127 matches found
CVE-2020-17519
CVE-2020-17519 Apache Flink RESTful API 任意ファイル読み取り Apache Flink は、Java と Scala で開発された、有界および無界なデータストリームに対するステートフル計算のためのフレームワークおよび分散処理エンジンです。Apache Flink 1.11.0 で導入された変更（1.11.1 および 1.11.2 でもリリース）により、攻撃者は JobManager プロセスの RESTful API を介して、JobManager...
CVE-2020-13937
CVE-2020-13937 1.脆弱性の説明： Apache Kylinには、認証なしで設定情報を公開するrestful apiがあります。 2再現 脆弱性がある場合の比較 脆弱性がない場合の比較 PoCの作成 単一URLの正しい検証 ：pocsuite -r CVE-2022-26134.py -u url 単一URLの誤った検証：pocsuite -r CVE-2022-26134.py -u url バッチスキャン：pocsuite -r CVE-2022-26134.py -u url.txt 3.スクリプトコード from collections import...
BreakEscape
BreakEscape Rails Engine 사이버보안 훈련용 탈출 게임으로, 마운트 가능한 Rails Engine 형태입니다. Features 24개 이상의 사이버보안 탈출 시나리오 2개 테이블 스키마를 사용한 서버 측 진행 상황 추적 ERB를 통한 게임 인스턴스별 무작위 비밀번호 생성 NPC 대화를 위한 JIT Ink 스크립트 컴파일 다형성 플레이어 지원 User/DemoUser Pundit 권한 부여 게임 상태 관리를 위한 RESTful API 세션 기반 상태 유지 Installation Gemfile에 다음을 추가하세요...
syft
Syft A CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. Exceptional for vulnerability detection when used with a scanner likeGrype. Features Generates SBOMs for container images , filesystems , archives see the docs for a full list of...
xxl-job
xxl-job エグゼキュータ RESTful API 未認証アクセス RCE 実行ログConsoleを利用することでコマンド実行成功の結果を取得できます： 例： /joblog/logDetailPage?id=xxxx JDK環境変数の確認 String var3 = System.getProperties.toString; System.out.printlnvar3; コマンド実行 /jobcode?jobId=x import com.xxl.job.core.log.XxlJobLogger; import...
hackazon
Hackazon Hackazon은 오늘날의 리치 클라이언트 및 모바일 애플리케이션에서 사용되는 것과 동일한 기술로 구축된 무료 취약 테스트 사이트이자 온라인 스토어프론트입니다. Hackazon은 AJAX 인터페이스, 엄격한 워크플로우, 그리고 동반 모바일 앱에서 사용되는 RESTful API를 갖추고 있어 IT 보안 전문가에게 독특하게 효과적인 훈련 및 테스트 환경을 제공합니다. 또한 SQL 인젝션, 크로스 사이트 스크립팅 등 여러분이 좋아하는 취약점들로 가득 차 있습니다. 오늘날의 웹 및 모바일 애플리케이션, 그리고 웹 서비...
hackazon
Hackazon Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective...
Drupal-cve-2019-6340
Research CVE 2019-6340 Drupal 8 のコア RESTful API サービスモジュールが有効になっており、ユーザーがサーバーに対して GET、PATCH、または POST リクエストを送信できるようになります。 GET リクエストだけでもコード実行の脆弱性を引き起こすのに十分であり、PATCH メソッドが無効になっていても同様です サイトには、Drupal 8 の JSON-API や Drupal 7 の REST サービスなど、他の Web サービスモジュールが有効になっている。 POC の必要条件 DOCKER.IO DRUPAL 8.6.9 SQL 5...
CVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
CVE-2026-68492
The Plesk control panel is affected by an untrusted search path vulnerability in versions 18.0.34 to 18.0.80.7 , 18.0.81 to 18.0.81.0 , and specifically within the Plesk RESTful API extension from version 2.4.2 to 2.4.6 . This flaw allows remote authenticated users to achieve arbitrary code execu...
CVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
EUVD-2026-85621
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
CVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
CVE-2026-68492: Untrusted Search Path
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
PT-2026-97570
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
[SECURITY] Fedora 43 Update: rest-0.10.2-5.fc43
This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
GO-2026-5515 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base...