Information disclosure

Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted b...

CVE-2021-45310

Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted b...

CVE-2021-45310

CVE-2021-45310 affects Sangoma Switchvox version 102409 and is an information-disclosure vulnerability caused by improper access restriction. An unauthenticated HTTP GET to https://Switchvox-IP/main?cmd=invalid_browser (and related invalid_browse URL) can exfiltrate user data such as first/last n...

Input Validation Error

firefox is vulnerable to input validation error. The vulnerability exists due to lack of URL restrictions when scanning QR codes allowing navigation to some URLs that do not point to web content. This bug only affects Firefox for Android. Other operating systems are unaffected...

Access Restriction Bypass

Drupal is vulnerable to access restriction bypass. The sites with JSON:API module enabled bypass the restriction of access to certain content...

PT-2022-1953

Name of the Vulnerable Software and Affected Versions TP-LINK TL-WR840NES version V6.20 180709 Description The issue is related to a command injection vulnerability via the component oal setIp6DefaultRoute. This vulnerability is associated with the lack of neutralization of special elements when...

CVE-2021-46361

The CVE-2021-46361 issue affects Magnolia CMS, specifically the Freemark Filter in Magnolia CMS v6.2.11 and earlier. The root cause is a bypass in the Freemark Filter that allows attackers to execute arbitrary code through a crafted FreeMarker payload, effectively enabling remote code execution w...

CVE-2021-22804

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the context of the user running IGSS, due to missing validation of user supplied data in network messages. Affected Product: Interactive Graphica...

UBUNTU-CVE-2020-13677

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected...

Design/Logic Flaw

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected...

CVE-2022-24112

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...

Default configuration

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...

CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...

CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...

CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...

CVE-2022-24112

CVE-2022-24112 affects Apache APISIX. It arises from the batch-requests plugin, where a bug can bypass the Admin API IP restriction, enabling remote code execution. Exploits/PoCs exist for APISIX 2.12.0–2.12.1 demonstrating RCE via admin API path and Lua code injection in routes, with documented ...

CVE-2022-24112

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...

PT-2022-10327 · Tokheim · Tokheim Profleet Dialog

Name of the Vulnerable Software and Affected Versions: Tokheim Profleet DiaLOG version 11.005.02 Description: The issue is related to SQL Injection. The component affected is the Field UserLogin parameter on the logon page. Recommendations: For Tokheim Profleet DiaLOG version 11.005.02, consider...

PT-2022-12336 · Tcpreplay +2 · Tcpreplay +2

Name of the Vulnerable Software and Affected Versions: tcpreplay version 4.3.4 Description: The issue is related to a Reachable Assertion in the add tree ipv6 function at tree.c. Recommendations: For tcpreplay version 4.3.4, consider restricting access to the add tree ipv6 function until a patch ...

PT-2022-1534 · Apple +7 · Webkit +13

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 15.3 iOS versions prior to 15.3.1 iPadOS versions prior to 15.3.1 macOS Monterey versions prior to 12.2.1 PS4 versions 6.xx through 9.xx PS5 versions 1.xx through 5.xx Description: The issue is related to a...