135 matches found
xxl-job
Неавторизованный доступ к RESTful API исполнителя xxl-job RCE Используя Console журнала выполнения, можно получить результат успешного выполнения команды: Пример: /joblog/logDetailPage?id=xxxx Просмотр переменных окружения JDK String var3 = System.getProperties.toString; System.out.printlnvar3;...
syft
Syft A CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. Exceptional for vulnerability detection when used with a scanner likeGrype. Features Generates SBOMs for container images , filesystems , archives see the docs for a full list of...
CVE-2020-13937
CVE-2020-13937 1. Описание уязвимости: Apache Kylin имеет restful API, который предоставляет информацию о конфигурации без какой-либо аутентификации. 2. Воспроизведение Сравнение с уязвимостью Сравнение без уязвимости Написание PoC Проверка правильного URL: pocsuite -r CVE-2022-26134.py -u url...
BreakEscape
BreakEscape Moteur Rails Jeu d'évasion d'entraînement en cybersécurité sous forme de moteur Rails montable. Fonctionnalités Plus de 24 scénarios d'évasion en cybersécurité Suivi de progression côté serveur avec un schéma de 2 tables Mots de passe aléatoires par instance de jeu via ERB Compilation...
hackazon
Hackazon Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective...
hackazon
Hackazon Hackazon est un site de test gratuit et vulnérable qui est une vitrine en ligne construite avec les mêmes technologies utilisées dans les applications clientes riches et mobiles d'aujourd'hui. Hackazon dispose d'une interface AJAX, de flux de travail stricts et d'API RESTful utilisées pa...
CVE-2020-17519
CVE-2020-17519 Apache Flink RESTful API произвольное чтение файлов Apache Flink — это фреймворк и механизм распределенной обработки для вычислений с состоянием над неограниченными и ограниченными потоками данных, разработанный с использованием Java и Scala. Изменение, введённое в Apache Flink...
Drupal-cve-2019-6340
Recherche CVE 2019-6340 Le site avec le module Drupal 8 core RESTful API Services activé permet à l'utilisateur d'envoyer des requêtes GET, PATCH ou POST au serveur. Une requête GET suffit pour déclencher la vulnérabilité d'exécution de code même si la méthode PATCH est désactivée Le site a tout...
CVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
EUVD-2026-85621
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
CVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
CVE-2026-68492
The Plesk control panel is affected by an untrusted search path vulnerability in versions 18.0.34 to 18.0.80.7 , 18.0.81 to 18.0.81.0 , and specifically within the Plesk RESTful API extension from version 2.4.2 to 2.4.6 . This flaw allows remote authenticated users to achieve arbitrary code execu...
CVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
PT-2026-97570
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
CVE-2026-68492: Untrusted Search Path
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...
[SECURITY] Fedora 43 Update: rest-0.10.2-5.fc43
This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
GO-2026-5515 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base...