264 matches found
Malicious code in @igdb/internal-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ec79cfda0dc3373cf41672610a4ab803332e33b369873a2d18a0932ba8b807d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-348 Malicious code in @igdb/internal-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ec79cfda0dc3373cf41672610a4ab803332e33b369873a2d18a0932ba8b807d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-29556
The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints...
Server side request forgery (ssrf)
The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints...
CVE-2022-29556
The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints...
Northern.tech Mender Enterprise 代码问题漏洞
Northern.tech Mender Enterprise is a wireless update manager for IoT devices from Northern.tech. A security vulnerability exists in Northern.tech Mender Enterprise prior to version 3.2.2, which stems from the iot-manager microservice 1.0.0 that allows SSRF because the Azure IoT Hub integration...
CVE-2021-20238
It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...
CVE-2022-26500
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code...
CVE-2022-26500
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code...
CVE-2022-26500
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...
Veeam Backup&Replication 路径遍历漏洞
Veeam Backup & Replication is a suite of data protection software from the Swiss company Veeam. The software provides backup, replication and recovery for VMware and Hyper-V VMs, physical and cloud environments. A path traversal vulnerability exists in Veeam Backup & Replication 9.5U3, 9.5U4, 10....
CVE-2021-43051
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of thos...
CVE-2021-43051
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of thos...
CVE-2021-43051: Undefined Security Weakness
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of thos...
PT-2021-23737
Name of the Vulnerable Software and Affected Versions TIBCO Spotfire Server versions 10.10.6 and below TIBCO Spotfire Server versions 11.0.0 through 11.4.1 TIBCO Spotfire Server versions 11.5.0 through 11.6.0 Description The Spotfire Server component contains a difficult to exploit vulnerability...
WHO COVID-19 Mobile App: Internal API endpoint is accesible for everyone
Summary: It looks like the endpoint /internal/cron/refreshCaseStats as configured in cron.yaml https://github.com/WorldHealthOrganization/app/blob/master/server/appengine/src/main/webapp/WEB-INF/cron.yamlL3 is accesible for everyone. Since it is configured as a cronjob to run every 5 minutes and...
Mail.ru: Acessed internal api documentation and information
hello team, Anyone can be able to access api documents and files . Actually this domain have proper authentication mechanism. https://apidocs.ucs.ru/ when i browse the above domain , it goes to login page . not possible to create accounts . means can access authenticated people . but when we brow...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data returning decrypted credentials
Summary IBM Watson Discovery for IBM Cloud Pak for Data returns decrypted credentials for data soruces in JSON response of internal API for processing settings. Vulnerability Details Third Party Entry: PSIRT-ADV0022492 DESCRIPTION: Created from Advisory: ADV0022492 CVSS Base score: 4.9 CVSS Vecto...
TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot Vulnerability
Exploit for hardware platform in category web applications Exploit Title: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot Exploit Author: PCEumel Vendor Homepage: https://www.tp-link.com/ Software Link: https://www.tp-link.com/us/support/download/tl-sg105e/Firmware Version: TP-Link...