108 matches found
CVE-2020-13937
CVE-2020-13937 1.漏洞描述： Apache Kylin有一个restful api会在没有任何认证的情况下暴露配置信息。 2复现 有漏洞对比 无漏洞对比 编写poc 验证正确单个url ：pocsuite -r CVE-2022-26134.py -u url 验证错误单个url：pocsuite -r CVE-2022-26134.py -u url 批量扫描：pocsuite -r CVE-2022-26134.py -u url.txt 3.脚本代码...
hackazon
Hackazon Hackazon 是一个免费的、存在漏洞的测试网站，它是一个在线商店，使用了当今富客户端和移动应用所采用的技术构建。Hackazon 拥有 AJAX 界面、严格的工作流以及由配套移动应用使用的 RESTful API，为 IT 安全专业人员提供了独特的有效训练和测试平台。而且，它充满了你喜爱的各种漏洞，如 SQL 注入、跨站脚本等。 当今的 Web 和移动应用以及 Web 服务包含大量新技术，这些技术并未得到充分的安全性测试。IT 安全专业人员迫切需要一种存在漏洞的 Web 应用，用于测试其工具的有效性并磨练自身技能。 Hackazon...
hackazon
Hackazon Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective...
BreakEscape
BreakEscape: Motor de Rails Juego de sala de escape de entrenamiento en ciberseguridad como un motor de Rails montable. Características Más de 24 escenarios de sala de escape de ciberseguridad Seguimiento del progreso del lado del servidor con esquema de 2 tablas Contraseñas aleatorias por...
syft
Syft A CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. Exceptional for vulnerability detection when used with a scanner likeGrype...
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
GO-2026-5515 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base...
CVE-2026-56248 Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy
Cap-go capgo capgo-backend before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the auditlogs table's Row-Level Security RLS policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection,...
SUSE CVE-2026-33065
Free5GC is an open-source Linux Foundation project for 5th generation 5G mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request from UDR into a 500 Internal Server Error when handling DELETE requests with an empty supi path parameter. This leak...
CVE-2025-32991
In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution...
GO-2026-4481 Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise in github.com/milvus-io/milvus
Milvus: Unauthenticated Access to Restful API on Metrics Port 9091 Leads to Critical System Compromise in github.com/milvus-io/milvus. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
CVE-2023-31585
Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php...
EUVD-2021-19573
Malware in sbrugna...
EUVD-2019-0308
Malware in sbrugna...
EUVD-2023-35882
Malicious code in bioql PyPI...
EUVD-2022-1868
Malicious code in bioql PyPI...
CVE-2025-32896
Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...
CVE-2025-32896
Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...