CVE-2022-30746

Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API...

Design/Logic Flaw

Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API...

CVE-2022-30746

Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API...

CVE-2022-30746

Summary: CVE-2022-30746 affects Samsung SmartThings prior to 1.7.85.12. A missing caller check in the JavaScript interface API can allow a remote attacker to access sensitive information. The vulnerability is described across multiple sources (NVD, Red Hat, CNVD/CNNVD references) as a missing cal...

CVE-2022-30746: Improper Authorization

Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API...

CVE-2021-46704

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check...

PT-2022-12907

Name of the Vulnerable Software and Affected Versions GenieACS versions 1.2.x through 1.2.7 Description The issue arises from insufficient input validation combined with a missing authorization check in the UI interface API, allowing unauthenticated OS command injection via the ping host argument...

PT-2021-17090

Name of the Vulnerable Software and Affected Versions Aruba ClearPass Policy Manager versions prior to 6.9.5 Aruba ClearPass Policy Manager version 6.8.8-HF1 Aruba ClearPass Policy Manager version 6.7.14-HF1 Description A remote authenticated SQL Injection issue was discovered in the web-based...

CVE-2021-26685: Improper Neutralization of Special Elements used in an SQL Command

A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager versions: Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attack...

CVE-2021-26686: Improper Neutralization of Special Elements used in an SQL Command

A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager versions: Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attack...

PT-2021-17091

Name of the Vulnerable Software and Affected Versions Aruba ClearPass Policy Manager versions prior to 6.9.5 Aruba ClearPass Policy Manager version 6.8.8-HF1 Aruba ClearPass Policy Manager version 6.7.14-HF1 Description A remote authenticated SQL Injection issue was discovered in the web-based...

Description of the security update for SharePoint Server 2019: September 10, 2019

None None...

CVE-2018-14573

A Local File Inclusion LFI vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683...

CVE-2018-14573

A Local File Inclusion LFI vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683...

CVE-2018-14573

The vulnerability CVE-2018-14573 affects TightRope Media Carousel Digital Signage before 7.3.5. It is a Local File Inclusion (LFI) in the Web Interface API’s RenderingFetch function, exploitable via directory traversal sequences (CSL-1683) to download arbitrary files. Impact is stated as Partial ...

PT-2018-12587

Name of the Vulnerable Software and Affected Versions TightRope Media Carousel Digital Signage versions prior to 7.3.5 Description A Local File Inclusion LFI issue exists in the Web Interface API, specifically affecting the RenderingFetch API. This allows for the downloading of arbitrary files...

CVE-2018-14573: Improper Limitation of a Pathname to a Restricted Directory

A Local File Inclusion LFI vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683...

Design/Logic Flaw

In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also...

CVE-2017-8307

Affected software. Avast Antivirus (before v17) on Windows. Vulnerability and root cause. The LPC interface API exposed by the AvastSVC.exe Windows service can be abused to launch predefined binaries or replace/delete arbitrary files. This arises in the context of Avast Self-Defense and can be ex...

CVE-2017-8307: Undefined Security Weakness

In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also...