793 matches found
Directory Traversal
rswag-api is vulnerable to Directory Traversal. The vulnerability exists in the call function of middleware.rb, which allows an attacker to read arbitrary JSON and YAML files via directory traversal, because the library exposes a file that is not in the OpenAPI specification file...
GHSA-VC79-65PR-Q82V rswag vulnerable to arbitrary JSON and YAML file read via directory traversal
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI or Swagger specification file of a project...
CVE-2023-38337
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI or Swagger specification file of a project...
Directory traversal
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI or Swagger specification file of a project...
CVE-2023-38337
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI or Swagger specification file of a project...
CVE-2023-38337
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI or Swagger specification file of a project...
PT-2023-26371 · Rswag · Rswag
Name of the Vulnerable Software and Affected Versions: rswag versions prior to 2.10.1 Description: The issue allows remote attackers to read arbitrary JSON and YAML files via directory traversal. This occurs because rswag-api can expose a file that is not the OpenAPI or Swagger specification file...
rswag 路径遍历漏洞
rswag is an API from the rswag community that seamlessly adds Swagger to Rails-based projects. A security vulnerability exists in versions of rswag prior to 2.10.1, which stems from the fact that the rswag-api can expose a file that is not a project's OpenAPI or Swagger specification file, leadin...
CVE-2023-20136
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper...
Design/Logic Flaw
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper...
CVE-2023-20136
CVE-2023-20136 concerns a privilege-escalation in the OpenAPI of Cisco Secure Workload. An authenticated, read-only user with valid credentials could invoke OpenAPI calls that should require Administrator privileges, enabling actions such as creating/deleting user labels due to RBAC misconfigurat...
CVE-2023-20136
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper...
The vulnerability of the OpenAPI interface of the Cisco Secure Workload protection tool for multi-cloud data centers (previously known as Tetration) allows a malicious actor to escalate their privileges.
The vulnerability of the OpenAPI interface of the Cisco Secure Workload protection tool for multi-cloud data centers relates to shortcomings in role-based access control when performing operations. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...
Cisco Secure Workload OpenAPI Elevation of Privilege Vulnerability
Cisco Secure Workload is a software from Cisco that allows users to install software agents on their application workloads. A security vulnerability exists in the Cisco Secure Workload OpenAPI, which can be exploited by remote attackers to submit a special request that can be used to perform...
Cisco Secure Workload 安全漏洞
Cisco Secure Workload is a software from Cisco that allows users to install software agents on their application workloads. A security vulnerability exists in the Cisco Secure Workload OpenAPI, which can be exploited by remote attackers to submit a special request that can be used to perform...
CVE-2023-20136
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper...
Cisco Secure Workload Authenticated OpenAPI Privilege Escalation Vulnerability
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper...
dk.mada.jaxrs:openapi-jaxrs-client (>=0.9.12 <=0.9.16), io.jstach:jstachio-jmustache (>=0.6.0 <=1.0.0) +5 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (>=0.6.0 <=1.0.0)
io.jstach:jstachio MAVEN version =0.6.0, =0.9.12, =0.6.0, =0.8.0, =0.8.0, =1.0.0 - io.jstach:jstachio-spring-webflux =1.0.0 - io.jstach:jstachio-spring-webflux-example =1.0.0 - io.jstach:jstachio-spring-webmvc =1.0.0 Source cves: CVE-2023-33962 Source advisory: OSV:GHSA-GWXV-JV83-6QJR...
[SECURITY] Fedora 38 Update: python-fastapi-0.95.2-1.fc38
FastAPI is a modern, fast high-performance, web framework for building APIs with Python 3.7+ based on standard Python type hints. The key features are: =EF=BF=BD=EF=BF=BD=EF=BF=BD Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python...
CVE-2023-30845
ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious X-HTTP-Method-Override header value to bypass JWT authentication in specific cases...