CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." A flaw was found in a...

PT-2015-3807

Name of the Vulnerable Software and Affected Versions Johnson Controls Metasys versions 4.1 through 6.5 Description The issue allows remote attackers to read password hashes via a POST request to a vulnerable API endpoint. Recommendations For versions 4.1 through 6.5, update to a version that...

PT-2015-5028

Name of the Vulnerable Software and Affected Versions Kiwix versions prior to 0.9.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to the "/search" API endpoint. Recommendations For versions prior to 0.9.1,...

PT-2015-3617

Name of the Vulnerable Software and Affected Versions Sendy version 1.1.9.1 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the c parameter in the "/send-to" API endpoint. Recommendations For Sendy version 1.1.9.1, avoid using the ...

CVE-2014-9355

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

Cross site request forgery (csrf)

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

CVE-2014-9355

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

CVE-2014-9355

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

CVE-2014-9355

Removed by vendor...

CVE-2014-9355: Exposure of Sensitive Information to an Unauthorized Actor

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

User avatar upload endpoint is vulnerable to XSRF

Stash, as 2.12, will allows users to upload local avatars to their account STASHDEV-6182. That upload is submitted to a non-API end point that accepts a POST request with the avatar as data-uri|https://en.wikipedia.org/wiki/DataUri. Currently, because the form is submitted by AJAX, the end point ...

UBUNTU-CVE-2013-4302

1 ApiBlock.php, 2 ApiCreateAccount.php, 3 ApiLogin.php, 4 ApiMain.php, 5 ApiQueryDeletedrevs.php, 6 ApiTokens.php, and 7 ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the...

PT-2012-2113

Name of the Vulnerable Software and Affected Versions DoceboLMS versions 4.0.4 and earlier Description The issue concerns SQL injection vulnerabilities in the save connection function within the iotask module of DoceboLMS. These vulnerabilities allow remote authenticated users with admin or teach...

PT-2012-5550

Name of the Vulnerable Software and Affected Versions Arbor Networks Peakflow SP versions 5.1.1 through 5.1.1 before patch 6 Arbor Networks Peakflow SP versions 5.5 through 5.5 before patch 4 Arbor Networks Peakflow SP version 5.6.0 before patch 1 Description A cross-site scripting XSS issue allo...

PT-2012-3312

Name of the Vulnerable Software and Affected Versions Webfolio CMS versions 1.1.4 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be done through "admin/users/add" or "admin/pages/edit/web page name" API endpoints...

PT-2012-1709

Name of the Vulnerable Software and Affected Versions Symantec pcAnywhere versions 12.5.x through 12.5.3 Symantec IT Management Suite pcAnywhere Solution version 7.0 aka 12.5.x Symantec IT Management Suite pcAnywhere Solution version 7.1 aka 12.6.x Description The issue is related to the...

PT-2011-4885

Name of the Vulnerable Software and Affected Versions Google App Engine Python SDK versions prior to 1.5.4 Description The issue is related to the sandbox environment in the Google App Engine Python SDK, which does not properly prevent os.popen calls. This allows local users to bypass intended...