1099 matches found
CVE-2024-42490 authentik has Insufficient Authorization for several API endpoints
authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//viewcertificate/, /api/v3/crypto/certificatekeypairs//viewprivatekey/, and...
CVE-2024-42490 authentik has Insufficient Authorization for several API endpoints
authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//viewcertificate/, /api/v3/crypto/certificatekeypairs//viewprivatekey/, and...
CVE-2024-42490
authentik (open-source Identity Provider) exposes certain API endpoints without proper authentication/authorization. Affected endpoints include /api/v3/crypto/certificatekeypairs//view_certificate/, /api/v3/crypto/certificatekeypairs//view_private_key/, and /api/v3/.../used_by/, where access depe...
CVE-2024-42490 authentik has Insufficient Authorization for several API endpoints
authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//viewcertificate/, /api/v3/crypto/certificatekeypairs//viewprivatekey/, and...
CVE-2024-42490: Improper Authorization
authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/ /viewcertificate/, /api/v3/crypto/certificatekeypairs/ /viewprivatekey/, and...
CVE-2024-44076
In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...
CVE-2024-33003
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information PII data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a Hi...
PT-2024-24325 · Adtran · Adtran Netvanta 3120
Name of the Vulnerable Software and Affected Versions: AdTran NetVanta 3120 version 18.01.01.00.E Description: The issue allows remote attackers to inject arbitrary JavaScript code, exploiting multiple stored cross-site scripting XSS vulnerabilities. This is demonstrated by various API endpoints,...
PT-2024-29279
Name of the Vulnerable Software and Affected Versions Puncia versions prior to 0.21 Description The issue arises from API URLS utilizing HTTP instead of HTTPS for communication, leading to potential issues like Eavesdropping, Data Tampering, Unauthorized Data Access, and MITM Attacks...
PT-2025-2796
Name of the Vulnerable Software and Affected Versions Edimax AC1200 Wi-Fi 5 BR-6476AC version 1.06 Description The issue is related to the lack of protection for the web interface structure of the Edimax AC1200 Wi-Fi 5 BR-6476AC router's firmware, allowing a remote attacker to conduct a Cross Sit...
Fortinet FortiAIOps Log Information Disclosure Vulnerability
Fortinet FortiAIOps is a Fortinet networking solution that combines artificial intelligence and machine learning AI/ML from Fortinet. A log information disclosure vulnerability exists in Fortinet FortiAIOps version 2.0.0, which stems from an application that does not adequately protect sensitive...
CVE-2024-5714
CVE-2024-5714 - Lunary in lunary-ai/lunary v1.2.4 is an improper access control vulnerability. Members with team management permissions can manipulate project identifiers in requests, enabling actions such as inviting users to projects in other organizations and changing members to projects with ...
CVE-2024-5714 Improper Access Control in lunary-ai/lunary
In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers in requests, enabling them to invite users to projects in other organizations, change members to projects in other organizations with...
PT-2024-27707 · Tessi · Tessi Docubase Document Management
Name of the Vulnerable Software and Affected Versions: Tessi Docubase Document Management product versions 5.x Description: The issue allows a remote attacker to execute arbitrary code via the idactivity parameter, which is related to a Cross Site Scripting vulnerability. Recommendations: For Tes...
SQL Injection
github.com/goharbor/harbor is vulnerable to SQL Injection. The vulnerability is due to the improper usage of prepared statements within the ListScanTasksByReportUUID function in task.go, which allows an attacker with administrator, projectadmin, or projectmaintainer roles to execute arbitrary SQL...
Sensitive Information Disclosure
ethycafides is vulnerable to Information Disclosure. The vulnerability is due to improper masking of nested sensitive fields such as privatekey in the BigQuery connection configuration, which allows an attacker to expose the sensitive fields in plaintext via certain API endpoints...
Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions
Now-patched authorization bypass issues impacting Cox modems could have been abused as a starting point to gain unauthorized access to the devices and run malicious commands. "This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could've...
JetBrains TeamCity Permission Issues Vulnerability
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from a permissions issu...