CVE-2024-26026

CVE-2024-26026: SQL injection in BIG-IP Next Central Manager API (URI) allows an unauthenticated remote attacker to execute malicious SQL statements. Affected: BIG-IP Next Central Manager versions 20.0.1–20.1.0. Remediation: upgrade to 20.2.0 or later as specified by K000138733; Nessus/K0- querie...

BIT-APISIX_DASHBOARD-2021-45232 security vulnerability on unauthorized access.

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...

CVE-2023-42358

An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service DoS via a crafted request to the E2Manager API component...

io.apiman:apiman-gateway-engine-ispn (1.2.2.final), io.apiman:apiman-manager-api-ispn (1.2.2.final) +48 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (8.1.1.final)

org.infinispan:infinispan-commons MAVEN version 8.1.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - io.apiman:apiman-gateway-engine-ispn 1.2.2.final - io.apiman:apiman-manager-api-ispn...

Rocky Linux 8 : squid:4 (RLSA-2021:4292)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4292 advisory. - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a...

Cross-site Scripting (XSS)

Overview TinyMCE is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Notification Manager API due to improper input sanitization. An attacker can execute arbitrary JavaScript when a notification is presented i...

CVE-2023-45819

Removed by vendor...

CVE-2023-45819 Cross-site Scripting vulnerability in TinyMCE notificationManager.open API

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully craft...

CVE-2023-45819

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully craft...

PT-2023-29708 · Tinymce · Tinymce

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.10.8 TinyMCE versions prior to 6.7.1 Description: A cross-site scripting XSS vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system,...

CVE-2023-45819: Improper Neutralization of Input During Web Page Generation

TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully craft...

io.apicurio:apicurio-registry-tenant-manager-api (>=2.1.0.rc1, <=2.1.0.final), io.quarkus:quarkus-keycloak-authorization (1.13.2.final) +2 more potentially affected by CVE-2023-1584 via io.quarkus:quarkus-oidc (1.13.2.final)

io.quarkus:quarkus-oidc MAVEN version 1.13.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-oidc and may be impacted: - io.apicurio:apicurio-registry-tenant-manager-api =2.1.0.rc1, =2.1.0.final -...

Amazon Linux 2 : squid (ALASSQUID4-2023-004)

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-004 advisory. Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an...

CVE-2023-22644

A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.1.3.final, <=1.2.1.final), io.apiman:apiman-manager-api-security (>=1.1.2.final, <=1.1.3.final) +82 more potentially affected by CVE-2023-0105 via org.keycloak:keycloak-core (1.2.0.cr1)

org.keycloak:keycloak-core MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.1.3.final, =1.1.2.final, =1.1.2.final,...

io.apiman:apiman-manager-api-micro (1.2.7.final), io.apiman:apiman-manager-api-war (1.2.7.final) +3 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.2.7.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.2.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 1.2.7.final -...

io.apiman:apiman-distro-db (1.2.0.final), io.apiman:apiman-distro-db-es (1.2.0.final) +11 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.2.0.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-distro-db 1.2.0.final - io.apiman:apiman-distro-db-es...

io.apiman:apiman-manager-api-micro (1.5.4.final), io.apiman:apiman-manager-api-war (1.5.4.final) +3 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.5.4.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 1.5.4.final -...

io.apiman:apiman-distro-db (1.1.3.final), io.apiman:apiman-distro-db-es (1.1.3.final) +11 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.1.3.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-distro-db 1.1.3.final - io.apiman:apiman-distro-db-es...

io.apiman:apiman-manager-api-micro (1.2.9.final), io.apiman:apiman-manager-api-war (1.2.9.final) +3 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.2.9.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.2.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 1.2.9.final -...