20 matches found
API BOLA / IDOR Probe
Tests API object endpoints with alternate IDs to detect unauthorized cross-object access OWASP API1:2023 BOLA. !/usr/bin/env python3 -- coding: utf-8 -- """Probe API endpoints for Broken Object Level Authorization BOLA/IDOR.""" from future import annotations import json from typing import Dict,...
CVE-2016-10779
cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...
EUVD-2019-5607
Malware in sbrugna...
EUVD-2016-1776
Malware in sbrugna...
CVE-2019-14397
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...
Sql injection
A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php. Affected is an unknown function of the file api1/login.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling...
CVE-2015-10086
A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php. Affected is an unknown function of the file api1/login.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling...
CVE-2015-10086: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php. Affected is an unknown function of the file api1/login.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling...
CVE-2016-10779
cPanel before 60.0.25 allows stored XSS in api1listautoresponders SEC-179...
Cross site scripting
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...
CVE-2016-10782
CVE-2016-10782 affects cPanel versions prior to 60.0.25, with a self-stored XSS in the postgres API1 listdbs. The root cause is insufficient validation of client-side data in the web application, allowing injected scripts to run when listing databases. Impact: stored XSS in affected user sessions...
PT-2019-7575
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows for stored XSS in the api1 listautoresponders endpoint. Recommendations For versions prior to 60.0.25, update to version 60.0.25 or later to resolve the issue...
CVE-2016-10782: Improper Neutralization of Input During Web Page Generation
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...
PT-2019-7578
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows self-stored XSS in the postgres API1 listdbs. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue w...
CVE-2019-14401
cPanel before 78.0.18 allows code execution via an addforward API1 call SEC-480...
CVE-2019-14397
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...
Design/Logic Flaw
cPanel before 78.0.18 allows code execution via an addforward API1 call SEC-480...
Code injection
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...
CVE-2019-14397
cPanel prior to 80.0.5 is affected by CVE-2019-14397. The vulnerability allows demo accounts to modify arbitrary files through the extractfile API1 call (SEC-496). Impact is limited to unauthorized file modifications on affected systems; no broader exploitation details are provided in the sources...