Keybase: Denial of Service through set_preference.json

Hey there, When selecting an image at https://keybase.io//api/1.0/image/setpreference.json, passing an invalid value in identitysrc knocks the server down for 20-30 seconds, with just one request. I have verified this by visiting an external website that checks if a website is down. POC: 1. Conne...

CVE-2016-5390

CVE-2016-5390 affects Foreman before 1.11.4 and 1.12.x before 1.12.1. The issue allows remote authenticated users with the view_hosts permission to exploit an information-disclosure flaw via API routes under hosts (e.g., api/v2/hosts/secrethost/interfaces) to obtain sensitive network interface in...

Docebo LMS 6.9 - (Moxie) API Calls RST RCE Vulnerability

Document Title: =============== Docebo LMS 6.9 - Moxie API Calls RST RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1888 Video: http://www.vulnerability-lab.com/getcontent.php?id=1892 Release Date: ============= 2016-08-02 Vulnerabilit...

OLX: SQLi in Payment Request

Hi there, I have found out that one request in your API is vulnerable to SQL injection. PoC: Invalid Request: GET /api/v1.0/payments/items?ids=891048367'"&platform=desktop HTTP/1.1 Host: www.olx.com.ar User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:46.0 Gecko/20100101 Firefox/46.0 Accept:...

Vulnerability of Adobe Reader software, which allows a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information

The vulnerability exists in the Adobe Reader API due to the access to unmaped memory. Exploiting this vulnerability allows attackers to execute arbitrary code by using API calls...

openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users

An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bare Metal. If an unprivileged attacker knew or was able to...

Cisco Application Policy Infrastructure Controller Enterprise Module Security Bypass Vulnerability

The Cisco Application Policy Infrastructure Controller Enterprise Module is a suite of applications that provide policy-based use for automated configuration of end-to-end infrastructure controllers. A security bypass vulnerability exists in the API of the Cisco Application Policy Infrastructure...

Cisco Prime Infrastructure Privilege Escalation API Vulnerability (cisco-sa-20160406-privauth)

A vulnerability in the web application programming interface API of Cisco Prime Infrastructure could allow an authenticated, remote attacker to gain elevated privileges. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...

Troy Hunt Explains Nissan Leaf Car Hack

Last month, when researcher Troy Hunt argued the dangers of insecure APIs at a security workshop, little did he know hours later he would discover an API vulnerability that allowed remote access to onboard computers of 200,000 Nissan Leaf and eNV200 electric automobiles. “After talking about the...

Mattel Fisher-Price Smart Toy Bear API Information Disclosure Vulnerability

The Mattel Fisher-Price Smart Toy Bear is a WiFi connected Internet of Things IOT smart toy bear. A security vulnerability in the API on the Mattel Fisher-Price Smart Toy Bear device allows remote attackers to exploit the vulnerability by submitting a special request to obtain sensitive informati...

CVE-2015-8269

The API on Fisher-Price Smart Toy Bear devices allows remote attackers to obtain sensitive information or modify data by leveraging presence in an 802.11 network's coverage area and entering an account number...

CVE-2015-5049

SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Updated blueman packages fix security vulnerability

Privilege escalation vulnerability in blueman before 2.0.3 in the dbus API CVE-2015-8612...

CVE-2015-6852

Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter...

langprism.com vulnerability

Vulnerable URL: http://langprism.com/api/http/getpage?url=https://www.xssposed.org/=ru Details: Description| Value ---|--- Patched:| Yes, at 21.12.2015 Latest check for patch:| 21.12.2015 16:08 GMT Vulnerability status:| Publicly disclosed Alexa Rank| 1899388 Google Pagerank| 3 VIP website status...

Shopify: create staff member without owner access

Hi as you mentioned in 56726 "Only the the store owner is allowed to create new staff members" admins can't create new staff members! but with this vulnerability admins can use api to create user! steps: - get access token for one full access admin you can send request to xauth or sniff it from...

REST API Vulnerability in Multiple F5 BIG-IQ Products

The BIG-IQ Cloud Platform provides the core services necessary for the management of application-oriented services. A security vulnerability exists in the REST API of multiple F5 BIG-IQ products, which can be exploited by a remote attacker to obtain an authentication token for any user by guessin...

SUSE-SU-2015:0945-1 Security update for spacewalk-java, spacewalk-setup

The spacewalk-java and spacewalk-setup packages were updated to fix one security issue: CVE-2014-8162: RPC API XML External Entities file disclosure. bsc922525 Security Issues: CVE-2014-8162...

Home Automation Protocol Z-Way Vulnerable to Remote Attacks

A researcher is warning users of the extensible Z-Way controller project that a weakness built into the software could inherently expose it to attacks. Z-Way is the controller and abstraction layer of software that handles Z-Wave, a standard for wireless communication between devices in smart...

Multiple Cross-Site Request Forgery Vulnerabilities in Cisco Unified MeetingPlace Server

Cisco Unified MeetingPlace conferencing solutions allow organizations to host integrated voice, video, and web conferences. Multiple cross-site request forgery vulnerabilities exist in the API functionality in Cisco Unified MeetingPlace version 8.6 1.9, which can be exploited by a remote attacker...