5081 matches found
VOOKI - Web Application Vulnerability Scanner
Vooki is a free web application vulnerability scanner. Vooki is a user-friendly tool that you can easily scan any web application and find the vulnerabilities. Vooki includes Web Application Scanner, Rest API Scanner, and reporting section. Vooki – Web Application Scanner can help you to find the...
billcapture.energycap.com XSS vulnerability
Open Bug Bounty ID: OBB-633428 Description| Value ---|--- Affected Website:| billcapture.energycap.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Security Bulletin: Multiple security vulnerabilities in Tivoli Storage Manager (IBM Spectrum Protect) Operations Center (CVE-2016-6043, CVE-2016-6044, CVE-2016-6045, CVE-2106-6046)
Summary Multiple security vulnerabilities exist in Tivoli Storage Manager IBM Spectrum Protect Operations Center as described under Vulnerability Details. Vulnerability Details CVEID: CVE-2016-6043 DESCRIPTION: Tivoli Storage Manager Operations Center could allow a local user to take over a...
Security Bulletin: A security vulnerability has been identified in IBM Maximo Asset Management which could allow an attacker to obtain sensitive information via REST API (CVE-2015-7452)
Summary A security vulnerability has been identified in IBM Maximo Asset Management which could allow an attacker to obtain sensitive information via REST API. Vulnerability Details CVEID: CVE-2015-7452 DESCRIPTION: A security vulnerability has been identified in IBM Maximo Asset Management which...
Security Bulletin: IBM Forms Experience Builder vulnerable to CSRF when configured with non default settings (CVE-2016-2884)
Summary A cross-site request forgery attack is possible when configured with non default settings, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2016-2884 DESCRIPTION: IBM Forms Experience Builder is vulnerable to cross-site request forgery, when configure...
Security Bulletin: API Connect Portal is affected by multiple Drupal vulnerabilities
Summary IBM API Connect has addressed the following vulnerabilities. API Connect Portal is affected by multiple Drupal vulnerabilities. Vulnerability Details Vulnerability Details CVEID:CVE-2017-6924 DESCRIPTION: Drupal could allow a remote attacker to bypass security restrictions, caused by a fl...
Security Bulletin: Incorrect authorization for update of process instance variables in IBM Business Process Manager (CVE-2016-0349)
Summary Due to incorrect authorization for update of process instance variables, users without required permission can update process instance variables in IBM Business Process Manager. Vulnerability Details CVEID: CVE-2016-0349 DESCRIPTION: IBM Business Process Manager allows authenticated users...
Security Bulletin: Insufficient authorization in Service REST API and cross site scripting vulnerability in REST API affecting IBM Business Process Manager (CVE-2015-1905, CVE-2015-1906)
Summary IBM Business Process Manager REST API is vulnerable to cross site scripting due to insufficiently restricted parameter values for controlling content types. IFixes shipped with this advisory also close an additional vulnerability due to insufficient authorization checks on interacting wit...
Security Bulletin: Insufficient authorization check in IBM Business Process Manager (BPM) Search REST API (CVE-2014-6139)
Summary Using the Search REST API, non-administrative users can search for task and process instances that they are not allowed to see by specifying a parameter that should be available only to administrative users. Vulnerability Details CVE ID: CVE-2014-6139 CVSS Base Score: 3.5 CVSS Temporal...
CVE-2016-10524
i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of...
CVE-2016-10524
i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of...
Design/Logic Flaw
i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of...
CVE-2016-10524
i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of...
Google Patches reCAPTCHA Bypass
Google has fixed a bypass for its reCAPTCHA authentication mechanism – the Turing test-based methodology for proving that website users aren’t robots, commonly spotted on log-in pages online. The news comes as Google releases a new version of reCAPTCHA in beta. Google has been working on refining...
Cross site request forgery (csrf)
The REST API in Dataiku DSS before 4.2.3 allows remote attackers to obtain sensitive information i.e., determine if a username is valid because of profile pictures visibility...
CVE-2018-10732
The REST API in Dataiku DSS before 4.2.3 allows remote attackers to obtain sensitive information i.e., determine if a username is valid because of profile pictures visibility...
CVE-2018-10732
Dataiku DSS REST API (affected product: Dataiku DSS) prior to version 4.2.3 is affected. The vulnerability arises from profile pictures visibility in the REST API, enabling remote attackers to determine whether a username is valid (information disclosure). The root cause is insufficient access co...
CVE-2018-10732
The REST API in Dataiku DSS before 4.2.3 allows remote attackers to obtain sensitive information i.e., determine if a username is valid because of profile pictures visibility...
Any user able to manage space watcher using REST API
h3. Summary Any Confluence user is able to manage Space Watcher by using REST API h3. Steps to Reproduce Create a user that belongs to the "confluence-users" group example: user1 Using an Adminstrator user, create a new space and restrict the space to the administrator user As the normal user...
Burpa - A Burp Suite Automation Tool
A Burp Suite Automation Tool With Slack Integration. Requirements burp-rest-api Burp Suite Professional slackclient Usage $ python burpa.py -h / / / / / / / / / / / // / // / / / // / // / /./,// / ./,/ // burpa version 0.1 / by 0x4D31 usage: burpa.py -h -a scan,proxy-config,stop -pP PROXYPORT...