The PaginatorOrdered classes used for paginating results of REST endpoints do not...

CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

CVE-2020-11576: Observable Discrepancy

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

PT-2020-5301

Name of the Vulnerable Software and Affected Versions D-Link DSL-2640B versions prior to EU 4.01B Description The issue is related to insufficient input validation, allowing a remote attacker to reset the device's configuration by accessing an unauthenticated URL, such as "/api/v1/reset" or...

CVE-2020-10591

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

CVE-2020-10591: Undefined Security Weakness

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...