12 matches found
Malicious code in elephant-tusk-runner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ddbdcdca1756bee69586881547c9e63f555685a2e5e3daa68a9519987edd37a server.js starts an Express + WebSocket server via app.listenPORT,... with no host argument, defaulting the bind to 0.0.0.0, with fully open CORS...
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Summary PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. Details The vulnerable server is the shippe...
CVE-2026-24321
SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does...
CVE-2026-24321
CVE-2026-24321 concerns SAP Commerce Cloud, where multiple API endpoints are exposed to unauthenticated users. The issue allows retrieval of information not intended for public access via the front-end. The documented impact is limited to confidentiality (low), with no reported impact to integrit...
PT-2026-7220
Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud affected versions not specified Description SAP Commerce Cloud has API endpoints accessible to unauthenticated users. These endpoints allow unauthorized retrieval of sensitive information not intended for public access throu...
CVE-2022-25319
An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled...
CVE-2022-25319
An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled...
Design/Logic Flaw
An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled...
CVE-2022-25319
An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled...
CVE-2022-25319
An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled...
PT-2022-17207 · Cerebrate · Cerebrate
Name of the Vulnerable Software and Affected Versions: Cerebrate versions through 1.4 Description: An issue was discovered where endpoints could be open even when not enabled. Recommendations: For versions through 1.4, consider disabling endpoints that are not in use to minimize the risk of...
