CVE-2017-1000399

The CVE-2017-1000399 vulnerability affects Jenkins 2.73.1 and earlier, and 2.83 and earlier, where the remote API at /queue/item/(ID)/api disclosed information about queue tasks to users without proper Item/Read permission. The issue allowed exposure of task details from the queue that the curren...

CVE-2017-1000395

CVE-2017-1000395 affects Jenkins Core (2.73.1 and earlier, 2.83 and earlier). The remote /user/(username)/api API disclosed user-account details (e.g., emails via Mailer Plugin) to non-admins; the API now only returns basic info (userID and name) unless the requester is an administrator. This is ...

PowerDNS Authoritative < 4.0.5 Read Only Configuration Bypass (CVE-2017-15091)

According to its self-reported version number, the version of the PowerDNS Authoritative listening on the remote host is prior to 4.0.5. It is, therefore, affected by a vulnerability in the API where a remote authenticated attacker can perform operations that affect the server state even if the...

CVE-2018-2663

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacke...

CVE-2017-1000442

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

Circle with Disney Apid Photo Upload Denial of Service Vulnerability(CVE-2017-2884)

Summary An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in a bricked device. An attacker needs network connectivity to...

Humax Wi-Fi Router HG100R 2.0.6 - Authentication Bypass

coding: utf-8 Exploit Title: Humax HG100R- Authentication Bypass Date: 14/09/2017 Exploit Author: Kivson Vendor Homepage: http://humaxdigital.com Version: VER 2.0.6 Tested on: OSX Linux CVE : CVE-2017-11435 The Humax Wi-Fi Router model HG100R- 2.0.6 is prone to an authentication bypass...

CVE-2015-3442

CVE-2015-3442 affects Xpert.Line 3.0 (Xpert.Center) from Soreco AG. The vulnerability arises from a client‑side authentication mechanism that uses the Windows API getUserNameA from advapi32.dll to authenticate the user. An attacker who can intercept this API call can impersonate other users and g...

Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update is now available for CloudForms Management Engine 5.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

WakaTime: Users with member privilege are able to see emails and membership information of other users

Description: According to the rules of Leaderboard Teams only Owners and admins have access to other team members' personal information like email address, roles etc. Users whose role set as "Member" can't see other users' details. But through API it is possible for a user with member role to...

CVE-2017-8307

In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also...

Authentication flaw

Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use...

CVE-2016-1219

CVE-2016-1219 : In Cybozu Garoon, versions prior to 4.2.2 expose an authentication bypass vulnerability related to API usage that lets remote attackers bypass login authentication. The main affected product is Cybozu Garoon (versions up to 4.2.1). The reported impact is remote authentication bypa...

Alienvault OSSIM/USM 5.3.4/5.3.5 - Remote Command Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'AlienVault USM/OSSIM API Command Execution', 'Description' = %q This modu...

Alienvault OSSIM/USM 5.3.4/5.3.5 - Remote Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'AlienVault USM/OSSIM API Command Execution', 'Description' = %q This module exploits an unauthenticated command injection in...

WordPress 4.7.1 - Username Enumeration

WordPress 4.7.1 - Username Enumeration !usr/bin/php...

W3C High Resolution Time API AnC Attack Vulnerability

The W3C High Resolution Time API is a set of JavaScript interfaces for providing web applications with a sub-millisecond resolution of the current time format. A security vulnerability exists in the W3C High Resolution Time API. The vulnerability can be exploited by an attacker with specially...

The vulnerability of the Android operating system, which allows a perpetrator to compromise the confidentiality of information

The vulnerability of the Android operating system’s Framework API is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality of sensitive information...

CVE-2016-6770

An elevation of privilege vulnerability in the Framework API could enable a local malicious application to access system functions beyond its access level. This issue is rated as Moderate because it is a local bypass of restrictions on a constrained process. Product: Android. Versions: 4.4.4,...

Shopify: CSRF in all API endpoints when authenticated using HTTP Authentication

Description: Short: I have found a CSRF vulnerability in all API endpoints /admin/anyapiendpoint/ if the current user has authenticated using HTTP authentication. Details: When a user generates API credentials for a private application in his shop he will be given API key and password that he can...