239 matches found
Heketi OS Command Injection Vulnerability
Heketi is a REST-based GlusterFS management framework that provides a RESTful management interface that can be used to manage the lifecycle of GlusterFS. server API is one of the server interfaces. An OS command injection vulnerability exists in the user request handling of the server API in Heke...
CVE-2017-15103
A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation...
CVE-2017-15103: Improper Neutralization of Special Elements used in an OS Command
A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation...
PT-2017-13871
Name of the Vulnerable Software and Affected Versions Heketi version 5 Description A security flaw was discovered in the Heketi server API, allowing an authenticated user to send specially crafted requests, potentially leading to remote command execution as the user running the Heketi server and...
GHSA-6494-V9FQ-FGQ2 Keystone is vulnerable to CSV injection
CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...
CVE-2017-15879
CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...
CVE-2017-15879
CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...
CVE-2017-15879
CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...
CVE-2017-15879: Improper Input Validation
CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...
PT-2017-14258
Name of the Vulnerable Software and Affected Versions KeystoneJS versions prior to 4.0.0-beta.7 Description A CSV Injection issue exists due to mishandled values in CSV exports. This issue affects the admin/server/api/download.js and lib/list/getCSVData.js files. Recommendations For versions prio...
PT-2014-8390
Name of the Vulnerable Software and Affected Versions Cisco Jabber affected versions not specified Description The issue allows remote attackers to obtain sensitive information by sniffing the network during an HTTP response, specifically when using HTML5 in the Guest Server API. This can occur...
CVE-2010-5142
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...
CVE-2010-5142
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...
CVE-2011-5097
chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...
CVE-2011-5098
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...
CVE-2010-5142: Undefined Security Weakness
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...
CVE-2011-5098: Undefined Security Weakness
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...
xMatters AlarmPoint Java Web Server API 3.2.1 Cross Site Scripting
Information -------------------- Name : XSS Persistent vulnerability in xMatters AlarmPoint Java Web Server API Software : xMatters AlarmPoint Vendor Homepage : http://www.xmatters.com Vulnerability Type : Cross-Site Scripting Severity : High Researcher : Juan Sacco Description ------------------...
