47 matches found
CVE-2026-107203 Foreman: domain and subnet interface api skips host search filters
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...
CVE-2026-107203
The Foreman package contains an incorrect authorization flaw in its network interface handling . The domain and subnet interface API fails to apply search limits on host permissions, allowing a low-privileged network attacker to view interface records for hosts they are not authorized to access. ...
EUVD-2026-97236
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...
CVE-2026-107203
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...
CVE-2026-107203
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...
GenieACS => 1.2.8 - OS Command Injection Detection
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check. !/usr/bin/env python3 --...
FortiWeb Stack Buffer Overflow
The vulnerability of the FortiWeb web application’s network interface program interface is related to buffer overflow attacks based on stacks. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted HTTP requests...
CVE-2023-25492
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API...
EUVD-2023-29450
Malicious code in bioql PyPI...
EUVD-2023-29447
Malicious code in bioql PyPI...
EUVD-2022-42307
Malicious code in bioql PyPI...
CVE-2018-14573
A Local File Inclusion LFI vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683...
CVE-2023-25492
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API...
CVE-2023-25492
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API...
CVE-2023-25492
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API...
CVE-2023-25492
Lenovo XClarity Controller (XCC) is affected by CVE-2023-25492, a format-string injection vulnerability in the XCC web interface API that could allow a remote authenticated attacker to trigger a denial of service or other undefined behavior. The issue is confirmed across multiple advisories (Red ...
CVE-2023-25495
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured...
PT-2023-8788 · Haproxy +4 · Haproxy +4
Name of the Vulnerable Software and Affected Versions: Roxy-WI version 6.3.9.0 Description: A Path Traversal issue was found in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. This issue can be exploited via an HTTP request to "/app/options.py" and the config...
