384 matches found
MantisBT < 2.28.1 - SOAP API Authentication Bypass
Mantis Bug Tracker 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username. id:...
Go365
Go365 v2.0 Correction des problèmes de passerelle AWS merci h0useh3ad ! Ne plante plus lorsque les connexions au serveur proxy échouent Ajout du point de terminaison graph Veuillez lire l'intégralité de ce README avant d'utiliser Go365 ! Go365 est un outil conçu pour effectuer des attaques...
api-scanner-docker
API Scanner - 자체 호스트 배포 API Scanner는 REST 및 SOAP API의 취약점을 OpenAPI/Swagger 명세서와 WSDL 파일을 사용해 스캔하는 자동화된 API 보안 테스트 도구입니다. 전제 조건 Docker Engine 20.10+ Docker Compose v2 Python 3.6+ 설정 스크립트용 8 GB RAM 최소 16 GB 권장 20 GB 디스크 공간 빠른 시작 1. 이 저장소 클론 root@kitploit: git clone...
CVE-2020-0618_DETECTION
CVE-2020-0618 - Обнаружение RCE в Microsoft SQL Server Reporting Services SSRS PoC 📜 Описание Это простой PoC для обнаружения CVE-2020-0618 , уязвимости удаленного выполнения кода, затрагивающей Microsoft SQL Server Reporting Services SSRS. Уязвимость существует из-за неправильной проверки пути в...
kyocera-cve-2022-1026
kyocera-cve-2022-1026 Неаутентифицированная уязвимость извлечения данных в принтерах Kyocera, позволяющая восстановить пароли адресной книги и пароли доменных учётных записей в открытом виде. Обзор уязвимости В 2021 году во время пентеста я экспериментировал с толстым клиентом Kyocera, используем...
cve-2023-34960
cve-2023-34960 chamilo soap api rce /webservices/additionalwebservices.php...
Chamilo Command Injection
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11. up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. id: CVE-2023-34960 info: name: Chamilo Command Injection author: DhiyaneshDK severity: critical...
CVE-2026-47156
MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...
EUVD-2026-75087
MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...
CVE-2026-47156
MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user holding a valid cookie_string (obtainable from the MANTIS_STRING_COOKIE browser cookie after login) can authenticate as any other user by supplying that cookie_stri...
CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...
CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...
CVE-2026-8339
The CVE-2026-8339 issue affects Coverity Connect SOAP API, with SQL injection identified in versions 2024.6.0 through 2026.3.0 (inclusive). An authenticated attacker can send a crafted payload to achieve full read access to database contents and perform other unauthorized commands. The vulnerabil...
GHSA-M7PH-9558-MRX3 MantisBT: REST API unauthorized Issue status change
A MantisBT user having $gupdatebugthreshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $gsetstatusthreshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...
CVE-2026-42071
Summary: CVE-2026-42071 affects MantisBT, specifically versions 2.23.0 through 2.28.1, where a missing authorization check in the file visibility function allows any authenticated user (REPORTER+) to download attachments from private bugnotes via REST API GET /api/rest/issues/{id}/files and SOAP ...
MantisBT has a Private Bugnote Attachment Content Leak via REST API
A missing authorization check in MantisBT's file visibility function allows any authenticated user REPORTER+ to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/id/files and SOAP API mcissueattachmentget endpoint. Impact -...
GHSA-PW5X-2MF9-3XC8 MantisBT has a Private Bugnote Attachment Content Leak via REST API
A missing authorization check in MantisBT's file visibility function allows any authenticated user REPORTER+ to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/id/files and SOAP API mcissueattachmentget endpoint. Impact -...
Missing Authorization
Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Missing Authorization in the file visibility process. An attacker can access unauthorized file attachments by sending requests to the REST API or SOAP API endpoints. Remediation Upgrade...
Authentication Bypass by Primary Weakness
Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the SOAP API due to improper type checking on the password parameter. An attacker can gain unauthorized access to user accounts by sending a crafted...