3158 matches found
CVE-2018-7248: Undefined Security Weakness
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
FreeBSD : jenkins -- multiple vulnerabilities (06ab7724-0fd7-427e-a5ce-fe436302b10c)
Jenkins developers report : The agent to master security subsystem ensures that the Jenkins master is protected from maliciously configured agents. A path traversal vulnerability allowed agents to escape whitelisted directories to read and write to files they should not be able to access. Black...
jenkins -- multiple vulnerabilities
Jenkins developers report: The agent to master security subsystem ensures that the Jenkins master is protected from maliciously configured agents. A path traversal vulnerability allowed agents to escape whitelisted directories to read and write to files they should not be able to access. Black Du...
PT-2018-9818 · Wuzhi · Wuzhi Cms
Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: A persistent XSS issue allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the "/index.php?m=tags&f=index&v=add" API endpoint. Recommendations: For WUZHI CMS versi...
LocalTapiola: User Information Disclosure via Json response
User Information Disclosure via Json response on a specific api end point POC URL: https://www.lahitapiolarahoitus.fi/wp-json/wp/v2/users/ Refernce: https://wpvulndb.com/wordpresses/462 Impact attacker can user those info for advance attack as bruteforce login...
BOHEMIA INTERACTIVE a.s.: (Possible) staff account takeover via reset token bruteforce at helpdesk.bistudio.com
As stated in a brief exchange with @rvn in my other report 312433, I might have found a logic flaw in the way https://helpdesk.bistudio.com handles the reset flow and tokens. I've asked if it was possible to obtain a test account, but I fully understand that it's something that cannot be done; as...
Gitlab project service integration API endpoint information disclosure vulnerability
GitLab is a set of Ruby on Rails development of open source applications , can be realized as a self-hosted Git version control system project repository , which has similar features to Github , you can access the project's file content , commit history , bug lists , etc. GitLab Community Edition...
CVE-2017-0925
Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password...
CVE-2017-0925
Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password...
PT-2018-5152
Name of the Vulnerable Software and Affected Versions Gitlab Enterprise Edition version 10.1.0 Description The issue concerns an insufficiently protected credential problem in the "project service integration API endpoint" that results in the disclosure of plaintext password information...
PT-2018-18253
Name of the Vulnerable Software and Affected Versions: Western Bridge Cobub Razor version 0.7.2 Description: An issue was discovered where authentication is not required for the "/index.php?/manage/channel/modifychannel" API endpoint. This allows for stored XSS to be triggered during a later...
PT-2018-18245
Name of the Vulnerable Software and Affected Versions: Afian FileRun versions prior to 2018.02.13 Description: The issue allows for remote SQL injection when an attacker is logged in as a superuser. This can be achieved via the search parameter in a "/?module=users§ion=cpanel&page=list" API...
PT-2018-18017
Name of the Vulnerable Software and Affected Versions Joomla! CW Tags component version 2.0.6 Description A SQL Injection issue exists in the CW Tags component for Joomla!, which can be exploited via the searchtext array parameter in the API endpoint. Recommendations For version 2.0.6, consider...
PT-2018-17992
Name of the Vulnerable Software and Affected Versions Lutron Quantum BACnet Integration version 2.0 firmware 3.2.243 Description An issue allows remote attackers to obtain potentially sensitive information via a "/DbXmlInfo.xml" API endpoint request. This can reveal details such as the...
PT-2018-17261
Name of the Vulnerable Software and Affected Versions: Joomla! Smart Shoutbox version 3.0.0 Description: A SQL Injection issue exists in the Smart Shoutbox component for Joomla!, which can be exploited via the shoutauthor parameter to the "archive" API endpoint. Recommendations: For Joomla! Smart...
PT-2018-17574
Name of the Vulnerable Software and Affected Versions Netwave IP Camera devices affected versions not specified Description An issue allows an unauthenticated attacker to crash a device by sending a POST request with a large body size to the "/" API endpoint. Recommendations At the moment, there ...
CVE-2017-1000388
The CVE-2017-1000388 entry concerns the Jenkins Dependency Graph Viewer plugin (version 0.12 and earlier). The root cause is missing permission checks on the API endpoint that modifies the dependency graph, allowing any user with Overall/Read permission to modify the data. This description is sup...
CVE-2017-1000388: Missing Authorization
Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data...
PT-2017-15087
Name of the Vulnerable Software and Affected Versions FS Lynda Clone affected versions not specified Description The issue allows for CSRF via the "user/edit profile" API endpoint, as demonstrated by adding content to the user panel. Recommendations At the moment, there is no information about a...
PT-2017-14537
Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions 6.1.1030.1 and prior Description A SQL Injection issue was discovered, which generates an error in the database log. This issue allows for potential information disclosure. Recommendations For versions 6.1.1030.1 and...