CVE-2024-44076: Improper Privilege Management

In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...

CVE-2024-5213: Insertion of Sensitive Information Into Sent Data

In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login POST /api/request-token and after account creations POST /api/admin/users/new. This exposure occurs because the entire User object,...

CVE-2024-37014: Improper Control of Generation of Code

Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/customcomponent" endpoint and provide a Python script...

CVE-2024-3104: Improper Neutralization of Special Elements used in an OS Command

A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the POST /api/system/update-env endpoint, which allows for the execution of...

CVE-2023-49959: Improper Neutralization of Special Elements used in a Command

In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename parameter in POST requests to the /api/updater/ctrl/startupdate...

CVE-2024-24776: Improper Access Control

Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/membercount API resulting in channel member counts being leaked to a user without permissions...

CVE-2023-40577: Improper Neutralization of Input During Web Page Generation

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in...

CVE-2023-3584

Mattermost CVE-2023-3584 affects the POST /api/v4/teams endpoint. The root cause is improper authorization checks when a team override scheme ID is supplied, enabling an authenticated attacker who knows a valid Team Override Scheme ID to create a new team using that scheme. Documents consistently...

PT-2023-25337 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from a failure to properly check authorization for the "POST /api/v4/teams" endpoint when a team override scheme ID is passed in the request. This allows an authenticate...

CVE-2023-3584: Incorrect Authorization

Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme...

CVE-2023-22487: Improper Access Control

Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special @" "p syntax. The following behavior never changes no matter if the actor should be able to read the mentioned pos...

CVE-2022-24189: Incorrect Authorization

The usertoken authorization header on the Ourphoto App version 1.4.1 /apiv1/ end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other use...

CVE-2021-32794: Improper Authentication

ArchiSteamFarm is a C application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code POST /Api/ASF ASF API endpoint responsible for updating global ASF config incorrectly removed IPCPassword from the resulting config when the caller did not...

CVE-2021-25812: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/setonlineclient...

VMware Harbor 1.7.x < 1.7.6, 1.8.x < 1.8.3 (VMSA-2019-0015)

The version of VMware Harbor installed on the remote host is 1.7.x prior to 1.7.6 or 1.8.x prior to 1.8.3. It is, therefore, affected by a privilege escalation vulnerability in the POST /api/users API endpoint due to insufficient checks of user privileges. An authenticated, remote attacker can...

CVE-2019-16097: Missing Authorization

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...

PT-2019-14506 · Vmware · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions 1.7.0 through 1.8.2 Description: The issue allows non-admin users to create admin accounts via the "POST /api/users" API endpoint, when Harbor is set up with a DB as the authentication backend and allows users to do...