3416 matches found
The vulnerability of the WhatsUp Gold network infrastructure monitoring system, related to errors when using privileged application programming interfaces (APIs), allows a hacker to execute arbitrary code.
The vulnerability of the WhatsUp Gold network infrastructure monitoring system is related to errors when privileged application programming interfaces APIs are used. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
CISA and EPA Release Joint Fact Sheet Detailing Risks Internet-Exposed HMIs Pose to WWS Sector
Today, CISA and the Environmental Protection Agency EPA released Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems. This joint fact sheet provides Water and Wastewater Systems WWS facilities with recommendations for limiting the exposure of Human Machine Interfaces HM...
VulnCheck KEV: CVE-2024-5827
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
PT-2024-25084 · Pal · Pal
Name of the Vulnerable Software and Affected Versions: PAL affected versions not specified Description: The issue occurs when the PAL client calls PAL service APIs by passing a random value as a handle, and the handle is not validated by the service, resulting in memory corruption. Recommendation...
CVE-2024-11667
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50W series firmware versions V5.10 through V5.38, and USG20W-VPN series firmware versions V5.10 through...
PT-2024-8761 · Myscada · Myscada Mypro Manager +1
Name of the Vulnerable Software and Affected Versions: mySCADA myPRO versions affected versions not specified mySCADA myPRO Manager versions affected versions not specified Description: The issue is related to a lack of authentication for a critical function used in the operating system command...
CVE-2021-1132
A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator NSO could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly...
CVE-2020-26073
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to application...
The vulnerability of the D-Link DSL6740C modem’s microprogramming software lies in errors that occur when privileged application programming interfaces are used. This allows a perpetrator to gain access to the device.
The vulnerability of the D-Link DSL6740C modem’s microprogramming software is related to errors that occur when privileged application programming interfaces APIs are used. Exploiting this vulnerability can allow a malicious actor to gain access to the device by sending a specially crafted API...
f2fs: fix to check atomic_file in f2fs ioctl interfaces
...
DataEase 数据伪造问题漏洞
DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends to achieve business improvement and optimization. DataEase v2.10.2 version before the data forgery problem vulnerability ,...
REST-APIs unintentionally enabled in Century Systems FutureNet NXR series routers
Overview FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial factory default configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server GUI or Web...
In the Dark about Shadow APIs?
I’m often asked about shadow APIs and shadow API parameters—even by people with a lot of experience in the API development space...
PT-2024-7891 · Futurenet · Futurenet Nxr Series Routers
Name of the Vulnerable Software and Affected Versions: FutureNet NXR series routers affected versions not specified Description: The issue concerns the unexpected enabling of REST-APIs in the initial configuration of FutureNet NXR series routers, provided that either http-server GUI or Web...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication due to insufficient validation of the cnf claim in DPoP access tokens. An attacker can use leaked DPoP access tokens at local API endpoints without possessing the private key for signing proof tokens. Note: This ...
The vulnerability of the $pconfig variable in the interfaces_groups_edit.php file of the software network interface controller based on the FreeBSD Netgate pfSense operating system allows a hacker to execute arbitrary code.
The vulnerability of the $pconfig variable in the interfacesgroups Edit.php file of the software network interface layer based on the FreeBSD Netgate pfSense operating system is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a remote...
CVE-2024-47005
Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs...
PT-2024-32336 · Sharp +1 · Sharp Mfps +1
Name of the Vulnerable Software and Affected Versions: Sharp and Toshiba Tec MFPs affected versions not specified Description: The issue concerns configuration-related APIs in Sharp and Toshiba Tec MFPs that are insufficiently restricted, allowing non-administrative users to execute some...
Sharp MFP 安全漏洞
Sharp MFP is a series of multifunction printers from Sharp Japan. A security vulnerability exists in Sharp MFP that stems from insufficiently restricted API permissions, which allows a non-administrative user to execute some configuration APIs...
