314 matches found
CVE-2023-4605
The CVE-2023-4605 case describes an vulnerability in Lenovo XClarity Administrator (LXCA) where a valid authenticated LXCA user can potentially leverage an unauthenticated API endpoint to retrieve system event information. Affected component: LXCA’s API surface exposing system event data. Root ca...
CVE-2023-4605: Exposure of Sensitive System Information to an Unauthorized Control Sphere
A valid authenticated Lenovo XClarity Administrator LXCA user can potentially leverage an unauthenticated API endpoint to retrieve system event information...
Tramyardg Autoexpress 1.3.0 Authentication Bypass Vulnerability
Tramyardg Autoexpress version 1.3.0 allows for authentication bypass via unauthenticated API access to admin functionality. This could allow a remote anonymous attacker to delete or update vehicles as well as upload images for vehicles. Exploit Title: tramyardg autoexpress - Authentication Bypass...
Tramyardg Autoexpress 1.3.0 Authentication Bypass
Exploit Title: tramyardg autoexpress - Authentication Bypass Google Dork: N/A Date: 11/28/2023 Exploit Author: Scott White Vendor Homepage: https://github.com/tramyardg/autoexpress Version: v1.3.0 Tested on: Ubuntu 22.04.3 LTS + Apache/2.4.52 CVE : CVE-2023-48902 References:...
CVE-2024-22422
AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versions prior to commit 08d33cfd8 an unauthenticated API route file export can allow attacker to crash the server resulting in a denial of...
CVE-2024-22422
CVE-2024-22422 affects AnythingLLM. The vulnerability is in the public, unauthenticated data-export API route that uses the filename parameter to export files. A crafted input can bypass directory-filtering and crash the server when the export is deleted, yielding an unauthenticated Denial of Ser...
The vulnerability in the Web interface of the Cisco Unity Connection system allows a perpetrator to execute arbitrary commands with root privileges.
The vulnerability of the Cisco Unity Connection messaging system’s web management interface is related to the lack of authentication in the application programming interface. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges by loading...
PT-2024-2582 · Lenovo · Lenovo Xclarity Administrator
Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Administrator affected versions not specified Description: The issue is related to information disclosure and can be exploited by a remote attacker to gain unauthorized access to an API endpoint without authentication. A valid...
CVE-2023-6595
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold...
PT-2023-32709 · Ipswitch · Whatsup Gold
Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1 Description: The issue is related to an API endpoint missing an authentication mechanism, allowing an unauthenticated attacker to enumerate ancillary credential information stored within the software...
PT-2023-32631 · Ipswitch · Whatsup Gold
Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1 Description: An API endpoint in WhatsUp Gold was found to be missing an authentication mechanism, allowing an unauthenticated attacker to enumerate information related to a registered device being monitor...
CVE-2023-46326
ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation...
CVE-2023-46326: Insufficient Session Expiration
ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation...
CVE-2023-44324
Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password. Exploitation of this...
CVE-2023-30131
An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls...
CVE-2023-30131
An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls...
CVE-2023-30131: Improper Control of Generation of Code
An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls...
CVE-2023-30131
CVE-2023-30131 affects IXP EasyInstall 6.6.14884.0. The issue allows attackers to run arbitrary commands and escalate privileges via unauthenticated API calls, with the NVD entry noting a high-impact remote code execution potential (CVSS v3.1: 9.8). Connected sources consistently describe command...
