3158 matches found
CVE-2019-17361
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host...
CVE-2020-5505
Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring in conjunction with "type":"application/x-php" to the /api/files/ URI...
CVE-2020-5194
The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajaxdownloadzip/zipname endpoint. The result is that a user without...
CVE-2020-5194
The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajaxdownloadzip/zipname endpoint. The result is that a user without...
CVE-2020-5194
CVE-2020-5194 affects Cerberus FTP Server 8 where the zip API endpoint (file/ajax_download_zip/zip_name) permits an authenticated user without zip permission to use the zip function via an unrestricted API endpoint due to improper permission verification. The result is that such a user can zip an...
PT-2020-18295
Name of the Vulnerable Software and Affected Versions Cerberus FTP Server version 8 Description The issue concerns improper permission verification in the zip API endpoint, allowing an authenticated attacker without zip permission to utilize the zip functionality. This occurs when calling the...
PT-2019-15891
Name of the Vulnerable Software and Affected Versions Big Switch Big Monitoring Fabric versions 6.2 through 6.2.4 Big Switch Big Monitoring Fabric versions 6.3 through 6.3.9 Big Switch Big Monitoring Fabric versions 7.0 through 7.0.3 Big Switch Big Monitoring Fabric versions 7.1 through 7.1.3 Big...
PT-2019-15331
Name of the Vulnerable Software and Affected Versions SPPA-T3000 MS3000 Migration Server All versions Description A vulnerability has been identified that could allow an attacker with network access to trigger a Denial-of-Service condition by sending specifically crafted packets to the port...
AntiDisposmail - Detecting Disposable Email Addresses
Antbot.pw provides a free, open API endpoint for checking a domain or email address against a frequently-updated list of disposable domains. CORS is enabled for all originating domains, so you can call the API directly from your client-side code. GET https://antibot.pw/api/[email protected]...
CVE-2019-3990
A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality...
CVE-2019-3990
A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality...
Design/Logic Flaw
A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality...
CVE-2019-3990
A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality...
CVE-2019-3990: Improper Privilege Management
A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality...
PT-2019-15743 · Tp Link +1 · Tp-Link Archer C7 +1
Name of the Vulnerable Software and Affected Versions: OpenWrt version 18.06.4 Description: The issue allows for XSS via the Name fields in the /cgi-bin/luci/admin/network/firewall/rules API endpoint, specifically in the "Open ports on router", "New forward rule", and "New Source NAT" fields. Thi...
CSRF vulnerability in google-compute-engine allowed provisioning agents
google-compute-engine did not require POST requests on an API endpoint. This CSRF vulnerability allowed attackers to provision new agents. google-compute-engine now requires POST requests for this API endpoint...
CVE-2019-8138
A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event...
CVE-2019-8138
A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event...
Cross site scripting
A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event...
PT-2019-18932
Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1, excluding 2.3.2-p1 Description A server-side request forgery SSRF vulnerability exists, allowing an authenticated user with admin privileges to modify store...